Deployment strategies: blue-green, canary and gradual
Three methods
Blue-green. Two identical environments; you shift traffic from one to the other, and roll back by reversing the shift. Simple, and requires double the resources briefly.
Canary. A small percentage of traffic to the new version, expanding by metrics. The safest, and requires good monitoring.
Rolling. Replacing instances gradually. A common default, but the interim period runs two versions together — which requires compatibility.
Prerequisites
A real health check that checks dependencies and not just that the process is alive; backward-compatible schema; and deployment decoupled from activation — you release code turned off and turn it on with a switch.
Define in advance what triggers a rollback
Error thresholds, response time and success rate that trigger an automatic rollback. A decision during an incident is always worse than a decision written on a calm morning.
Going deeper
Practice a rollback while everything is fine, at least once a quarter. A mechanism never exercised fails exactly when you need it, and usually over a small detail — a permission, a schema version, or a cache that wasn't cleared.