<p>I am new to kubernetes just doing little R&amp;D on k8s.
was checking out different deployment strategies like rolling update, recreate, blue-green and canary. if am correct the idea behind canary deployment is rolling out new version to set of users. here my questions lets my team has developers and testing team. whenever testing team try to access the application it should redirect to new version of application, is it possible? or canary is only used for having 2 version applications running at same time with one service?</p>

Sugatur Deekshith S N
<h2>Canary Deployment</h2>
<blockquote>
<p>if am correct the idea behind canary deployment is rolling out new version to set of users. here my questions lets my team has developers and testing team.</p>
</blockquote>
<p>The term <em>Canary Deployment</em> does not have a precise definition as what I know. But it usually means that you deploy a new version of your app and only let a small fraction of your traffic hit the new version, e.g. 5% or 15% - and then have a <em>Canary Analyzer</em> (e.g. <a href="https://netflixtechblog.com/automated-canary-analysis-at-netflix-with-kayenta-3260bc7acc69" rel="noreferrer">Kayenta</a>) to analyze the metrics for the new and the old version - and then do an <em>automatic decision</em> to route all your traffic to the new version or to rollback the deployment.</p>
<p>The good thing with this is the high degree of automation - humans does not have to monitor the metrics after the deployment. And if there was a bug in the new version, only a small fraction of your customers were affected. But this is also challenging since you need a certain amount of traffic for a good statistical ground.</p>
<h2>Route based on User property</h2>
<blockquote>
<p>whenever testing team try to access the application it should redirect to new version of application, is it possible?</p>
</blockquote>
<p>What you want here is to route the traffic to a specific version, based on a property of the user, e.g. from the authentication token.</p>
<p>You need a <em>service mesh</em> like e.g. <a href="https://istio.io/" rel="noreferrer">Istio</a> and base your authentication on <a href="https://en.wikipedia.org/wiki/JSON_Web_Token" rel="noreferrer">JWT</a> e.g. <a href="https://openid.net/connect/" rel="noreferrer">OpenID Connect</a> to do this in Kubernetes.</p>
<p>From the <a href="https://istio.io/latest/docs/reference/config/security/request_authentication/" rel="noreferrer">Istio documentation</a>, you need to create a <code>RequestAuthentication</code> and an <code>AuthorizationPolicy</code> for your app.</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
  - issuer: &quot;issuer-foo&quot;
  - issuer: &quot;issuer-bar&quot;
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
 rules:
 - from:
   - source:
       requestPrincipals: [&quot;issuer-foo/*&quot;]
   to:
     hosts: [&quot;example.com&quot;]
 - from:
   - source:
       requestPrincipals: [&quot;issuer-bar/*&quot;]
   to:
     hosts: [&quot;another-host.com&quot;]
</code></pre>
<p>The <a href="https://istio.io/latest/docs/tasks/security/authorization/authz-jwt/#allow-requests-with-valid-jwt-and-list-typed-claims" rel="noreferrer">JWT and list-typed claims</a> part of the documentation describes how to specify rules for a specific user name (<code>sub</code>) or a property / group of users with <code>claims</code>. E.g.</p>
<pre><code>    when:
    - key: request.auth.claims[groups]
      values: [&quot;test-group&quot;]
</code></pre>
