Autoscaling Controller  ·  View 29 of 37  ·  5 · Operations

CI/CD and Policy Promotion

Two things ship here — the controller, and the rules it decides by — and only one of them can move a fleet.

Editable source SVG draw.io All views
Author Controller Code Go Policy Change declarative Review Pull Request CODEOWNERS Second Approver ceilings and max Prove Unit and Sim synthetic demand Counterfactual Replay against real history Capacity Diff cost and latency Stage Dry Run on Target journalled only Canary Targets 5% of the fleet Promote Argo CD Sync region by region Version Pinned immutable in journal Revert Roll Back Policy capacity unchanged unacceptable reversals rise Shipping the Controller, and Shipping a Policy Application we own Security / platform Decision point Data store failure / alternate A policy roll-back changes the next decision, never the current capacity. The fleet is not disturbed by the deployment that changes how it will be decided. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • A policy change is proved against recorded history by counterfactual replay before it reaches a target, and the capacity diff is reviewed as part of the change.
  • Dry run, then canary on 5% of targets, then region-by-region promotion.
  • A policy roll-back changes the next decision and never the current capacity. The fleet is not disturbed by a deployment.

Gates

  • Second approver required for fleet ceilings and for any target's max bound.
  • Canary abort on a rise in direction reversals, which is the earliest visible sign of a policy that will oscillate.

Assumptions

  • Counterfactual replay is honest only where signal history covers the window being replayed — 15 days at full resolution, 13 months rolled up.
◀  Multi-Region Topology All views Observability  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 37 views · Azure and open source29-cicd-and-policy-promotion