🔵🟢 Blue-Green Deployment with AWS ALB & Jenkins

This document explains Blue-Green Deployment using AWS ALB, EC2, Target Groups, VPC design, NAT Gateway strategy, and Jenkins automation with practical examples and real-world notes. 🚀

---

🔁 Blue-Green Deployment & Sticky Sessions

⚠️ Why Sticky Sessions Are Disabled

In Blue-Green deployments, it is recommended to disable sticky sessions.

🔴 Problem if enabled:

• If DB schema changes (e.g., a new column is added)
• Users stuck on the old target group (Blue) via sticky session
• The old app won’t understand the new DB column
• This can cause runtime errors ❌

✅ Best Practice:

• Keep applications stateless
• Disable stickiness during traffic switch

📝 When Sticky Sessions Are Still Used

In some practical scenarios (especially on JB / App servers):

• Keeping temporary files
• Running grep on logs
• Downloading reports

👉 In such cases, sticky sessions may be used intentionally, but NOT during Blue-Green traffic switching.

---

🌐 VPC CIDR Strategy (AWS)

📦 VPC Overview

• VPC CIDR: 10.0.0.0/16
• Total IPs: 65,536

🗂️ Subnet Design

Purpose	CIDR	AZ	Notes
🌍 Public Subnet 1	10.0.0.0/24	ap-south-1a	ALB & NAT Gateway
🌍 Public Subnet 2	10.0.1.0/24	ap-south-1b	ALB & NAT Gateway
🌍 Public Subnet 3	10.0.2.0/24	ap-south-1c	Optional AZ
🖥️ Private Subnet 1	10.0.10.0/24	ap-south-1a	App servers
🖥️ Private Subnet 2	10.0.11.0/24	ap-south-1b	App servers
🖥️ Private Subnet 3	10.0.12.0/24	ap-south-1c	Optional AZ
🗄️ DB Subnet 1	10.0.20.0/24	ap-south-1a	RDS / DB Tier
🗄️ DB Subnet 2	10.0.21.0/24	ap-south-1b	RDS / DB Tier

---

⚠️ AWS Reserved IPs (Per Subnet)

AWS reserves 5 IP addresses in every subnet:

1. Network address (all 0s)
2. VPC router address (.1)
3. AWS DNS address (.2)
4. Reserved for future use
5. Broadcast address (all 1s – reserved even though AWS doesn’t support broadcast)

---

🌍 NAT Gateway Explained

🔹 What a NAT Gateway Does

Allows private subnets to access the internet outbound (OS updates, package downloads, APIs) without inbound exposure.

💰 Cost: Hourly + Data processed

---

🧩 NAT Gateway Options

1️⃣ None

✔️ Use when:

• Fully isolated workloads
• No internet access required

❌ Risk:

• No package updates
• No external API access

---

2️⃣ Single NAT Gateway (1 AZ)

✔️ Pros:

• Cheaper 💸

❌ Cons:

• Single point of failure

✔️ Use for:

• Dev / Test environments

---

3️⃣ NAT Gateway Per AZ ✅ (Production)

✔️ Pros:

• High Availability
• Lower cross-AZ traffic cost

❌ Cons:

• Higher cost

---

💡 Rule of Thumb

Environment	Recommendation
🧪 Dev / Test	1 NAT Gateway
🏭 Production	NAT Gateway per AZ
🔒 Isolated	No NAT Gateway

---

🔐 Security Group Setup

📘 Concept

Controls inbound & outbound traffic for EC2 and ALB.

🛠️ Practical Setup

• Name: blue-green-sg
• VPC: Blue-Green VPC

🔽 Inbound Rules

Port	Source	Purpose
80	0.0.0.0/0	HTTP
443	0.0.0.0/0	HTTPS
22	Your IP	SSH

🔼 Outbound Rules

• Allow all traffic

---

🖥️ Launch EC2 Instances (Blue & Green)

🔵 Blue Server User Data

#!/bin/bash
apt update && apt install -y nginx
echo "<h1>Blue Version</h1>" > /var/www/html/index.html
systemctl enable nginx && systemctl start nginx

🟢 Green Server User Data

#!/bin/bash
apt update && apt install -y nginx
echo "<h1>Green Version</h1>" > /var/www/html/index.html
systemctl enable nginx && systemctl start nginx

---

🎯 Target Groups & Traffic Switching

• Create two target groups:

  • 🔵 Blue Target Group
  • 🟢 Green Target Group

• Attach EC2 instances accordingly

• Switch traffic by changing ALB listener rules

---

🧪 AWS CLI Commands

🔍 Describe Listeners

aws elbv2 describe-listeners --load-balancer-arn <LB-ARN>

🔍 Describe Target Groups

aws elbv2 describe-target-groups --names Blue Green

---

🔁 Switch Traffic (Blue → Green)

aws elbv2 modify-listener \
  --listener-arn <LISTENER-ARN> \
  --default-actions Type=forward,TargetGroupArn=<GREEN-TG-ARN>

🔁 Rollback (Green → Blue)

aws elbv2 modify-listener \
  --listener-arn <LISTENER-ARN> \
  --default-actions Type=forward,TargetGroupArn=<BLUE-TG-ARN>

---

🤖 Jenkins Pipeline – Blue-Green Switch

🎛️ Parameter-Based Traffic Switch

pipeline {
    agent any
    parameters {
        choice(name: 'TARGET_GROUP', choices: ['Blue', 'Green'], description: 'Select traffic target')
    }
    stages {
        stage('Verify Health Before Switch') {
            when { expression { params.TARGET_GROUP == 'Green' } }
            steps {
                script {
                    echo "Checking Green target health..."
                }
            }
        }
        stage('Switch Traffic') {
            steps {
                echo "Switching traffic..."
            }
        }
    }
}

---

⚖️ Weighted Traffic Switching (Canary Style)

🔍 Get Listener ARN

aws elbv2 describe-listeners \
  --load-balancer-arn <LB-ARN> \
  --query 'Listeners[*].ListenerArn' \
  --output text

---

🤖 Jenkins Pipeline – Weighted Routing

pipeline {
    agent any
    parameters {
        string(name: 'BLUE_WEIGHT', defaultValue: '1', description: 'Blue TG weight')
        string(name: 'GREEN_WEIGHT', defaultValue: '0', description: 'Green TG weight')
    }
    stages {
        stage('Switch Traffic Weights') {
            steps {
                script {
                    echo "Updating traffic weights..."
                }
            }
        }
    }
}

---

🧠 Key Takeaways

• 🔵🟢 Blue-Green avoids downtime
• 🚫 Disable sticky sessions during switch
• 🌐 Proper VPC & NAT design is critical
• ⚖️ Weighted routing enables safe canary releases
• 🤖 Jenkins automates traffic control

---