What is the best way to do a zero-downtime deployment?

There are three well documented modes for zero-downtime deployments.

1. Canary - If your deployment is sufficiently large, you can stage a gradual deployment of the smallest component and scale up as confidence grows. e.g. you have a 10 node cluster, upgrade just 1 cluster first, and update the rest gradually. This means any failure is small and can be isolated, meaning the service overall experiences no downtime.

1. Blue-Green deployments - With the duplication of an entire application, you can operate in an active/passive configuration, where the passive configuration is upgraded via a deployment. This passive side can then be tested fully before the switch occurs. Once happy a switch configures the systems to swap over, passive becomes active and active becomes passive. This also enables a swift rollback if necessary.

1. Feature switches - In code a feature switch enables fine grain control over specific features in an application. The application can be deployed with the code intact, but the switch is off. Then the switch can be enabled (usually via configuration) for that feature to test with very low impact on the rest of the application or service.

Most teams in practice combine two of these — a canary rollout (e.g. 5% of traffic for 15 minutes before continuing) paired with a feature flag, so a bad release can be halted by traffic percentage and killed by flag without needing a full rollback.