Your DevOps engineering team is automating a zero-downtime infrastructure migration pipeline using Cloud Build. The pipeline provisions a target GKE cluster with Cloud Service Mesh alongside an existing GKE cluster hosting production microservices. You need to implement a canary deployment strategy within the automated pipeline that safely shifts live user traffic in small increments to validate workload reliability on the new cluster while maintaining an immediate rollback mechanism. Which strategy should you implement in your pipeline?

Configure a ServiceEntry on the source cluster pointing to the target cluster's ingress gateway, and use a VirtualService to route a small initial percentage of traffic to the target cluster before progressively increasing it.: What Cloud Service Mesh Traffic Shifting Is Cloud Service Mesh (and Istio-based service mesh architectures) provides advanced Layer 7 traffic routing and management capabilities across Kubernetes clusters and namespaces. Through custom resource definitions like ServiceEntry and VirtualService, network traffic can be precisely manipulated at the ingress proxy level without modifying client code or relying on external DNS propagation. How it Meets the Requirements Automated Canary Deployment: Defining a ServiceEntry informs the source cluster's mesh of the external IP address for the target cluster's asm-ingressgateway. The accompanying VirtualService can specify fine-grained traffic weights (e.g., routing 5% or 10% of requests to the target cluster endpoint). Minimizing Operational Risk: Production traffic is split gradually in controlled increments, allowing the pipeline and observability stack to evaluate latency, error rates, and system metrics on the new infrastructure under real user load. Rapid Rollback: If unexpected errors or latency spikes occur, the rollback mechanism merely updates the VirtualService traffic weight back to 100% on the source cluster (or 0% to the target), which instantly reverts traffic without infrastructure teardown or DNS cache delays. Key Advantages and Capabilities Granular Weight Shifting: Allows percentage-based splitting down to 1% intervals, preventing overwhelming unvalidated workloads. Cross-Cluster Connectivity: Facilitates smooth transition between heterogeneous cluster environments and control plane versions. Layer 7 Telemetry: Generates uniform access logs and distributed tracing metrics across both old and new clusters simultaneously. Instant Convergence: Proxy configurations update dynamically across Envoy sidecars and gateways within milliseconds. Why This Is Optimal Using native service mesh primitives (ServiceEntry and VirtualService) is the Google-recommended pattern for canary migrations between clusters. It isolates blast radius effectively, leverages existing ingress gateways, and integrates seamlessly into automated CI/CD steps in Cloud Build.