Skip to content

SYSTEM Cited by 1 source

Slack Gondola

What it is

Gondola is Slack's global deployment orchestration system for Shipyard. It produces deployable artifacts, manages staged progressive rollouts across fleet segments, monitors service health metrics at each stage, and performs automatic rollback when problems are detected.

Mechanism

Artifact production

When Gondola builds an artifact, it produces a deployable package with two main parts treated as a single deployable unit:

  1. The AMI to roll out across the fleet
  2. The Chef artifact — versioned recipes associated with a specific Git commit, packaged to S3

Pluggable executors

Gondola uses a service-defined executor per stage to perform the actual rollout:

  • ASG-based deployments: Updates the launch template with the new AMI and configuration. New instances use a baked-in bootstrapper to fetch the correct Chef artifact from S3 and run relevant recipes. Uses AWS Instance Refresh.
  • Kubernetes worker fleets: Tells Karpenter which AMI to use and provides the same configuration metadata. Nodes bootstrap identically.
  • Custom executors: Extensible for services with special deployment needs.

Staged progressive rollout

Customer pipelines can have multiple stages, each representing a deployable unit (an ASG, a Kubernetes cluster, or a group of EC2 instances). Example: the Egress Team runs separate canary and production ASGs in each availability zone, with stages ordered for sequential flow. Gondola updates each stage, monitors key metrics, and rolls back automatically if problems are detected.

Metadata-driven bootstrapping

Configuration metadata ensures only the right configuration is applied to each instance, regardless of deployment model. New instances fetch the correct artifact version and run only the relevant recipes for their role.

Relationship to other Slack systems

  • Successor to ReleaseBot: ReleaseBot (2018-era) was Webapp-backend-only; Gondola generalises the same metric-driven-deploy + auto-rollback pattern across all Shipyard substrates.
  • Implements Deploy Safety Program goals: 10-minute automated MTTR / 20-minute manual MTTR / detect before 10% fleet exposure.

Caveats

  • No Gondola latency/throughput benchmarks disclosed.
  • Specific metric types used for health gates not enumerated.
  • Custom executor API surface not described.
  • Relationship to the "centralised deployment orchestration system" referenced in the 2025-10-07 Deploy Safety post is inferred but not explicitly stated.

Seen in

Last updated · 585 distilled / 1,765 read