Feature Flags Pattern: Decouple Deployments from User Exposure

Scenario context

Feature flags separate deploy from exposure. They are operationally valuable when you need cohort rollout, instant kill switches, or entitlement control without rebuilding or redeploying the service.

TLDR: Flags help only when they are treated like production configuration with ownership, expiry, and observability. Otherwise they become a second codebase hidden behind conditionals.

Operator note: Incid…

This walkthrough focuses on When Feature Flags Actually Help.

Before making a design choice, clarify:

• Feature flags are best when the deployment artifact and the exposure decision need to move at different speeds.
• Use them for: - controlled rollout by cohort, tenant, or region, - kill switches for risky integrations or expensive features, - entitlement and plan-based access control, - safe migration paths where new and old behavi…

Concepts in play: canary-deployments, jvm-internals-and-garbage-collection, caching, system-design-hld-architectures

Stage 1 — How Flags Work in Production

• Good flag systems have two planes: 1.
• A control plane where owners define targeting rules, defaults, expiry, and audit history.
• A data plane where the application evaluates the flag locally or with a cached config snapshot.
• The production sequence usually looks like this: 1.

flowchart TD
    A[Draft - config only] --> B[Enabled - 1% rollout]
    B --> C[Ramp - 10% rollout]
    C --> D[Broad - 50% rollout]
    D --> E[Full - 100% rollout]
    E --> F[Archived - flag removed]
    B --> G[Disabled - rolled back]
    G --> B
    C --> G
    D --> G

Observable outcome: The production sequence usually looks like this: 1.

Stage 2 — Unleash, LaunchDarkly OSS, and Flipt: Feature Flag Platforms in Practice

• Unleash is the leading open-source feature flag platform with a Java SDK, a rich strategy engine (gradual rollout, user targeting, custom constraints), A/B variant support, and a self-hostable control plane.
• Flipt is a lightweight, GitOps-friendly open-source flag server with a gRPC API.
• OpenFeature is a CNCF-incubated vendor-neutral SDK standard that decouples flag evaluation code from the backing provider.
• These tools solve the feature flag problem by providing a proper two-plane architecture: a control plane stores targeting rules, defaults, and audit history; a data plane evaluates flags locally from a cached snapshot s…

import io.getunleash.DefaultUnleash;
import io.getunleash.Unleash;
import io.getunleash.UnleashContext;
import io.getunleash.util.UnleashConfig;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FeatureFlagConfig {

    @Bean
    public Unleash unleash() {
        // SDK polls the control plane every 15s and caches rules locally.
        // Evaluation never makes a live network call — the local cache answers.
        return new DefaultUnleash(
            UnleashConfig.builder()
                .appName("checkout-service")
                .instanceId(System.getenv().getOrDefault("HOSTNAME", "local"))
                .unleashAPI(System.getenv("UNLEASH_URL"))
                .apiKey(System.getenv("UNLEASH_TOKEN"))
                .build()
        );
    }
}

// Usage in any Spring bean — pass user/tenant context for targeting
boolean enabled = unleash.isEnabled(
    "new-checkout-flow",
    UnleashContext.builder()
        .userId(userId)
        .addProperty("plan", plan)
        .addProperty("region", region)
        .build(),
    false   // safe default if SDK cannot resolve the flag
);

Observable outcome: These tools solve the feature flag problem by providing a proper two-plane architecture: a control plane stores targeting rules, defaults, and audit history; a data plane evaluates flags locally from a cached snapshot s…

Stage 3 — Enterprise Java Example: Rolling Out checkout-risk-v2

• Scenario: your checkout service has a new fraud/risk engine ( v2 ).
• You want to expose it only to enterprise tenants in eu-west at first, ramp gradually, and retain instant rollback.
• 1) Isolate the flag boundary in a dedicated component 2) Pass enterprise context into flag evaluation Control-plane targeting rule for this scenario: - Strategy 1: internal users = on - Strategy 2: plan=enterprise AND r…
• Every stale flag becomes hidden branch logic that on-call engineers must rediscover under pressure.

package com.acme.checkout.flags;

import io.getunleash.DefaultUnleash;
import io.getunleash.Unleash;
import io.getunleash.util.UnleashConfig;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FlagConfig {

  @Bean
  public Unleash unleash() {
    UnleashConfig config = UnleashConfig.builder()
        .appName("checkout-service")
        .instanceId(System.getenv().getOrDefault("HOSTNAME", "checkout-1"))
        .unleashAPI(System.getenv("UNLEASH_API_URL"))
        .apiKey(System.getenv("UNLEASH_API_TOKEN"))
        .build();

    return new DefaultUnleash(config);
  }
}

package com.acme.checkout.flags;

import io.getunleash.Unleash;
import io.getunleash.UnleashContext;
import org.springframework.stereotype.Component;

@Component
public class FeatureDecisions {

  private final Unleash unleash;

  public FeatureDecisions(Unleash unleash) {
    this.unleash = unleash;
  }

  public boolean useRiskEngineV2(String userId, String tenantId, String plan, String region) {
    UnleashContext context = UnleashContext.builder()
        .userId(userId)
        .addProperty("tenant", tenantId)
        .addProperty("plan", plan)
        .addProperty("region", region)
        .build();

    // `false` is the safe default when flag state cannot be resolved.
    return unleash.isEnabled("checkout-risk-v2", context, false);
  }
}

Observable outcome: Every stale flag becomes hidden branch logic that on-call engineers must rediscover under pressure.

End-to-end outcome

Feature flags are best when the deployment artifact and the exposure decision need to move at different speeds.

Alternatives considered

The source focuses on one primary design. A second architecture is not compared, so no alternative is invented here.

Failure and degraded modes

When Not to Use Feature Flags

• Detection: Flags are a poor substitute for basic code and architecture discipline.
• User or operator impact: Flags are a poor substitute for basic code and architecture discipline.