Safeguarding Dynamic Configuration Changes at Scale

This post describes how Airbnb built "Sitar," their internal dynamic configuration platform for shipping runtime config changes safely at scale.

• •Sitar consists of four layers: a developer-facing Git/GitHub workflow, a control plane for validation and rollout decisions, a data plane for config storage and distribution, and agent sidecars with local caching on service hosts.
• •Config changes are treated as code: authored via pull requests, subject to mandatory review and CI schema validation, versioned, and fully auditable.
• •The control plane performs staged rollouts, progressively expanding a change across environments or pod percentages and triggering fast rollbacks if regressions are detected.
• •Control and data planes are intentionally separated so rollout strategies can evolve independently from the storage and delivery mechanisms.
• •Agent sidecars persist configs locally so services remain operational even when the backend is temporarily unavailable.