Comparison
Control planevsStatic stability
Control plane
the API that decides what should run went down, and everything already running carried on serving traffic perfectly.
The set of components that hold the desired state and decide what should happen — the API, the store behind it, the schedulers and controllers. It is where you make changes and where policy is enforced, and it is deliberately not in the request path of your users' traffic. Its failure mode is distinctive: nothing breaks immediately, but nothing can heal, scale or deploy either, so the outage becomes visible the moment something else fails.
Full entry →Static stability
the control plane was down for an hour and traffic kept flowing, because nothing in the request path needed to ask it anything.
Designing so a system keeps working from its existing state when its dependencies for making changes are unavailable, rather than needing a successful call to stay healthy. The classic application is capacity: pre-provision for the failed state so a zone failure requires no scaling event, since the scaling API is likely to be struggling at exactly that moment. It costs money in idle capacity and buys you not depending on anything working during the worst hour of the year.
Full entry →