Comparison
HeadroomvsStatic stability
Headroom
you run at sixty percent so a zone failure or a traffic spike does not immediately become an outage.
Deliberate unused capacity held to absorb failures, spikes and the time it takes to add more. The right amount is set by what you must survive without scaling — commonly the loss of one zone — plus however long provisioning actually takes. It is the least glamorous line on a cloud bill and the first thing cut in a cost exercise, usually by someone who has not connected it to the last incident.
Full entry →Static stability
the control plane was down for an hour and traffic kept flowing, because nothing in the request path needed to ask it anything.
Designing so a system keeps working from its existing state when its dependencies for making changes are unavailable, rather than needing a successful call to stay healthy. The classic application is capacity: pre-provision for the failed state so a zone failure requires no scaling event, since the scaling API is likely to be struggling at exactly that moment. It costs money in idle capacity and buys you not depending on anything working during the worst hour of the year.
Full entry →