Autoscaling Controller · View 09 of 37 · 2 · Structure
Decisions
- The delta is re-derived from observed actual capacity on every run, never carried forward from what was intended last time.
- Capacity counts only once it is health-checked and registered with its load balancer or queue subscription.
- A delta that would breach a declared safety bound is refused and journalled rather than clipped silently.
Numbers
- Circuit breaker after 5 consecutive provider failures.
- Drain deadline 120 s per target by default.
- Warm-pool attach under 10 s; cold provision measured per target and machine shape.
Risks
- Throttling and scarcity present similarly and are handled oppositely — backoff for one, fallback list then an honest unmet-demand signal for the other. Getting this wrong produces a controller that spins.
- Idempotency depends on the provider's set-capacity call being idempotent. Where it is not, the adapter carries a request id and reconciles by reading back.
