Health Check & Service Discovery  ·  View 03 of 21  ·  People and journeys

Actors and Their Journeys

Four humans, three machines, and the one actor who can break this platform by doing their job correctly.

Editable source SVG draw.io All views
The people who change traffic Service owner 450 services, ~120 teams Goal — Ship twice a day without anyone noticing, and get told if my readiness check is lying about me. Core journeys Deploy without dropping traffic Declare a health contract Read my own flap report SRE on call follow-the-sun, 3 regions Goal — Decide in two minutes whether this is one bad replica, one bad zone, or my own health check. Core journeys Chase errors from one replica Evacuate a zone or region Override an eligibility decision The people who are owed an answer Security engineer quarterly review Goal — Know that nothing but a service itself can mark that service unhealthy, and prove it from a log. Core journeys Audit a denial of service Review resolution authorisation Platform engineer owns this plane Goal — Prove the request path survives my own control plane being switched off, before it is switched off for me. Core journeys Run a control-plane removal drill Onboard a non-orchestrated fleet Machines in the cast Calling service 12 M req/s peak Goal — Get an endpoint list I can route on right now, even if nothing answers me. Core journeys Resolve a callee by name Eject a bad endpoint locally Deploy pipeline ~900 deploys/day Goal — Be told no when draining this instance would take the service below its floor. Core journeys Request a drain Ramp a new version Third-party endpoint health unknown Goal — Be routed to without pretending I publish a readiness signal. Core journeys Be declared with no probe Who This Is For, and What They Get To Do Person or role Journey / task Application we own Security / platform External / third party v 1.0 · owner Reliability Architecture

What the cast says about the design

  • The deploy pipeline is an actor, and the thing it most needs is to be told no — a disruption budget it cannot override.
  • A third-party endpoint is in the cast precisely because it publishes no readiness signal, and the design has to say so out loud.
  • The platform engineer's journey is a drill: proving the request path survives this platform being switched off.

Assumptions

  • ~120 owning teams, ~900 deploys a day, follow-the-sun on call across 3 regions.
  • Security reviews the denial path quarterly, because marking an instance ineligible is a denial of service.

What act 2 must prove

  • A reader should be able to say, from these three journeys alone, what each person is able to do and where it hurts.
◀  High-Level Architecture All views Journey — Deploy Without Dropping Traffic  ▶
Solution Architecture v1.0 · Amazon Web Services with an open-source Envoy/xDS data plane · Reliability Architecture · 2026-10 · 21 views · 16 architecture decision records03-actors-and-journeys