Health Check & Service Discovery · View 16 of 21 · Operations
Decisions
- Each region's control plane has its own authority and its own registry writes; cross-region resolution is a read-only async aggregate (ADR-14).
- The failover signal that says a region is unhealthy is out of band and has no dependency on the registry it describes.
- Probers are per-AZ, so a prober-network failure is scoped to one failure domain rather than to a region.
Assumptions
- us-east-1, eu-west-1 and ap-south-1 active; ~20,000 workloads per AZ in the home region.
- Registry on a 3-AZ relational store, observed state on a wide-column store with 7-day TTL, transitions to a log plus object storage.
Risks
- Regions will sometimes disagree about which region is healthy. Reconciliation after a partition is explicit and logged, never silent.
