Health Check & Service Discovery · View 19 of 21 · Assurance
Decisions
- A signal that cannot be attributed to the instance it describes is discarded. Everything downstream assumes this held (ADR-15).
- An instance may report only about itself; a prober only about its assigned targets. A compromised workload cannot mark a neighbour unhealthy.
- A registered address must be proved to belong to its registrant, so an endpoint cannot be pointed at an attacker.
Assumptions
- Workload identity via IRSA and instance profiles; mutual authentication on every control-plane path.
- Resolution is authorised per caller-callee pair, so the registry is not a map of the estate.
Residual risk
- The passive outcome channel is the one signal a workload cannot forge about itself — and a compromised caller can still lie about someone else. Ejection caps bound it; nothing removes it.
