Service Mesh Platform · View 23 of 31 · 6 · Operations
Decisions
- Waves are ordered by cluster, not by proxy. A cluster is the unit with its own control plane, so a bad change is contained by the same boundary that contains a bad istiod.
- Gates read three signals: mesh-attributed error ratio, NACK count and proxies still on the previous sha. Application error rates are shown but do not gate, or every unrelated incident would halt every change.
- On breach the wave halts and the affected clusters are pinned to the previous rendered bundle. Git is reverted afterwards, by the same operation, so Argo CD does not re-apply the bad change.
Exception
- An emergency deny skips waves and applies to every cluster at once. It is the one change type where speed is worth more than staging, and it is audited as an exception.
Targets
- Full rollout across 20 clusters in about 45 minutes. Halt and revert ≤ 60 s from breach.
