Staying available while things fail

Services hold no session state, so any replica can serve any request and a lost instance costs nothing but capacity. State lives in the datastore or the cache, not in the process.

Readiness and liveness probes distinguish "not ready yet" from "broken", so traffic is withheld during startup and a wedged container is restarted rather than left in rotation.

Rolling updates with a surge replica and graceful shutdown let in-flight requests finish while new pods come up. Migrations stay backward compatible so both versions can run at once.

Timeouts, bounded retries, and circuit breakers stop a slow dependency from consuming every thread. Where the feature allows it, degrading — a cached answer, a queued action — beats returning an error.

Running spare capacity and multi-zone datastores raises both spend and operational surface. The question is always which failures are worth the standing cost of surviving.