Architecture & resilience

Designing so that failure is survivable rather than surprising.

35 sketches

• Change managementThe way back, rehearsed
• Chaos engineeringPull it on purpose
• Common-mode failureThree legs, one root
• Configuration driftEvery dial started here
• Default credentialsPrinted once, known by everyone
• Dependency mappingDrawn before, or drawn during
• Fail secureWhich way does it fail?
• Graceful degradationDrop the ballast, stay in the air
• HardeningFold away what you never use
• High availabilityAlways open is open to everyone
• Legacy systemsYou cannot change it, so you build around it
• RedundancyTwo of everything, one of the thing that counts
• Remote administrationA lever long enough to move everything
• ResilienceBuilt to bend, built to come back
• Secure decommissioningThe box goes, the threads stay
• A jump host concentrates administrative entryOne plank, every crossing
• A bastion should not become a general-purpose workstationIt only has the one job
• Bulkheads contain failureThe water stops at the wall
• Out-of-band management survives primary-path failureWhen the bridge is out
• A choke point makes control observableEverything through one gap
• A broker can separate clients from powerful credentialsChained to the bench
• A one-way gateway changes the threat modelWater does not fall upwards
• A quarantine zone creates time for inspectionA room with two gates
• Control planes should be separated from what they controlThe box on the embankment
• A service mesh moves controls into the communication layerClamped onto the wire
• High availability and disaster recovery solve different problemsA part, or the place
• A dependency can be more critical than the applicationThe lighter side goes down
• Manual workarounds have capacity limitsThe pipe gets narrower
• Recovery priorities should follow business outcomesWhose order is it?
• Resilience includes people and suppliersThe shelf runs out
• Failover can fail if never exercisedThe day it is asked
• Graceful degradation preserves the important partDrop the ballast
• Recovery from corruption differs from recovery from outageBack to when, not back on
• Crisis communication needs alternate channelsThe route runs through it
• Resilience is a property of the whole service chainGreen all the way down