Triage and recover health checks

Map failure classes for GET /livez and GET /readyz: retryable vs fatal vs needs-human. Retries need budgets, jitter, and idempotency rules aligned to /livez only checks process; /readyz checks vector+model deps; wrong probe kills healthy pods. The chapter’s signature failure — readyz embedded in liveness → restart storm during dependency blip — must take a deliberate branch, not a generic catch-all.

Implement the degrade/rollback/refuse behavior cluster operator during vector DB maintenance window needs when PROBE-RESTART-STORM-8 repeats. Prefer scoped controls (one flag, one weight, one tenant, one secret version) over fleet-wide restarts. Preserve evidence; do not delete logs to “clean the demo.”

After containment, check restart_count == 0 during dep outage and ready_pods ≥ 1 when deps healthy moves in the safe direction and watch for retry amplification. Write the stop condition that ends the incident response for this lab.

Chaos note: inject only one fault class at a time and restore fixtures after. Watch for dual failures — dependency down and retry amplifier — which is how readyz embedded in liveness → restart storm during dependency blip becomes an outage. Customer communication templates (even if only for the drill) beat silence. If you queue deferred work, define poison-message handling. Budget documents should state the maximum extra spend allowed during retries. Close the loop by linking the containment action to a dashboard panel for restart_count == 0 during dep outage and ready_pods ≥ 1 when deps healthy.

Draw a state diagram for degrade modes and put it in the repo as ASCII if needed. Cap concurrent retries across the process, not only per request. Ensure cancellation propagates to downstream HTTP clients. When failing closed, choose a user-visible message that does not leak internals. Practice the single command that flips the kill switch or weight to zero. After recovery, drain or inspect deferred work before declaring green. In this chapter the product is Kubernetes liveness vs readiness for retrieval-and-generation API, the human stakeholder is cluster operator during vector DB maintenance window, and the incident id you design against is PROBE-RESTART-STORM-8. Re-state the oracle in your notes — vector pause → readyz 503, livez 200, no restart loop; process deadlock → livez fails → restart — and keep the invariant visible: /livez only checks process; /readyz checks vector+model deps; wrong probe kills healthy pods. Track restart_count == 0 during dep outage and ready_pods ≥ 1 when deps healthy as the scoreboard. Surface under change control: GET /livez and GET /readyz. If you only have forty minutes, finish the fixture for readyz embedded in liveness → restart storm during dependency blip before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.