Topic
Designing services to degrade safely under downstream failure, covering cascades, shared budgets, circuit breakers, and escalation.
Vanessa Huerta Granda, who leads resiliency engineering at Enova, spends her InfoQ talk on incidents where the fix gets announced and then withdrawn. The controls she names are rotation, breaks and room capacity.
Reality
GitHub's write-up puts an almost eight-hour outage on an Istio sidecar that hit its concurrency limits while the autoscaling policy watched the wrong load signal, then on four saturated HAProxy nodes and two separate retry loops.
Reality
In a six-service checkout path, the fallback policy turns on a single question about undo, which is why the same gateway belongs in both columns depending on whether the token in hand is already signed.
Reality
Sam Newman's InfoQ talk uses the 1968 Ronan Point tower failure to argue that a cascade is a property of the structure, not of the trigger that started it.
Reality
A field-notes post argues the retry question splits in two: how many, and whether at all. On a user-facing path with a 30-second ceiling, the honest answer is usually a fast error.
Reality