Two findings from the review in lesson 4.7.1 belong together: RE:05, "Environment and database without zone redundancy", and RE:03, "No failure mode analysis for booking and sending". The first asks what the Kladde does when a data center fails. The second asks more generally: What can go wrong in the most important flows, how do you notice, and what happens then?
This lesson answers both. You learn what availability zones do, how each of the Kladde's building blocks uses them, how to calculate the
availability of a whole chain, and what a failure mode analysis looks like. At the end, docs/failure-mode-analysis.md is in the Kladde,
and an ADR decides on zone redundancy.
What a zone is and what it protects against
In many cases, an Azure region consists of several availability zones: groups of data centers, physically separate, each with its own power, cooling and network. If one zone fails, the others keep running. A service can be one of three things:
- zone redundant: The service spreads itself across several zones and switches over on its own when one fails. That is the case the Kladde wants.
- zonal: The resource sits in a zone that you choose. Against the failure of that zone, the only help is a second resource in another zone, which you have to take care of yourself.
- non-zonal: Azure places the resource somewhere in the region. If the zone it happens to be in fails, it fails with it.
Zones protect against the failure of a data center. They do not protect against the failure of a whole region (that is lesson 4.7.5), not against a bug in your code that runs in all zones at the same time, and not against deleted or incorrectly written data, which the replication dutifully copies into all zones. For the last one there are backups.