Building Network Isolation with Cell-Based Architectures, Availability Zones, and Regions
摘要
Before we dive into this topic, I would like to point out that cell-based architecture is not a good choice for every workload, because it increases architectural and operational complexity by duplicating infrastructure and components across independent units. It is most warranted for the most critical services—especially those vulnerable to correlated failures such as misconfigurations, faulty deployments, or overloads that can take down all “redundant” copies simultaneously. For many applications, a well-architected multi-AZ design already meets resilience objectives; cells become appropriate when the primary requirement is to bound blast radius so that a single software or operational failure cannot become a service-wide outage.