Operations & Deployment

Liveness checks whether the app should be restarted because it's stuck; readiness checks whether it should currently receive traffic. If readiness is broken and always says "yes," a struggling instance keeps getting new requests it can't handle while it's failing.

Pick based on what you need: strict-consistency registries (Consul/Raft) can refuse to answer during a network partition, while availability-first ones (Eureka) may hand out stale info but never go fully silent. At multi-region scale, most teams end up with per-region discovery plus a mesh or global routing layer to handle traffic across regions, rather than one giant global registry.

A sidecar is a helper container deployed alongside a service's container in the same pod that handles shared plumbing like security or metrics, so the service's own code doesn't need to implement that plumbing itself.

Normally you can't put a real password in git because anyone who can read the repo can read it. Sealed Secrets lets you encrypt the password first with a key only your cluster knows, so the encrypted version is safe to commit — only your cluster can turn it back into the real password.

Sometimes a fancy gradual rollout isn't worth it - for tiny low-traffic services, batch jobs, or changes where a database migration already commits you either way, a simpler rolling deploy with good tests is safer and cheaper than building a whole canary pipeline.

For a small number of services, a full mesh can cost more in complexity and per-pod overhead than the traffic-management and mTLS benefits are worth; newer ambient-mesh designs try to get similar benefits without a sidecar in every pod.