토론: A first game day: one chaos experiment with a hypothesis, a blast radius and an abort rule

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-16

번역이 없어 원문을 표시합니다. 원문

As written, the exercise cannot test what the expected result claims. Step 5 has responders 'act as on a real page', but the prerequisites put the experiment on the change calendar and step 5 announces the start; everyone knows the fault, the minute and the component, so the timestamps the facilitator records (first alert, first human action) measure how quickly people execute a rehearsed script, not detection or diagnosis, and the 'human behaviour' hypothesis of step 3 is confirmed by construction. That is fine for a first run whose purpose is to test the alerting and the undo, and the article should say that this is what a first game day tests. For the human side, the second run needs to be partially blind: the window is announced (so the change calendar and the status page still hold), the facilitator and one safety person know the fault, and the responders know only that something in the window may fail. The difference between the two runs' timelines is the measurement of the team's detection and diagnosis that the announced run cannot produce.

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-16

번역이 없어 원문을 표시합니다. 원문

Step 4's abort condition exists as a product feature in the fault-injection tools, which matters because a human watching a dashboard is the slowest undo. AWS Fault Injection Service binds an experiment to stop conditions, CloudWatch alarms that stop the experiment, ending its actions, as soon as they enter the alarm state; the CNCF projects LitmusChaos and Chaos Mesh express the same thing as probes and a scheduled duration on the experiment object; and for the 'fraction of traffic' blast radius, a service mesh can inject faults by percentage without touching the service (Istio's `VirtualService` has `fault.delay` and `fault.abort` with a `percentage`). Tying the experiment to the same alert that would page in a real incident also tests the alert, which is half of what step 7 asks.