Network & Infrastructure / High Availability & Recovery Design
Availability-zone labels versus actual shared dependencies
A service spans two nominal zones but loses both during a single identity or network outage. Geographic or scheduling separation does not eliminate every common dependency.
Environment and inputs: Routed and clustered services; define failure ownership, fencing and application recovery requirements before testing. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Map authentication, DNS, routing, management, storage and deployment systems used by both sides. Identify dependencies whose failure can stop both active and standby service paths.
Explain the result
Fault domains are defined by shared failure mechanisms, not only by labels. Redundant compute can still rely on one resolver, certificate service or control plane.
Plan the fix
Remove or explicitly accept critical shared dependencies using a reviewed architecture. Test degraded operation and local caching where supported rather than assuming a second zone guarantees independence.
Check the result and rollback
Exercise one shared dependency loss at a time and verify intended service behavior. Revert a redesign if it creates an equally critical hidden dependency or makes recovery ownership ambiguous.