Node.js Backend Development Bootcamp · 课时

健康检查、就绪探针与负载丢弃

正确报告存活状态和就绪状态，并丢弃过量负载以保护不堪重负的服务。

第 4 / 4 课13 个步骤

健康检查、就绪探针与负载丢弃 是 CoddyKit 上的免费 Node.js Backend Development Bootcamp 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Node.js Backend Development Bootcamp 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Node.js Backend Development Bootcamp 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Liveness vs Readiness

Production orchestrators (Kubernetes, ECS, Nomad) ask your service two different questions, and conflating them causes outages.

Liveness: "Is this process broken beyond repair?" If it fails, the orchestrator restarts the container.
Readiness: "Can this process serve traffic right now?" If it fails, the orchestrator removes the pod from the load balancer but does NOT kill it.

The classic mistake: putting a database ping in the liveness probe. When the DB has a transient hiccup, every replica fails liveness simultaneously and Kubernetes restarts your entire fleet at once, turning a 5-second blip into a full outage. Dependency checks belong in readiness, not liveness.

A Minimal Liveness Endpoint

A liveness check should be cheap, local, and dependency-free. It answers one thing: is the event loop alive and the process able to respond? Anything that reaches over the network does not belong here.

Below is a tiny dependency-free HTTP server (no framework) exposing /livez. It always returns 200 unless the process is so broken it cannot respond at all — which is exactly the signal a restart should be based on.

const http = require('http');

const server = http.createServer((req, res) => {
  if (req.url === '/livez') {
    // Liveness: no I/O, no DB, just "am I able to answer?"
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ status: 'alive' }));
    return;
  }
  res.writeHead(404);
  res.end();
});

server.listen(3000, () => {
  console.log('liveness server on :3000');
  // Self-test so an online judge sees output and exits.
  http.get('http://localhost:3000/livez', (r) => {
    let body = '';
    r.on('data', (c) => (body += c));
    r.on('end', () => {
      console.log('GET /livez ->', r.statusCode, body);
      server.close();
    });
  });
});

Readiness With Dependency Checks

Readiness aggregates the health of the things you need to serve a request: the database pool, a cache, a critical downstream API. If any required dependency is down, return 503 so the load balancer stops routing to you.

Key rules:

Run dependency checks in parallel with Promise.allSettled so one slow check does not serialize the rest.
Apply a per-check timeout — a hanging DB probe must not hang the readiness endpoint.
Distinguish required vs optional dependencies; a degraded optional cache should not pull you out of rotation.

function withTimeout(promise, ms, name) {
  let t;
  const timeout = new Promise((_, reject) => {
    t = setTimeout(() => reject(new Error(name + ' timed out')), ms);
  });
  return Promise.race([promise, timeout]).finally(() => clearTimeout(t));
}

async function checkReadiness(deps) {
  const results = await Promise.allSettled(
    deps.map((d) => withTimeout(d.probe(), 500, d.name).then(() => d))
  );

  const failures = results
    .map((r, i) => ({ r, dep: deps[i] }))
    .filter((x) => x.r.status === 'rejected' && x.dep.required);

  return { ready: failures.length === 0, failures: failures.map((f) => f.dep.name) };
}

// Demo with fake probes
const deps = [
  { name: 'postgres', required: true, probe: () => Promise.resolve() },
  { name: 'redis', required: false, probe: () => Promise.reject(new Error('down')) },
];

checkReadiness(deps).then((r) => console.log(JSON.stringify(r)));

Cache Readiness Results to Protect Dependencies

Probes are called frequently — every replica, every few seconds, from kubelet and sometimes from external monitors too. If each readiness call pings Postgres, your health checks alone can hammer a struggling database and make the incident worse.

Cache the dependency-check result for a short TTL (e.g. 1-2 seconds). The probe reads the cached verdict; a background refresh updates it. This decouples probe frequency from real dependency load.

function cachedCheck(checkFn, ttlMs) {
  let cache = { value: null, at: 0 };
  let inflight = null;

  return async function get() {
    const now = Date.now();
    if (cache.value && now - cache.at < ttlMs) return cache.value;
    if (inflight) return inflight; // coalesce concurrent calls
    inflight = Promise.resolve(checkFn())
      .then((value) => {
        cache = { value, at: Date.now() };
        return value;
      })
      .finally(() => { inflight = null; });
    return inflight;
  };
}

let calls = 0;
const readiness = cachedCheck(async () => { calls++; return { ready: true }; }, 1000);

Promise.all([readiness(), readiness(), readiness()]).then(async (rs) => {
  console.log('results', rs.length, 'actual checks', calls); // 3 results, 1 check
});

Startup Probes Avoid Premature Restarts

Slow-booting apps (warming caches, running migrations, JIT compiling) need a startup probe. Kubernetes runs only the startup probe until it succeeds once; liveness and readiness are suspended during this window.

Without it, a liveness check with a short period can kill a process that simply hasn't finished booting — a crash loop that never lets the app come up. Model a started flag separately from ready:

/startupz → 200 once boot completes (give it a generous failure threshold).
/livez → only meaningful after startup succeeds.
/readyz → gates traffic after the app is both started and dependencies are healthy.

const state = { started: false, shuttingDown: false };

async function boot() {
  // Simulate migrations / cache warm-up
  await new Promise((r) => setTimeout(r, 50));
  state.started = true;
}

function startupz() {
  return state.started ? 200 : 503;
}

boot().then(() => {
  console.log('before boot done? startupz would have been 503');
  console.log('startupz now ->', startupz()); // 200
});

Why You Need Load Shedding

Even a healthy service has a finite capacity. When arrival rate exceeds what you can process, requests pile up in queues. Latency climbs, timeouts fire, clients retry, and the added retry load pushes you further over the edge — a congestion collapse. Throughput can drop to near zero while CPU stays pinned.

Load shedding is the deliberate choice to reject some requests fast (with 503 + Retry-After) so the rest succeed. Rejecting cheaply is far better than accepting work you cannot finish. The goal: keep goodput (successfully completed requests) high under overload, instead of letting it collapse.

Shedding on Event-Loop Lag

In Node, the single-threaded event loop is the bottleneck. When you're overloaded, the loop falls behind and event-loop delay rises. That delay is an excellent, cheap, app-agnostic overload signal — better than CPU%, because it directly measures "am I keeping up?"

Use perf_hooks.monitorEventLoopDelay to sample the lag, and reject new requests when the smoothed delay crosses a threshold. The library @cabhishek/toobusy or toobusy-js wraps this pattern, but you can do it in a few lines.

const { monitorEventLoopDelay } = require('perf_hooks');

const h = monitorEventLoopDelay({ resolution: 20 });
h.enable();

const MAX_LAG_MS = 70;
function tooBusy() {
  // mean is in nanoseconds
  const lagMs = h.mean / 1e6;
  return lagMs > MAX_LAG_MS;
}

// Simulate a blocking burst, then measure.
function blockFor(ms) {
  const end = Date.now() + ms;
  while (Date.now() < end) {} // intentional CPU block
}

blockFor(120);
setTimeout(() => {
  console.log('mean lag (ms):', (h.mean / 1e6).toFixed(1));
  console.log('tooBusy ->', tooBusy());
  h.disable();
}, 100);

Bounded Concurrency: A Semaphore

Event-loop lag catches CPU overload, but many backends are bottlenecked on a downstream (DB pool, an upstream API). There, the right primitive is a concurrency limiter: cap the number of in-flight requests, and shed anything beyond the cap immediately.

This bounds queue depth, which by Little's Law bounds latency. A request that can't get a slot is rejected fast instead of waiting behind a long line. Prefer rejecting over unbounded queuing under overload.

class Semaphore {
  constructor(max) { this.max = max; this.inUse = 0; }
  tryAcquire() {
    if (this.inUse >= this.max) return false;
    this.inUse++;
    return true;
  }
  release() { if (this.inUse > 0) this.inUse--; }
}

async function handle(sem, id) {
  if (!sem.tryAcquire()) {
    return { id, status: 503 }; // shed: no capacity
  }
  try {
    await new Promise((r) => setTimeout(r, 20));
    return { id, status: 200 };
  } finally {
    sem.release();
  }
}

const sem = new Semaphore(2);
Promise.all([1, 2, 3, 4].map((i) => handle(sem, i))).then((rs) =>
  console.log(rs.map((r) => r.id + ':' + r.status).join(' '))
);

Prioritized Shedding: Protect Critical Traffic

Not all requests are equal. Under load you want to shed low-priority work (analytics writes, prefetch, background sync) before critical work (checkout, login). Implement tiers with separate thresholds so health checks and critical paths survive longest.

A common pattern: reserve capacity. Allow critical requests up to the hard cap, but start shedding low-priority requests at a lower watermark. This keeps headroom for what matters.

function admit({ inFlight, priority }) {
  const HARD_CAP = 100;     // absolute ceiling
  const LOW_PRIO_CAP = 70;  // shed low-prio earlier

  if (priority === 'critical') return inFlight < HARD_CAP;
  return inFlight < LOW_PRIO_CAP;
}

const cases = [
  { inFlight: 65, priority: 'low' },
  { inFlight: 80, priority: 'low' },
  { inFlight: 80, priority: 'critical' },
  { inFlight: 100, priority: 'critical' },
];

for (const c of cases) {
  console.log(`inFlight=${c.inFlight} ${c.priority} -> ${admit(c) ? 'ADMIT' : 'SHED 503'}`);
}

Graceful Shutdown Ties It Together

When a pod is told to stop (SIGTERM on deploy/scale-down), readiness and shutdown must cooperate so no request is dropped:

Flip readiness to 503 first. The load balancer notices and stops sending new traffic — but this takes a few seconds to propagate.
Keep serving in-flight requests during that window; do NOT close the server immediately.
Stop accepting new connections, drain, then close the DB pool.
Add a hard timeout so a stuck request can't block shutdown forever; force-exit after it.

Liveness must keep returning 200 during drain, or Kubernetes will SIGKILL you mid-drain.

A Complete Graceful Shutdown Handler

This standalone example shows the full sequence: a SIGTERM-style trigger flips ready to false, waits for the load balancer to notice, stops new work, drains in-flight requests, and force-exits after a hard deadline. The same ready flag is what your /readyz endpoint should read.

const state = { ready: true, inFlight: 0 };

function readyz() { return state.ready ? 200 : 503; }

async function gracefulShutdown({ drainWaitMs, hardDeadlineMs }) {
  console.log('readyz before:', readyz());
  state.ready = false; // 1) fail readiness, LB stops new traffic
  console.log('readyz after :', readyz());

  await new Promise((r) => setTimeout(r, drainWaitMs)); // 2) let LB propagate

  const start = Date.now();
  while (state.inFlight > 0) { // 3) drain in-flight work
    if (Date.now() - start > hardDeadlineMs) {
      console.log('hard deadline hit, forcing exit with', state.inFlight, 'in flight');
      return 'forced';
    }
    await new Promise((r) => setTimeout(r, 10));
  }
  console.log('drained cleanly');
  return 'clean';
}

state.inFlight = 1;
setTimeout(() => { state.inFlight = 0; }, 30); // a request finishes
gracefulShutdown({ drainWaitMs: 20, hardDeadlineMs: 500 }).then((r) =>
  console.log('shutdown result:', r)
);

Quick Check

Test your understanding of where dependency checks belong.

在交互式课程中回答

Recap

You learned to signal health and shed load correctly:

Liveness = restart-if-broken; keep it cheap and dependency-free.
Readiness = gate traffic; aggregate required dependencies in parallel, with per-check timeouts, and cache results so probes don't hammer dependencies.
Startup probes protect slow-booting apps from premature liveness restarts.
Load shedding preserves goodput under overload by rejecting fast with 503 + Retry-After.
Shed on event-loop lag for CPU-bound overload and on bounded concurrency for downstream-bound overload; bounding queue depth bounds latency.
Prioritize: shed low-priority work earlier, reserve capacity for critical paths.
Graceful shutdown: flip readiness to 503 first, drain in-flight requests, keep liveness 200, and force-exit after a hard deadline.

免费开始

用 AI 导师学习 JavaScript — 免费

在浏览器中编写并运行真实代码，获得全天候 AI 导师的即时帮助，并在网页或应用中继续学习。

课程: 22
课程: 92

免费开始学习查看完整课程

常见问题解答

「健康检查、就绪探针与负载丢弃」课时是免费的吗？

是的 — 「健康检查、就绪探针与负载丢弃」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Node.js Backend Development Bootcamp 课程的其余内容，请升级到 CoddyKit PRO。 Node.js Backend Development Bootcamp 课程共包含 4 节课。

「健康检查、就绪探针与负载丢弃」这节课中我会学到什么？

正确报告存活状态和就绪状态，并丢弃过量负载以保护不堪重负的服务。你通过在浏览器中直接运行的动手代码来练习 Node.js Backend Development Bootcamp，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Node.js Backend Development Bootcamp 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Node.js Backend Development Bootcamp 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「健康检查、就绪探针与负载丢弃」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Node.js Backend Development Bootcamp 课中编写并运行代码吗？

能。每节 Node.js Backend Development Bootcamp 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Node.js Backend Development Bootcamp