工作机制
实践者先定义稳态指标，提出可证伪的假设，限制爆炸半径，再注入贴近现实的故障，例如延迟、丢包或实例终止。实验在监控和熔断条件下运行，最后产出证据：系统是否守住了承诺。随着信心提升，实验从预发环境推进到生产环境。
适用场景与取舍
大促前、架构变更后，以及任何故障转移声明尚未验证时，都适合做混沌工程。它要求冗余、可观测性和快速中止实验的能力。与单元测试或负载测试相比，混沌工程验证真实组件的交互，但不能证明正确性，并带来真实运营风险。代价包括工具、培训和协调成本；范围不当的实验可能伤害客户，一次顺利运行也不等于具备韧性。
具体示例
团队在工作时间终止某个可用区百分之十的 Pod。假设是 p99 延迟低于三百毫秒、错误率低于百分之零点一；任一指标越界即中止。实验在节假日高峰前暴露了缺失的重试策略。
常见误解与关联概念
混沌工程不是随机破坏或表演，而是有假设的受控实验，也不一定需要大公司和专用工具，手工的故障演练日同样可行。它不能替代测试，而是验证测试触达不到的假设。复盘把实验发现转成修复项，SLO 定义需要守护的稳态，事故指挥则在实验越界时组织响应。
代码示例
package main
import (
"errors"
"fmt"
"sync"
"time"
)
type State int
const (
StateClosed State = iota
StateOpen
StateHalfOpen
)
func (s State) String() string {
switch s {
case StateClosed:
return "closed"
case StateOpen:
return "open"
case StateHalfOpen:
return "half-open"
default:
return "unknown"
}
}
var ErrOpen = errors.New("circuit breaker is open")
type Breaker struct {
mu sync.Mutex
threshold int
cooldown time.Duration
now func() time.Time
state State
failures int
openedAt time.Time
}
func NewBreaker(threshold int, cooldown time.Duration) (*Breaker, error) {
if threshold < 1 {
return nil, fmt.Errorf("threshold must be positive")
}
if cooldown <= 0 {
return nil, fmt.Errorf("cooldown must be positive")
}
return &Breaker{threshold: threshold, cooldown: cooldown, now: time.Now}, nil
}
func (b *Breaker) Allow() error {
b.mu.Lock()
defer b.mu.Unlock()
if b.state == StateOpen {
if b.now().Sub(b.openedAt) < b.cooldown {
return ErrOpen
}
b.state = StateHalfOpen
}
return nil
}
func (b *Breaker) record(err error) {
b.mu.Lock()
defer b.mu.Unlock()
if err == nil {
b.state = StateClosed
b.failures = 0
return
}
b.failures++
if b.state == StateHalfOpen || b.failures >= b.threshold {
b.state = StateOpen
b.openedAt = b.now()
}
}
func (b *Breaker) Execute(operation func() error) error {
if err := b.Allow(); err != nil {
return err
}
err := operation()
b.record(err)
return err
}
func (b *Breaker) CurrentState() State {
b.mu.Lock()
defer b.mu.Unlock()
return b.state
}
type fakeClock struct {
current time.Time
}
func (c *fakeClock) Now() time.Time { return c.current }
func (c *fakeClock) Advance(step time.Duration) { c.current = c.current.Add(step) }
func main() {
clock := &fakeClock{current: time.Date(2026, 10, 21, 12, 0, 0, 0, time.UTC)}
breaker, err := NewBreaker(2, 100*time.Millisecond)
if err != nil {
fmt.Println(err)
return
}
breaker.now = clock.Now
failing := func() error { return errors.New("upstream unavailable") }
for call := 1; call <= 3; call++ {
fmt.Printf(
"call %d: err=%v state=%s\n",
call,
breaker.Execute(failing),
breaker.CurrentState(),
)
}
clock.Advance(150 * time.Millisecond)
fmt.Println("after cooldown state:", breaker.CurrentState())
probeErr := breaker.Execute(func() error { return nil })
fmt.Printf("probe err=%v state=%s\n", probeErr, breaker.CurrentState())
}const RETRYABLE = new Set([408, 425, 429, 500, 502, 503, 504]);
const CACHEABLE = new Set([200, 203, 204, 206, 300, 301, 308, 404, 410]);
export function classifyStatus(status) {
if (!Number.isInteger(status) || status < 100 || status > 599) {
throw new RangeError("status must be a three-digit HTTP status code");
}
const group = Math.floor(status / 100);
const labels = {
1: "informational",
2: "success",
3: "redirect",
4: "client-error",
5: "server-error",
};
return {
status,
group,
label: labels[group],
success: group === 2,
redirect: group === 3,
error: group >= 4,
retryable: RETRYABLE.has(status),
cacheable: CACHEABLE.has(status),
};
}
export function isRetryableStatus(status) {
return classifyStatus(status).retryable;
}