Slack’s Migration to a Cellular Architecture

This post details the migration of Slack's critical user-facing services from a monolithic to a cell-based architecture over 1.5 years. The motivation was to increase redundancy and limit the blast radius of site failures, particularly after an incident where a network disruption in one Availability Zone (AZ) caused user-visible errors. The solution involves treating AZs as cells, where services are siloed within their AZ and only communicate with services in the same AZ. This containment allows traffic to be dynamically routed away from failing AZs by reweighting target clusters in edge Envoy load balancers via Rotor, Slack's xDS control plane. This implementation satisfies goals of rapid propagation (seconds), graceful drains, incremental traffic assignment (1% granularity), and resilience against AZ failure.