Pushed Not Fetched

A fleet of 12,000 workers reads a feature flag configuration from a central config service on every request. The config changes a few times a week and is about 40 KB. Twice this quarter a config service incident has taken request handling down with it. Four proposals arrive. Which one removes the most failure modes from the request path?

Put the config service behind a load balancer with three replicas in separate availability zones

Push the configuration to every worker whenever it changes, and have the request path read only the local copy, so a config service outage cannot affect serving

Cache the config locally with a 30 second TTL and refetch on expiry

Keep fetching, but on a config service failure fall back to the last value the worker successfully retrieved