Circuit Breaker Pattern — Resilience4j Implementation

The Circuit Breaker pattern protects your service from cascading failures caused by a struggling downstream dependency. Without it, when a payment gateway starts timing out at 30 seconds, every incoming request ties up a thread waiting for that timeout. Within seconds you've exhausted your thread pool, your health checks fail, Kubernetes restarts your pod, and the cascade spreads to every service that depends on you.

The circuit breaker is a state machine with three states. CLOSED means everything is normal — calls pass through and failures are counted within a sliding window. When failures exceed the threshold — say 50% of the last 10 calls — the breaker opens. In open state, calls fail immediately in microseconds without contacting the downstream service. After a wait period, it moves to HALF_OPEN and allows a few test requests through. If they succeed, the circuit closes. If they fail, it opens again.

Resilience4j is the standard library in Spring Boot — it replaced Netflix Hystrix, which is deprecated. Configuration goes in application.yml per service instance. The tricky part is tuning thresholds. Too sensitive and the breaker trips on normal traffic spikes. Too lenient and it doesn't protect you when it matters. Start with a 50% failure rate threshold and a 10-15 second open duration.

The configuration decision most teams get wrong is recordExceptions. You want to trip on infrastructure failures — timeouts, connection errors. Business validation errors like 'insufficient funds' are expected behavior and must be excluded, otherwise the breaker opens on perfectly normal traffic.