A distributed system for coordinating fault recovery of a tenant infrastructure in the distributed system, the distributed system comprising a controller component and a plurality of nodes, wherein the distributed system is configured to run, for each of a plurality of tenants, a service application associated with a tenant on a plurality of service-application components comprising the plurality of nodes, wherein the nodes are allocated to run one or more portions of the service applications, wherein each service application is associated with a tenant management role, wherein the tenant infrastructure comprises the service application components on which the service application associated with the tenant runs, the controller component configured for: determining a fault occurrence for an infrastructure in the distributed system based on receiving communication of the fault occurrence from the tenant management role, wherein the fault occurrence is a hardware or software failure at one of the nodes and is associated with a plurality of tenants; communicating a fault recovery plan, which indicates the service-application components impacted by the fault occurrence and a fault recovery action associated with each of the one or more service-application components, to the tenant management roles; determining whether a fault recovery plan response is received from each of the tenant management roles, wherein the fault recovery plan response is an acknowledgement of the fault recovery plan; and executing the fault recovery plan to restore the infrastructure; each of the tenant management roles configured for: receiving the fault recovery plan for the fault occurrence; determining a tenant infrastructure impact associated with the fault recovery plan, wherein the tenant infrastructure impact triggers one or more tenant recovery actions to accommodate the tenant infrastructure impact; communicating the fault recovery plan response to the controller component; and executing the one or more tenant recovery actions, wherein the executing the fault recovery plan comprises performing an in-place fault recovery action, which comprises at least one fault recovery action selected from the following: a reboot; an OS reimage; and a data reimage. determining a fault occurrence for an infrastructure in the distributed system based on receiving communication of the fault occurrence from the tenant management role, wherein the fault occurrence is a hardware or software failure at one of the nodes and is associated with a plurality of tenants; communicating a fault recovery plan, which indicates the service-application components impacted by the fault occurrence and a fault recovery action associated with each of the one or more service-application components, to the tenant management roles; determining whether a fault recovery plan response is received from each of the tenant management roles, wherein the fault recovery plan response is an acknowledgement of the fault recovery plan; and executing the fault recovery plan to restore the infrastructure; each of the tenant management roles configured for: receiving the fault recovery plan for the fault occurrence; determining a tenant infrastructure impact associated with the fault recovery plan, wherein the tenant infrastructure impact triggers one or more tenant recovery actions to accommodate the tenant infrastructure impact; communicating the fault recovery plan response to the controller component; and executing the one or more tenant recovery actions, wherein the executing the fault recovery plan comprises performing an in-place fault recovery action, which comprises at least one fault recovery action selected from the following: a reboot; an OS reimage; and a data reimage. receiving the fault recovery plan for the fault occurrence; determining a tenant infrastructure impact associated with the fault recovery plan, wherein the tenant infrastructure impact triggers one or more tenant recovery actions to accommodate the tenant infrastructure impact; communicating the fault recovery plan response to the controller component; and executing the one or more tenant recovery actions, wherein the executing the fault recovery plan comprises performing an in-place fault recovery action, which comprises at least one fault recovery action selected from the following: a reboot; an OS reimage; and a data reimage.