Skip to content
Snippets Groups Projects
  • Boris Stepanenko's avatar
    64ae9a08
    raft: add strict fencing · 64ae9a08
    Boris Stepanenko authored
    With current leader fencing implementation old leader doesn't resign
    it's leadership before new leader may be elected. Because of this
    several "leaders" might coexist in replicaset for some time.
    
    This commit changes replication_disconnect_timeout that it is twice
    as short for current raft leader (2*replication_timeout) if strict
    fencing is enabled. Assuming that replication_timeout is the same for
    every replica in replicaset this makes it less probable that new
    leader can be elected before old one resigns it's leadership.
    
    Old fencing behaviour can be enabled by setting fencing to soft mode.
    This is useful when connection death timeouts shouldn't be affected
    (e.g. different replication_timeouts are set to prioritize some
    replicas as leader over the others).
    
    Closes #7110
    
    @TarantoolBot document
    Title: Strict fencing
    
    In `box.cfg` option `election_fencing_enabled` is deprecated in favor
    of `election_fencing_mode`. `election_fencing_mode` can be set to one
    of the following values:
    'off' - fencing turned off (same as `election_fencing_enabled` set to
    false before).
    Connection death timeout is 4*replication_timeout for all nodes.
    
    'soft' (default) - fencing turned on, but connection death timeout is
    the same for leader and followers in replicaset. This is enough to
    solve cluster being readonly and not being to elect a new leader in
    some situations because of pre-vote.
    Connection death timeout is 4*replication_timeout for all nodes.
    
    'strict' - fencing turned on. In this mode leader tries its best to
    resign leadership before new leader can be elected. This is achived
    by halving death timeout on leader.
    Connection death timeout is 4*replication_timeout for followers and
    2*replication_timout for current leader.
    64ae9a08
    History
    raft: add strict fencing
    Boris Stepanenko authored
    With current leader fencing implementation old leader doesn't resign
    it's leadership before new leader may be elected. Because of this
    several "leaders" might coexist in replicaset for some time.
    
    This commit changes replication_disconnect_timeout that it is twice
    as short for current raft leader (2*replication_timeout) if strict
    fencing is enabled. Assuming that replication_timeout is the same for
    every replica in replicaset this makes it less probable that new
    leader can be elected before old one resigns it's leadership.
    
    Old fencing behaviour can be enabled by setting fencing to soft mode.
    This is useful when connection death timeouts shouldn't be affected
    (e.g. different replication_timeouts are set to prioritize some
    replicas as leader over the others).
    
    Closes #7110
    
    @TarantoolBot document
    Title: Strict fencing
    
    In `box.cfg` option `election_fencing_enabled` is deprecated in favor
    of `election_fencing_mode`. `election_fencing_mode` can be set to one
    of the following values:
    'off' - fencing turned off (same as `election_fencing_enabled` set to
    false before).
    Connection death timeout is 4*replication_timeout for all nodes.
    
    'soft' (default) - fencing turned on, but connection death timeout is
    the same for leader and followers in replicaset. This is enough to
    solve cluster being readonly and not being to elect a new leader in
    some situations because of pre-vote.
    Connection death timeout is 4*replication_timeout for all nodes.
    
    'strict' - fencing turned on. In this mode leader tries its best to
    resign leadership before new leader can be elected. This is achived
    by halving death timeout on leader.
    Connection death timeout is 4*replication_timeout for followers and
    2*replication_timout for current leader.