I'm very new to Galera Cluster and is exploring a potential setup with reasonable resiliency to node failure and network failure. Looking at the very bottom part of this documentation, the Weighted Quorum for a Primary and Secondary Site Scenario is quite promising. For ease of reading, I've extracted the setup from the document as follows:
When configuring quorum weights for primary and secondary sites, use the following pattern:
Primary Site: node1: pc.weight = 2 node2: pc.weight = 2 Secondary Site: node3: pc.weight = 1 node4: pc.weight = 1
Under this pattern, some nodes are located at the primary site while others are at the secondary site. In the event that the secondary site goes down or if network connectivity is lost between the sites, the nodes at the primary site remain the Primary Component. Additionally, either node1 or node2 can crash without the rest of the nodes becoming non-primary components.
But there seems to be two drawbacks:
- If there are two failed nodes and one of them happened to be on the primary site, the quorum will be <= 50% and the remaining two nodes will become non-primary components.
- Despite pc.weight is a dynamic option that can be changed while the server is running, flipping between primary site and secondary site requires modification on all nodes, which is a bit troublesome.
So I've come up with another idea in mind - leave the weight as 1 for all nodes, and in the primary site add a Galera Arbitrator. In this case:
- The primary site will remain the Primary Component on network issue, just like the original setup.
- The cluster still functions even if two nodes failed.
- Flipping between primary and secondary site just require a move of the Galera Arbitrator.
May I know if there's anything wrong with my idea, or if there will be any practical difficulties? Appreciate if you can share your thoughts with me.