3.7.1. Clustering: Active-Active and Active-Passive
💡 First Principle: A cluster is two or more servers that present themselves as a single logical service. The servers monitor each other via a heartbeat connection; if one fails, the others take over. The difference between active-active and active-passive determines how the cluster uses resources normally.
Active-Passive Clustering
In active-passive, one node serves traffic (active) while the other stands ready (passive):
- Failover: The passive node takes over services when the active node fails. Usually automatic, triggered by heartbeat loss.
- Failback: Returning services to the original active node after it's repaired. Can be automatic or manual (manual is safer—verify the node is healthy before failback).
- Heartbeat: A dedicated connection between cluster nodes that monitors health. If the active node stops sending heartbeats, the passive node initiates failover. The heartbeat network should be on a separate network from production traffic.
- Proper patching procedures: Patching clustered servers requires moving services to the passive node first, patching the now-passive node, then failing back and patching the other node. This maintains availability throughout the patch cycle.
Active-Active Clustering
In active-active, all nodes serve traffic simultaneously:
- Advantages: Full utilization of all nodes; can handle the loss of a node because remaining nodes absorb its load (if they have capacity)
- Requirements: Load balancer to distribute requests; shared state management between nodes (sessions, transactions); careful capacity planning to ensure remaining nodes can handle full load after one fails
Split-Brain Problem
If the heartbeat network fails (but both nodes are otherwise healthy), each node may believe the other has failed and both attempt to go active simultaneously. This "split-brain" scenario can cause data corruption (both nodes write to shared storage). Solutions include quorum devices (a third witness), STONITH (Shoot The Other Node In The Head—forcefully powering off the suspected-failed node), or majority node sets.
⚠️ Exam Trap: A cluster with two nodes requires careful thought about the heartbeat network. The heartbeat should be on a dedicated network separate from the production NIC—otherwise a production NIC failure causes false failover even when the primary node is healthy.
Reflection Question: A two-node active-passive cluster fails over correctly when the primary node fails, but the passive node refuses to take over when only the heartbeat network fails (while both nodes are otherwise functional). Why is this behavior correct, and what problem does it prevent?
