Service-aware failover
for active-active services.

Web, mail, and DNS can live in the same daemon while preferring different nodes and failing independently. Each resource controller owns only its mutable lifecycle state, operation generation, timers, and status snapshot. Shared capabilities such as the BGP runtime keep one lifecycle, but they do not merge resource authority.

Every asynchronous result carries the authority and operation generation that started it. If ownership changes while a netlink or publisher operation is still in flight, the late result is rejected instead of completing a newer transition. One resource failure does not reset unrelated controllers unless a shared runtime is unsafe for all of them.

Read resource reconciliation and state-machine invariants →

Service-specific checks run outside the elasticd authority daemon. Monit, Consul, or root-managed scripts submit fresh health reports through its local health socket. This keeps application credentials and protocol logic outside the privileged HA daemon.

Every required check begins as unknown after restart. Acceptable states carry a bounded TTL derived from the daemon’s monotonic receive time; producer timestamps cannot extend it. Missing, expired, critical, withdrawn, malformed, or unauthorized evidence never satisfies eligibility.

Health can remove a node from contention, but it cannot create ownership or request a VIP. Read local health notification and eligibility →

Resource configuration defines ownership priorities and required health checks. Fresh health reports determine which nodes are eligible, and the configured preference guides owner selection. The selected node still needs a committed Raft ownership grant and an unexpired local lease before it can act. Health or priority alone never grants ownership.

Handover is break-before-make: the current owner withdraws routes, waits for the required propagation delay, removes managed VIPs, and confirms cleanup before releasing ownership. If it crashes or cleanup cannot be proven, the successor waits a conservative safety delay before taking over. Leases and takeover safeguards prevent the previous and next owners from overlapping.

The design prefers an explicit outage to two correct owners. Understand ownership leases and safe takeover →

The address capability owns only exact configured pairs: interface name plus canonical host prefix. It may add, observe, or remove those pairs. It does not create or bring up the interface, adopt an address it discovers, infer resources from host networking, or touch unrelated addresses, routes, rules, neighbors, namespaces, sysctls, or firewall state.

Netlink events are wake-up hints, not durable truth. Full link-and-address observation is authoritative at startup, after event loss or decode failure, after link replacement, and periodically. IPv4 must be observed on the expected link; IPv6 must also clear tentative, duplicate-address, and deprecation checks required by the address contract.

If an active VIP disappears, elasticd withdraws publication before repairing the address and republishing. Read managed VIP and netlink reconciliation →

The publisher accepts only validated route intent from resource configuration. It does not scan interfaces, redistribute kernel routes, derive aggregates, import routes into the host, or let an arbitrary path cross the publisher boundary. For v0.1, one embedded GoBGP server and peer set are shared across resources, while desired routes remain resource-scoped.

Local publication proves the exact elasticd-originated path exists in the embedded BGP local RIB for the current authority generation. It does not prove that a peer selected it or that every downstream router converged. Peer failure is operational degradation, not a new ownership election.

Clean drain proves local route absence and maintains it through the configured propagation delay before removing the VIP and releasing authority. Unclean takeover waits the declared stale-route fence. Read publisher intent, BGP observation, and fencing →