Network & Infrastructure
Several cluster nodes remain powered on after a partition, but the service stops intentionally. Counting running nodes without examining membership and quorum can misclassify a safety decision as random downtime.
High Availability & Recovery Design2 min read
Read article : Quorum design: available nodes do not always mean an available service
Network & Infrastructure
A cluster promotes a replacement node while the former owner is isolated but still running. Without reliable exclusion, both may write to a shared resource simultaneously.
High Availability & Recovery Design2 min read
Read article : Fencing must prove exclusion before shared-resource takeover
Network & Infrastructure
A two-site design loses its witness whenever the preferred site fails, leaving the surviving site unable to obtain the expected decision authority. The witness shared the same physical dependency.
High Availability & Recovery Design2 min read
Read article : Witness placement and correlated site failure
Network & Infrastructure
A virtual gateway address moves quickly, but established NAT or application sessions still fail. Address ownership redundancy does not necessarily include the state maintained behind that address.
High Availability & Recovery Design1 min read
Read article : VRRP gateway failover does not replicate application state
Network & Infrastructure
A router remains the active gateway after its upstream service fails because its LAN interface is still up. Basic link tracking does not cover the full availability dependency.
High Availability & Recovery Design2 min read
Read article : VRRP tracking that detects upstream loss rather than link carrier
Network & Infrastructure
A preferred node repeatedly regains ownership before its dependencies are ready, then fails again. Automatic failback can create more disruption than remaining on a healthy secondary.
High Availability & Recovery Design1 min read
Read article : Preemption and failback oscillation after partial recovery
Network & Infrastructure
A failover platform changes a service address rapidly, but some clients continue using the failed destination. The recovery promise excluded resolver and application caching behavior.
High Availability & Recovery Design1 min read
Read article : DNS-based failover and the cache contribution to recovery time
Network & Infrastructure
An anycast node keeps advertising after its backend fails because the routing daemon is still healthy. Requests continue reaching a node that cannot complete the service.
High Availability & Recovery Design1 min read
Read article : Anycast health withdrawal and the difference between process and service
Network & Infrastructure
A backend returns a static health page while every useful request fails on an unavailable database. The load balancer distributes traffic evenly among servers that cannot perform their job.
High Availability & Recovery Design2 min read
Read article : Load-balancer readiness checks that exercise a real dependency
Network & Infrastructure
A maintenance drain stops new requests but leaves persistent sessions indefinitely active. An immediate shutdown then interrupts work despite a dashboard showing the backend removed from new selection.
High Availability & Recovery Design1 min read
Read article : Connection draining for services with long-lived sessions
Network & Infrastructure
A cluster has one spare node on paper but overloads when its largest node fails. Capacity counted by node quantity can hide unequal sizes and workload-placement constraints.
High Availability & Recovery Design2 min read
Read article : N+1 capacity under actual failure placement
Network & Infrastructure
A service spans two nominal zones but loses both during a single identity or network outage. Geographic or scheduling separation does not eliminate every common dependency.
High Availability & Recovery Design1 min read
Read article : Availability-zone labels versus actual shared dependencies