• antirez's avatar
    Sentinel: be safe under crash-recovery assumptions. · a31a0b43
    antirez authored
    Sentinel's main safety argument is that there are no two configurations
    for the same master with the same version (configuration epoch).
    
    For this to be true Sentinels require to be authorized by a majority.
    Additionally Sentinels require to do two important things:
    
    * Never vote again for the same epoch.
    * Never exchange an old vote for a fresh one.
    
    The first prerequisite, in a crash-recovery system model, requires to
    persist the master->leader_epoch on durable storage before to reply to
    messages. This was not the case.
    
    We also make sure to persist the current epoch in order to never reply
    to stale votes requests from other Sentinels, after a recovery.
    
    The configuration is persisted by making use of fsync(), this is
    considered in the context of this code a good enough guarantee that
    after a restart our durable state is restored, however this may not
    always be the case depending on the kind of hardware and operating
    system used.
    a31a0b43
sentinel.c 138 KB