Failover & Redundancy
IntermediateRedundancy duplicates critical components so that if one fails, another takes over. Failover is the process of switching to a standby component. Together, they achieve high availability.
Overview
Redundancy means having multiple copies of a component (server, database, network path) so that failure of one does not cause downtime. Failover is the mechanism that detects failure and switches traffic to a healthy replica. Active-passive failover keeps a standby replica ready to take over (simple, but standby wastes resources). Active-active failover has all replicas serving traffic simultaneously (efficient, but requires synchronisation). Failover can be automated (health checks trigger promotion) or manual (operator intervention). The key metric is Recovery Time Objective (RTO) — how fast the system recovers. Cloud services like AWS RDS Multi-AZ, Aurora, and Kubernetes automatically handle failover. Geographic redundancy (multi-region) protects against entire datacenter failures but introduces complexity around data replication and consistency.
Active-Passive vs Active-Active
Active-passive maintains a hot standby — simpler but the standby is idle. Active-active serves traffic on all replicas — efficient but requires data synchronisation and conflict resolution.
// Active-Passive failover
//
// ┌───────────┐ health check ┌───────────┐
// │ Primary │ ◄──────────────────►│ Standby │
// │ (Active) │ replication │ (Passive) │
// └─────┬─────┘ └─────┬─────┘
// │ all traffic │ no traffic (idle)
// ▼ │
// Clients │
// │
// Primary fails → health check detects → Standby promoted
// → DNS/LB updated → traffic flows to new primary
// Active-Active failover
//
// ┌───────────┐ ◄─── sync ───► ┌───────────┐
// │ Node A │ │ Node B │
// │ (Active) │ │ (Active) │
// └─────┬─────┘ └─────┬─────┘
// │ 50% traffic │ 50% traffic
// └──────────┬─────────────────────┘
// ▼
// Clients (load balanced)
//
// Node A fails → 100% traffic goes to Node B (seamless)Database Failover
Database failover promotes a read replica to primary when the primary fails. Automated failover (RDS Multi-AZ, Aurora) handles this without manual intervention.
// AWS RDS Multi-AZ — automatic failover
// Primary (us-east-1a) ──sync replication──► Standby (us-east-1b)
// Primary fails → RDS detects (30s) → promotes standby (~60-120s)
// DNS endpoint unchanged — applications reconnect automatically
// Aurora — faster failover (~30s)
// 1 writer + up to 15 read replicas
// Writer fails → Aurora promotes replica with least replication lag
// Failover priority tiers: tier-0 (first choice) to tier-15
// PostgreSQL manual failover with pg_promote
-- On the standby:
SELECT pg_promote(); -- promotes standby to primary
-- Application connection string updated to point to new primary
// Kubernetes StatefulSet failover
// Pod dies → Kubernetes reschedules on another node
// PersistentVolumeClaim reattaches to new pod
// Service DNS auto-updates to healthy podMulti-Region Redundancy
Geographic redundancy protects against entire region failures. Active-active multi-region provides the lowest RTO but requires cross-region data replication and conflict handling.
// Multi-region active-active
//
// US-East (primary for US users) EU-West (primary for EU users)
// ├── App instances ├── App instances
// ├── Database (writer) ├── Database (writer)
// └── Cache (Redis) └── Cache (Redis)
// │ │
// └───── async replication ──────────┘
//
// Region failure → DNS failover routes all traffic to surviving region
// RTO: seconds (DNS TTL) to minutes
// HA metrics:
// Availability | Downtime/year | Strategy
// ──────────────────────────────────────────
// 99% | 3.65 days | Basic redundancy
// 99.9% | 8.76 hours | Active-passive, automated failover
// 99.99% | 52.6 minutes | Active-active, multi-AZ
// 99.999% | 5.26 minutes | Active-active, multi-regionKey Points to Remember
- 1Redundancy = multiple copies of components; failover = automatic switchover on failure.
- 2Active-passive: standby ready, simple; active-active: all serve traffic, more efficient.
- 3RDS Multi-AZ provides automatic database failover in ~60-120s; Aurora in ~30s.
- 4Multi-region redundancy protects against datacenter failures but requires cross-region replication.
- 5Design for specific availability targets: 99.9% (8.76 hours/year downtime) vs 99.99% (52.6 minutes).
Interview Questions
Sign in to ask AriaWhat is the difference between active-passive and active-active failover?
How does AWS RDS Multi-AZ handle failover?
What is the difference between RTO and RPO?
Design a multi-region active-active architecture for a banking application.
How do you achieve 99.999% availability?
Ask Aria about Failover & Redundancy
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.