CLUSTER

   1 TODO
   2
   3 *** WARNING: all the following problably has some meaning only for
   4 *** me (antirez), most info are not updated, so please consider this file
   5 *** as a private TODO list / brainstorming.
   6
   7 - disconnect FAIL clients after some pong idle time.
   8
   9 ---------------------------------
  10
  11 * Majority rule: the cluster con continue when there are all the hash slots covered AND when there are the majority of masters.
  12 * Shutdown on request rule: when a node sees many connections closed or even a timeout longer than usual on almost all the other nodes, it will usually wait for the normal timeout before to change the state, unless it receives a query from a client: in such a case it will put itself into error status.
  13
  14 --------------------------------
  15
  16 * When asked for a key that is not in a node's business it will reply:
  17
  18     -ASK 1.2.3.4:6379   (in case we want the client to ask just one time)
  19     -MOVED <slotid> 1.2.3.4:6379  (in case the hash slot is permanently moved)
  20
  21 So with -ASK a client should just retry the query against this new node, a single time.
  22
  23 With -MOVED the client should update its hash slots table to reflect the fact that now the specified node is the one to contact for the specified hash slot.
  24
  25 * Nodes communicate using a binary protocol.
  26
  27 * Node failure detection.
  28
  29     1) Every node contains information about all the other nodes:
  30         - If this node is believed to work ok or not
  31         - The hash slots for which this node is responsible
  32         - If the node is a master or a slave
  33         - If it is a slave, the slave of which node
  34         - if it is a master, the list of slave nodes
  35         - The slaves are ordered for "<ip>:<port>" string from lower to higher
  36           ordered lexicographically. When a master is down, the cluster will
  37           try to elect the first slave in the list.
  38
  39     2) Every node also contains the unix time where every other node was
  40        reported to work properly (that is, it replied to a ping or any other
  41        protocol request correctly). For every node we also store the timestamp
  42        at which we sent the latest ping, so we can easily compute the current
  43        lag.
  44
  45     3) From time to time a node pings a random node, selected among the nodes
  46        with the least recent "alive" time stamp. Three random nodes are selected
  47        and the one with lower alive time stamp is pinged.
  48
  49     4) The ping packet contains also information about a few random nodes
  50        alive time stamp. So that the receiver of the ping will update the
  51        alive table if the received alive timestamp is more recent the
  52        one present in the node local table.
  53
  54        In the ping packet every node "gossip" information is somethig like
  55        this:
  56
  57        <ip>:<port>:<status>:<pingsent_timestamp>:<pongreceived_timestamp>
  58
  59        status is OK, POSSIBLE_FAILURE, FAILURE.
  60
  61     5) The node replies to ping with a pong packet, that also contains a random
  62        selections of nodes timestamps.
  63
  64 A given node thinks another node may be in a failure state once there is a
  65 ping timeout bigger than 30 seconds (configurable).
  66
  67 When a possible failure is detected the node performs the following action:
  68
  69     1) Is the average between all the other nodes big? For instance bigger
  70        than 30 seconds / 2 = 15 seconds? Probably *we* are disconnected.
  71        In such a case we don't trust our lag data, and reset all the
  72        timestamps of sent ping to zero. This way when we'll reconnect there
  73        is no risk that we'll claim many nodes are down, taking inappropriate
  74        actions.
  75
  76     2) Messages from nodes marked as failed are *always* ignored by the other
  77        nodes. A new node needs to be "introduced" by a good online node.
  78
  79     3) If we are well connected (that is, condition "1" is not true) and a
  80        node timeout is > 30 seconds, we mark the node as POSSIBLE_FAILURE
  81        (a flat in the cluster node structure). Every time we sent a ping
  82        to another node we inform this other nodes that we detected this
  83        condition, as already stated.
  84
  85     4) Once a node receives a POSSIBLE_FAILURE status for a node that is
  86        already marked as POSSIBLE_FAILURE locally, it sends a message
  87        to all the other nodes of type NODE_FAILURE_DETECTED, communicating the
  88        ip/port of the specified node.
  89
  90        All the nodes need to update the status of this node setting it into
  91        FAILURE.
  92
  93     5) If the computer in FAILURE state is a master node, what is needed is
  94        to perform a Slave Election.
  95
  96 SLAVE ELECTION
  97
  98     1) The slave election is performed by the first slave (with slaves ordered
  99        lexicographically). Actually it is the first functioning slave, so if
 100        the first slave is marked as failing the next slave will perform the
 101        election and so forth. Such a slave is called the "Successor".
 102
 103     2) The Successor starts checking that all the nodes in the cluster already
 104        marked the master in FAILURE state. If at least one node does not agree
 105        no action is performed.
 106
 107     3) If all the nodes agree that the master is failing, the Successor does
 108        the following:
 109
 110        a) It will send a SUCCESSION message to all the other nodes, that will
 111           upgrade the hash slot tables accordingly. It will make sure that all
 112           the nodes are updated and if some node did not received the message
 113           it will keep trying.
 114        b) Once all nodes not marked as FAILURE accepted the SUCCESSION message
 115           it will update his own table and will start acting as a master
 116           accepting write queries.
 117        c) Every node receiving the succession message, if not already informed
 118           of the change will broadcast the same message to other three random
 119           nodes. No action is performed if the specified host was already marked
 120           as the master node.
 121        d) A node that was a slave of the original master that failed will
 122           switch master to the new one once the SUCCESSION message is received.
 123
 124 RANDOM
 125
 126     1) When selecting a slave, the system will try to pick one with an IP different than the master and other slaves, if possible.
 127
 128     2) The PING packet also contains information about the local configuration checksum. This is the SHA1 of the current configuration, without the bits that normally change form one node to another (like latest ping reply, failure status of nodes, and so forth). From time to time the local config SHA1 is checked against the list of the other nodes, and if there is a mismatch between our configuration and the most common one that lasts for more than N seconds, the most common configuration is asked and retrieved from another node. The event is logged.
 129
 130     3) Every time a node updates its internal cluster configuration, it dumps such a config in the cluster.conf file. On startup the configuration is reloaded.
 131     Nodes can share the cluster configuration when needed (for instance if SHA1 does not match) using this exact same format.
 132
 133 CLIENTS
 134
 135     - Clients may be configured to use slaves to perform reads, when read-after-write consistency is not required.