Failover

Three sequential states show a writable, then neither a nor b writable after fencing, then b writable after promotion. The writer counts are 1, 0, 1; the safe transition allows zero.

Failover is a practiced switch

A standby helps only if the promotion path works and the old writer cannot corrupt the new history. Failover is a decision, a procedure, and a rehearsal. A healthy-looking replica is not proof that clients can reach it or that it contains every acknowledged write. Define the required recovery time and acceptable data loss before deciding when to switch. ...

Five known Sentinel observers illustrate quorum two for failure agreement and majority three for failover authorization.

Redis Sentinel coordinates primary failover

Redis Sentinel supervises a non-Cluster primary/replica deployment and publishes the current primary’s address. It does not store the application’s dataset or proxy its commands. Automatic promotion can restore write availability after a primary fails, but discovery, replica freshness, client reconnection, and protection from stale writers remain separate parts of the system. ...