THE FIELD GUIDE / OPERATIONS
High availability with MySQL
Run redundant controllers and preserve authorization, shared state and operation ownership across failures.
Choose a serving mode
Active/standby uses one eligible serving controller with reviewed handoff or policy-controlled promotion. Active/active accepts UI and API requests on eligible nodes while coordinating scheduler leadership and durable work separately. Deployment health shows membership, boot generation, readiness, role, version, failure domain and promotion reason.
Keep shared dependencies authoritative
Use redundant ingress and a supported TLS-verified MySQL failover topology. Controllers share consistent deployment identity, secret access and committed durable artifacts. Ingress distinguishes liveness from role eligibility. TLS revisions and renewals coordinate across the deployment. Sessions, revocation and notification cursors follow authoritative shared state.
Fence stale owners and reconcile unknown outcomes
Durable ownership epochs prevent stale schedulers and workers from issuing new side effects. On lost ownership or uncertain database commits, the system stops new dispatch and checks target receipts before adopting work. An interrupted package, firmware or paid AI operation retains its hold or reservation until evidence resolves it.
Coordinate migrations and exercise recovery
One authorized migration owner records schema progress. Compatibility checks control replica admission and rolling maintenance. Drain, hand off, verify and rejoin under an availability budget. Failure drills cover controllers, workers, ingress, MySQL, storage and secret access. Keep isolated restore evidence alongside failover receipts.
Open the application reference for capability scope and technical details.
Open View scope in issue #446 ↗