mirror of
https://github.com/versity/scoutfs.git
synced 2026-07-25 01:23:13 +00:00
Auke Kok
69b09eafe3
A quorum member that loses contact with the majority used to increment and persist its term on every election timeout while it could never win. A network-partitioned former leader could climb its term far above the cluster's, then on reboot read that inflated term back from its quorum block and usurp the leader that legitimately replaced it. The previous term-persist approach (deferring the durable term write until a vote arrived) did not cover a partition that splits off an intercommunicating sub-majority: in a five node cluster a two node minority that can still reach each other exchange votes, so both the voter (adopting the higher term) and the candidate (seeing a vote) persist the climbing term anyway. Add a raft pre-vote round. On election timeout a member becomes a pre-candidate and probes for support at its prospective next term without incrementing or persisting it. Peers grant a pre-vote only when they do not currently see a live leader, and pre-vote messages are excluded from the adopt-greater-term path so granting changes no state. Only once a majority of pre-votes is collected does the member increment its term, persist it, and stand for election for real. A partitioned member or sub-majority can never reach a majority of pre-votes, so it loops pre-vote rounds at a frozen term, never inflating it, and follows the majority's leader once the partition heals. Signed-off-by: Auke Kok <auke.kok@versity.com>