Active/Active vs Active/Passive: Site Resilience and Recovery Models
Redundancy comes in two shapes, and the choice between them determines cost, complexity and how long recovery takes. Active/active runs all nodes serving traffic simultaneously. Active/passive runs one while the other stands ready. Everything else in resilience design follows from that distinction. Active/passive One node handles everything; the standby monitors and takes over on failure. Failover may be automatic through a health check and a virtual address, or manual. The advantages are simplicity and predictability. There is one authoritative node, so no question of conflicting writes, and capacity planning is straightforward because a single node carries the full load by definition. The costs are real. The standby is paid for and idle, failover takes time — seconds to minutes, occasionally longer — and sessions in flight are usually lost. Worst of all, an untested standby frequently does not work: configuration drifts, a licence expires, a certificate lapses, and ...