In an HA configuration, fail-safe mode ensures that one node is always primary when both nodes fail the health check. This is to ensure that when a node is only partially available, backup methods are enabled to handle traffic as best as possible. The HA fail-safe mode is configured independently on the primary and secondary nodes.
The following table shows some of the fail-safe cases. The NOT\_UP state means that the node failed the health check yet it is partially available. The UP state means that the node passed the health check.
| Node A (Primary) Health State |
Node B (Secondary) Health State |
Default HA Behavior |
Fail-Safe Enabled HA Behavior |
Description |
| NOT_UP(failed last) |
NOT_UP (failed first) |
A (Secondary), B (Secondary) |
A (Primary), B (Secondary) |
If both nodes fail, one after the other, the node that was the last primary remains primary. |
| NOT_UP (failed first) |
NOT_UP(failed last) |
A (Secondary), B (Secondary) |
A(Secondary), B(Primary) |
If both nodes fail, one after the other, the node that was the last primary remains primary. |
| UP |
UP |
A (Primary), B (Secondary) |
A (Primary), B (Secondary) |
If both nodes pass the health check, no change in behavior with fail-safe enabled. |
| UP |
NOT_UP |
A(Primary), B(Secondary) |
A (Primary), B (Secondary) |
If only the secondary node fails, no change in behavior with fail-safe enabled. |
| NOT_UP |
UP |
A(Secondary), B(Primary) |
A(Secondary), B(Primary) |
If only the primary fails, no change in behavior with fail-safe enabled. |
| NOT_UP |
UP (STAYSECONDARY) |
A (Secondary), B (Secondary) |
A (Primary), B (Secondary) |
If the secondary is configured as STAYSECONDARY, the primary remains primary even if it fails. |