Data protection & recovery
Stretched cluster
A stretched cluster is a single storage cluster whose nodes are distributed across two or more physical sites and operate as one system. Data is written synchronously to all sites, so each holds a current copy, and the cluster continues to serve requests if one site is lost.
How does a stretched cluster differ from replication between clusters?
The alternative design is two independent clusters with geo-replication between them.
| Aspect | Stretched cluster | Two clusters with replication |
|---|---|---|
| Number of systems | One, with one namespace | Two, each with its own |
| Write path | Synchronous to all sites | Local, then copied |
| Data loss on site failure | None | Up to the replication lag |
| Failover | Automatic, clients keep the same endpoint | Redirect clients to the other cluster |
| Distance | Limited by latency | Unlimited |
| Dependence on the inter-site link | Every write | Background copy only |
Why is a third site needed?
If the link between two sites fails, each side sees the other as down. Without a rule to decide which side continues, both might accept writes and diverge, a condition called split brain. Clusters avoid this by requiring a majority, or quorum, to operate. With two equal sites neither has a majority alone, so a third location is needed to break the tie. It may hold a full share of the data or only a lightweight witness. Designs with three full sites can also spread erasure-coded data so that any one site can be lost with less capacity overhead than full copies.
What does latency allow?
Because every write waits for the remote sites, the round-trip time between them is added to each operation. Stretched clusters are therefore built across metropolitan distances, typically within a few milliseconds of each other, over redundant, high-capacity links. The link must also carry rebuild traffic after a failure, which can be far heavier than normal writes. Greater distances are served by asynchronous replication.
When is a stretched cluster the right design?
It suits workloads that cannot lose any acknowledged data and need service to continue automatically through a site outage, where the sites are close enough and well enough connected. It provides storage high availability across sites with a single system to manage. It is not a substitute for backup, since all sites share one logical state, and it places heavy reliance on the inter-site network. Stretched clusters and site failover compare the two approaches in operation.
Frequently asked questions
Can a stretched cluster work with only two sites?
It can run, but it needs a tiebreaker at a third location to avoid split brain when the link fails.
Does a stretched cluster replace disaster recovery?
It covers site loss. It does not cover logical errors or events that affect all sites, which still need backups or a distant copy.
What happens when a site comes back?
The cluster resynchronizes the data that changed while the site was away, as a background task.
Related terms
- Geo-replication: the asynchronous alternative.
- Failover: what the cluster performs automatically.
- Storage high availability: the property a stretched cluster extends across sites.
- Strong consistency: the guarantee synchronous writes preserve.
- Rack awareness: the same idea of failure domains within a site.