Kepiye sampeyan ngrancang DB multi-region kanggo HA lan DR?

Question

IT Interview Practice · Accepted Answer

Replikasi database ing pirang-pirang region lan pilih topologi miturut kabutuhan: **active-passive** (siji writer, standby anget sing njupuk alih nalika failover) kanggo kesederhanaan lan konsistensi kuwat, utawa **active-active** (pirang-pirang writer) kanggo latency tulisan endhek kanthi biaya resolusi konflik — banjur pilih **sync vs async replication** kanggo trade durabilitas marang latency, lan nemtokake target **RPO/RTO** eksplisit sing ngendhaleni failover.

```text
        ┌──────────── Region A (primary) ────────────┐
writes ─▶ app ─▶ DB primary ──┐
                              │ replication
        ┌─────────────────────┼── async (RPO>0) ─────┐
        │                     └── sync (RPO=0, slow)  │
        ▼                                             ▼
   Region B standby                            (failover promotes standby)
        │
   health check ──▶ on primary loss: promote + repoint DNS/traffic
```

## Active-passive vs active-active

**Active-passive** duwe siji primary sing nangani tulisan lan standby sing mung maca; nalika gagal sampeyan **promosekake** standby. Iku prasaja lan nyingkiri konflik tulisan, nanging kapasitas pasif nganggur lan failover duwe gap. **Active-active** ngidini saben region nampa tulisan kanggo latency lokal lan tanpa promosi failover — nanging rong region bisa ngowahi row sing padha bebarengan, mula sampeyan *kudu* ngrampungake konflik (last-write-wins, CRDT, utawa merge level-app). Umume tim miwiti active-passive; active-active kanggo latency tulisan global sing pancen ora bisa sampeyan tekani kanthi cara liya.

## Sync vs async replication

Iki minangka trade durabilitas/latency inti. **Sinkron:** primary ngenteni replika jarak jauh ngakoni sadurunge komit — **RPO = 0** (ora ana data ilang nalika failover) nanging saben tulisan mbayar latency round-trip lintas-region (~puluhan ms), lan yen replika ora bisa dijangkau, tulisan mandheg. **Asinkron:** primary komit lokal lan ngirim owah-owahan sabanjure — tulisan cepet, nanging kelangan region bisa ilang sawetara detik pungkasan (**RPO > 0**). Sync lintas-region asring kealon-alonen, mula akeh sing mlaku async lan nampa RPO cilik.

## Failover, RPO & RTO

- **RPO (Recovery Point Objective):** sepira data sing bisa sampeyan ilang — ditemtokake sync vs async.
- **RTO (Recovery Time Objective):** sepira suwe nganti sampeyan bali — ditemtokake sepira cepet sampeyan ndeteksi kegagalan lan mpromosekake.
- Failover = deteksi (health check) → promosekake standby → arahake maneh lalu lintas (DNS/global LB). Otomatisasi, nanging jaga marang **split-brain** (loro region ngira awake primary) nganggo quorum/fencing token.

## Sudut pandang wawancara

Sing diselidiki: apa sampeyan ngerti yen HA/DR iku **trade antarane konsistensi, latency, lan data ilang** — dudu "cukup tambah replika". Apik: active-passive kanthi standby. Apik banget: sampeyan nyebutake RPO/RTO, implikasi sync-vs-async, lan risiko split-brain. Jebakane: ngaku async menehi nol data ilang, utawa nganggep failover sanalika lan tanpa kerugian.

## Trade-off & mode kegagalan

- **Split-brain:** partisi jaringan mromosekake loro primary → data nyimpang. Nganggo quorum, fencing, utawa witness region.
- **Failback angel:** sawise primary lawas bali, ngrekonsiliasi tulisan sing nyimpang iku manual lan gampang salah.
- **Biaya:** multi-region sejati kira-kira nggandakake infra lan nambah tagihan bandwidth egress lintas-region.
- **Failover sing ora diuji gagal:** DR sing ora tau dilatih ora bakal mlaku ing gangguan nyata — anakake game-day.

Active-passive vs active-active

Sync vs async replication

Failover, RPO & RTO

Sudut pandang wawancara

Trade-off & mode kegagalan

Pitakon sing gegandhengan