[dviejokfs]

Losing the only control-plane host can interrupt public ingress and leave database role DNS serving stale addresses even when workloads survive. ADR-045 proposes independent redundant ingress, worker-side execution and probes, autonomous database role discovery, and multiple consoles coordinated through durable jobs and fencing.

The proposal defines failure guarantees, rollout phases, alternatives, and failure-injection acceptance criteria, building on #1031. Its status is Proposed; it does not claim these HA guarantees are implemented.

Scope: only docs/adr/045-multi-node-control-plane-and-ingress-ha.md.

Validation: all relative links resolve; staged whitespace checks and pre-commit hooks passed (trailing whitespace, final newline, typos, and Conventional Commit). No runtime code changed.

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Documentation

- **architecture:** Propose multi-node control plane and ingress HA
- **architecture:** Address HA review findings
- **architecture:** Define role observation transport

[greptile-apps]

Confidence Score: 5/5

The documentation-only PR appears safe to merge, with no outstanding actionable findings.

Summary

The revision completes ADR-045’s console-independent database-role observation design and addresses the previous missing-transport finding.

• Defines a worker-authenticated endpoint and signed observation envelopes.
• Introduces two persisted, independently rooted dissemination trees with bounded resource usage.
• Specifies one-path continuity, fail-closed expiry, cold-start behavior, and readiness gates.
• Extends rollout and failure-injection criteria to validate observer and dissemination-path failures.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  OA[Assigned Observer A] --> TA[Dissemination Tree A]
  OB[Assigned Observer B] --> TB[Dissemination Tree B]
  TA --> W[Consuming Worker]
  TB --> W
  W --> R[Local Role DNS View]
  CP[Control Plane] -. topology updates while available .-> TA
  CP -. topology updates while available .-> TB
  OA --> M[Database HA Monitor]
  OB --> M

Loading

_{Reviews (4) · Last reviewed commit: "docs(architecture): define role observat..."}