Leader election

Leader election chooses a coordinator for an epoch. It does not, by itself, guarantee exclusive external effects. A process can pause, lose its lease, and later resume believing it is still leader.

Production invariant: election plus fencing

A safe design combines:

1. a linearizable coordination decision through a quorum;
2. a monotonically increasing epoch or fencing token;
3. a protected resource that stores the greatest accepted token and rejects smaller tokens.

A lease timestamp checked only by the client process is insufficient. Clock skew and long pauses can outlive the lease. The downstream database, object store, lock service, or proxy must validate the fence.

Failure detection is suspicion

Timeouts cannot distinguish a crashed process from a slow process or partition. Failure detectors therefore trade completeness against accuracy. Election protocols preserve their safety rules when suspicion is wrong; timing assumptions are used for progress.

ZooKeeper recipe

The standard recipe creates an ephemeral sequential znode. The contender with the smallest sequence is leader, and each other contender watches its immediate predecessor. Watching the parent makes every waiter wake at once.

A connection loss after create is ambiguous: the znode may exist. Use recoverable identity/protected creation and find the existing contender before retrying. Session expiry, not a transient disconnect alone, releases ephemeral ownership.

Bully algorithm scope

The Bully algorithm is useful pedagogically under explicit assumptions: fixed known membership, totally ordered unique IDs, direct communication, and eventually reliable timeout-based failure detection. The highest live process wins. Its election message pattern can be quadratic in the number of processes. It is not a partition-safe substitute for quorum consensus plus fencing.

Operational checklist

Persist epoch and owner, make acquisition/release idempotent, expose lease and quorum health, reject stale tokens at every side-effecting resource, and test process pauses as well as crashes.

Diagram scenarios

The animation covers fenced leases, session loss and stale rejection, ZooKeeper predecessor watches, ambiguous creation, and the Bully algorithm's assumption boundary.

Related concepts

Interactive scenarios