For a single data center, when you deploy a cluster of three nodes you can implement built-in High Availability (HA). Cortex XSOAR on-prem currently supports an HA solution for a use case of node failure, in which the system experiences downtime and then restores automatically.
A cluster of three nodes enables distributing the workload and replicating data across the nodes to ensure continuous operation. If one node fails, the remaining nodes take over the tasks and data handling, minimizing downtime and maintaining service availability. This setup allows for redundancy and enhances the overall resilience of the system.
Note
Kubernetes requires a majority of control plane nodes to be online for it to function, so a three node cluster requires two to be online. If two nodes fail but are fixed and go back online, the cluster will recover. However, if two nodes fail and are not able to go back online, open a support session for assistance.
Built-in High Availability works as follows:
Tasks and data are distributed across the nodes to balance the load.
Data is replicated across nodes, ensuring no single point of failure.
If a node goes down, workloads on the failed node are automatically distributed to the other nodes.
Note
There may be a several minutes of downtime until the other nodes take over.
Once the failed node is restored, it automatically reintegrates into the cluster and the workloads are automatically rescheduled.
Monitor and manage nodes
Once you set up your cluster and install Cortex XSOAR, you can monitor node status and recover from node failure as needed.
In Cortex XSOAR, monitor the node health in the System Diagnostics page. For more information, see View system status in the System Diagnostics page.
If there is a node failure, manage the nodes from the textual UI.
For example, if a node fails remove it and then add a new node to replace it. For more information, see Manage nodes in a cluster.
You need to set the host again and reestablish trust between all the nodes if you want to replace a node in the cluster after completing installation.