Applies toMySQL 8.0 and 8.4 LTS; Percona XtraDB Cluster / MariaDB Galera for comparison; Amazon RDS/Aurora MySQL, Azure Database for MySQL Flexible Server HA
Options compared
| Option | Data loss on failover | Failover | Effort |
|---|---|---|---|
| Async replication + manual failover | Possible (unreplicated transactions) | Manual, minutes+ | Low setup, high incident effort |
| Async/semi-sync + orchestrator tool (e.g. Orchestrator, MHA-style) | Reduced with semi-sync | Automatic | Medium |
| InnoDB Cluster (Group Replication + MySQL Router + Shell) | None for committed transactions in single-primary mode (majority) | Automatic, seconds | Medium; needs 3+ nodes |
| InnoDB ClusterSet | Cluster per region, async between | Regional failover manual/controlled | Higher |
| Galera (Percona XtraDB Cluster, MariaDB) | None (certification-based) | Automatic | Medium; write conflicts and large transaction limits |
| Managed Multi-AZ (RDS, Aurora, Azure Flexible HA) | None/minimal within region | Automatic, provider-managed | Lowest |
Decision questions
- RPO: can you lose the last few transactions? If not, avoid pure async for HA.
- RTO: seconds (automatic) or minutes (manual acceptable)?
- Where: self-managed (on-prem/VMs) or a managed service available?
- Write pattern: large transactions and hot rows can struggle with Group Replication/Galera certification.
- Skills: who runs the cluster at 3 AM?
Typical choices
| Situation | Choice |
|---|---|
| Cloud, standard workload | Managed Multi-AZ HA |
| Self-managed, need zero data loss and automatic failover | InnoDB Cluster (3 nodes) |
| Existing async replicas, simple apps | Semi-sync + orchestrated failover |
| Multi-region DR | Async replica or ClusterSet to the second region (see the MySQL DR post) |
Application side
- Connect through a router/proxy (MySQL Router, ProxySQL) or a DNS endpoint that follows the primary.
- Retry logic for transient errors during failover.
- Avoid relying on reading your own writes from replicas unless consistency settings guarantee it.
Tip
Test failover under load before go-live and quarterly afterwards. Measure actual RTO and check for lost or duplicated transactions.
Checklist
- RPO and RTO agreed
- Option chosen per environment
- Write pattern checked for cluster compatibility
- Router/proxy and application retries in place
- Failover tested and timed