> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jacobpevans.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Clusters and quorum
> Why several hypervisor hosts are joined into one system, and why the number of votes matters more than the number of machines.
> Two machines that disagree about who is in charge each confidently do the wrong thing. Quorum is how you stop that.
A **cluster** is several hypervisor hosts managed as one system. You get one place to see
everything, guests can move between hosts, and, best of all, the cluster can react
automatically when a host disappears.
Joining machines together creates a problem that does not exist with one machine. They now have to agree on things, and the network between them can fail.
## The split-brain problem
Picture two hosts and a network cable between them. The cable is cut. Neither host is broken; each simply cannot reach the other.
From inside each host, that is indistinguishable from *the other one died*. So each concludes it is
the survivor and starts the guests it thinks were lost. Now the same guest is running twice, on two
hosts, both writing to what they believe is the same disk.
That is **split-brain**, and it corrupts data rather than merely causing downtime. It is the failure that cluster design exists to prevent.
```mermaid theme={null}
%%{init:
{'theme':'base','look':'handDrawn','themeVariables':{'fontFamily':'Geist','fontSize':'14px','primaryColor':'#102937','primaryTextColor':'#F4EFE6','primaryBorderColor':'#4FB3A9','lineColor':'#4FB3A9','secondaryColor':'#0B1D2A','tertiaryColor':'#1A2A38','clusterBkg':'rgba(79,179,169,0.08)','clusterBorder':'#4FB3A9'}}}%%
flowchart LR
subgraph A["node-a"]
HostA([Hypervisor A])
GuestA([Guest, running])
end
Link{Network link}
subgraph B["node-b"]
HostB([Hypervisor B])
GuestB([Guest, also running])
end
HostA --> Link
Link --> HostB
HostA --> GuestA
HostB --> GuestB
classDef host fill:#102937,stroke:#4FB3A9,stroke-width:2px,color:#F4EFE6;
classDef gate fill:#102937,stroke:#E06B4A,stroke-width:2.5px,color:#F4EFE6;
classDef sink fill:#102937,stroke:#F4EFE6,stroke-width:2.5px,color:#F4EFE6;
class HostA,HostB host
class Link gate
class GuestA,GuestB sink
linkStyle 0,1 stroke:#E06B4A,stroke-width:2px,stroke-dasharray:4 4;
```
## Quorum is the fix
Each host gets a vote. A host may only run guests if it can see **more than half** of all votes. Not half. *More than* half.
With four hosts, four votes, a majority is three. Split them two-and-two and neither side has three,
so **both sides stop**. That sounds like a worse outcome than split-brain until you remember the
alternative was silent data corruption. Downtime is recoverable; two writers on one disk often
isn't.
| Hosts | Votes needed | Can survive losing |
| - | - | - |
| 2 | 2 | nothing: losing either stops the cluster |
| 3 | 2 | one host |
| 4 | 3 | one host |
| 5 | 3 | two hosts |
Read the two-host row carefully. Adding a second machine for redundancy, with no other change, makes
things **worse**. You go from one machine that can fail to two machines that each can take the
cluster down. This surprises nearly everyone.
## Why odd numbers
Four hosts survive exactly as many failures as three do, and cost you an extra machine to reach that
identical result. Five survive two. So the useful counts are odd, and the sizes that actually buy
something are 3 and 5.
An even count is not wrong. It is simply paying for a machine that adds no fault tolerance. Where
an even count exists, it is usually because the extra host was added for capacity rather than
resilience, which is a perfectly good reason.
Some clusters solve the two-host case with a **witness**: a tiny third voter that holds no guests
and exists only to break ties. It can be something as small as a Raspberry Pi. Three votes, two
machines' worth of hardware.
## Where to go next
Quorum decides who may act. This is what they actually do.
The layer underneath, if clusters are getting ahead of you.