High availability

Design and run Apache APISIX in a highly available configuration across traditional, decoupled, and standalone deployment modes.

In traditional, decoupled, and standalone modes, the requirements for a highly available APISIX deployment differ. This page outlines the architecture, component redundancy, and failure-domain decisions you need to make before going to production.

Deployment mode differences

[TODO] Add specific replica and failure-domain guidance for each mode.

Control plane and data plane replicas

[TODO] Document minimum and recommended replica counts for the control plane and data plane in each mode.

etcd quorum and fault domains

For etcd-based deployments, etcd should be deployed as an odd-numbered cluster (typically 3 or 5 nodes) across failure domains. Refer to etcd backup and restore for backup procedures.

[TODO] Add etcd node placement, disk, and network guidance.

Load balancer entry

[TODO] Document L4/L7 load balancer, health check, and DNS requirements in front of APISIX data plane nodes.

Configuration synchronization behavior

[TODO] Describe how APISIX syncs configuration from etcd and the behavior when the control plane or etcd is unavailable.

Single-node failure test

[TODO] Add a step-by-step procedure for killing one data plane or etcd node and verifying traffic continues.

Zone-level fault limits

[TODO] Document anti-affinity, topology spread, and multi-zone deployment guidance.

Recommended metrics and alerts

[TODO] List key metrics and example alert thresholds for APISIX, NGINX, Lua, and etcd.