WL#11568: Group Replication: option to shutdown server when dropping out of the group

Affects: Server-8.0   —   Status: Complete 

EXECUTIVE SUMMARY
=================

This worklog implements an option allowing the user to define the
behavior of the server once it drops out of the cluster. The option
allows the user to specify if the server should voluntarily shut
itself down or if it switches itself to super read only mode instead
(current behavior).

USER STORIES
============

- As a developer using MySQL I want to always read data from a MySQL
  server that is connected to replication so I minimize my chances of
  reading stale data.

- As a MySQL DBA I want my servers to automatically shoot themselves
  in the head if they involuntarily drop out of replication, so that
  other components in my system do not engage stale servers, or remove
  connections automatically to stale servers, or both.

- As a system builder, I want my system to react (e.g., close
  connections, remove server from the pool of "good" servers, etc)
  whenever a server goes involuntarily offline w.r.t. replication, so
  that I avoid to pro-actively polling the system to figure that out.

- As a proxy tool routing connections to a MySQL server, I want to
  get my connections to stale servers automatically closed, so that
  these connections are evicted from my routing cache automatically.

PROBLEMS
========

Issues:

- When a server drops out of the group, it sets itself as
  super-read-only, thus still allowing stale reads.
- When a server is stuck on a minority partition, it is still
  readable, thus still allowing stale reads!
- There is no notification emitted to other parts of the
  infrastructure, not even automatic connection closing when a
  server drops outside of replication.

Users want:

- MySQL Router to kill all open connections to a server that leaves
  the group (setting instance to RO is not sufficient).
- MySQL Router to kill all open connections to a server that is
  stuck on a minority.
- Those who not use MySQL Router want a more autonomic system where
  the server automatically restrict access if it runs into an
  unrecoverable local error (has gone out of sync).

What automatic shutdown does (side-effects):

- Closes all open connections and prevents client apps from doing
  stale reads or failed writes.

- Allows for systemd or watchdog tool to restart the server (and
  thus rejoin automatically)


Copyright (c) 2000, 2025, Oracle Corporation and/or its affiliates. All rights reserved.