Hello, I'm in the process of improving the Sentinel configuration to
make certain things simpler, but if you check the current config, it
is already well-stated that you need the majority of Sentinels to
authorize a failover. Quorum is used for the failure detection, so
this is how it works:
Step 1) Failure detection: is quorum reached to consider the master
failing? If so, go to step 2.
Step 2) Is there the majority to authorize a failover? If so,
failover, otherwise do nothing.
Otherwise in your proposed setup, if the two servers where you have,
in each, a Sentinel+Redis server combo would no longer able to talk
with the other side, what you get is two masters since the minority
side is able to elect the slave to master. Moreover the majority is
needed in order to create an unique configuration number that is later
used in order to propagate the latest configuration for a given master
(who is the active master).
Salvatore
--
Salvatore 'antirez' Sanfilippo
open source developer - Pivotal
http://pivotal.io
"If a system is to have conceptual integrity, someone must control the
concepts."
— Fred Brooks, "The Mythical Man-Month", 1975.