docs(dha): correct the stock-HPA motivation (topology, not victim selection) - #42
Conversation
…ection) The motivation and the "Stock HPA + KEDA" alternative claimed HPA "would happily remove a synchronous standby." That misattributes the mechanism: HPA only writes a replica count (for CloudNativePG, Cluster.spec.instances, not spec.replicas), and which instance to add or remove — and in what order — is the engine operator's decision (CNPG removes the highest-ordinal standby, never the primary). Restate the real reason a stock HPA does not fit: it is topology-blind — nothing encodes the synchronous-commit quorum floor (maxSyncReplicas + 1), so it can drive the count below it, and there is no replication-lag gate. The Flux argument is dropped from the HPA point; the accurate "a direct patch to the operator CR is reverted by Flux" note under the direct-patch alternative already covers that ground. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 36 seconds Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
What this changes
Corrects a factual error in the Database Horizontal Autoscaler design proposal's motivation. The text claimed a stock
HorizontalPodAutoscaler"would happily remove a synchronous standby." That misattributes the mechanism: HPA only writes a replica count (for CloudNativePG that field isCluster.spec.instances, notspec.replicas), and which instance to add or remove — and in what order — is the engine operator's decision. CNPG removes the highest-ordinal standby and never the primary; an autoscaler cannot express victim selection at all.The corrected wording states the real reason a stock HPA does not fit: it is topology-blind. Nothing in HPA encodes the synchronous-commit quorum floor (
maxSyncReplicas + 1), so it can drive the count below it — at which point the operator either rejects the change or loses its write quorum — and it has no gate on replication lag, scaling on the load metric alone while standbys are arbitrarily behind. This is exactly the split the proposed operator implements: it owns the count and the safety guardrails and leaves instance lifecycle to the engine operator.The "fights Flux" clause is dropped from the HPA point; the accurate "a direct patch to the operator CR is reverted by Flux" note under the direct-patch alternative already covers that ground, so the design's rationale for writing through the apps API is not lost.
Prose-only change to
design-proposals/database-horizontal-autoscaling/README.md; no code is affected.