Gateway Leader Failover Sequence

Gateway Leader Failover Sequence A sequence diagram generated by Archify. renew lease — fails Election defaults are not a measured recovery time. acquire lease (retryPeriod 1s) Gateway Pod 2 becomes the new leader First: AWS CreateRoute / ReplaceRoute Configured aggregate routes point to the new leader ENI. Then: CiliumVTEPConfig endpoints Update tunnelEndpoint/cidr/mac for Cilium VTEP consumers. Leadership loss / lease handling Eligible standby acquires leadership Ordered setup: AWS routes first, VTEP endpoints second Gateway Pod 1 · leader (fails) · Sequence participant Gateway Pod 1 leader (fails) Kubernetes Lease · leader election · Sequence participant Kubernetes Lease leader election Gateway Pod 2 · standby → leader · Sequence participant Gateway Pod 2 standby → leader VTEPConfig / VPC RT · data-plane targets · Sequence participant VTEPConfig / VPC RT data-plane targets Legend lease acquired failed call config update

Recovery prerequisites

  • • Defaults3s lease /2s renew deadline /1s retry are not latency guarantees
  • • Every replica already reconciles local tunnel state
  • • AWS aggregate routes update before VTEP endpoints
  • • Measure API convergence, packet loss and application recovery

During the Failover Window

  • • VPC-to-hybrid path depends on current AWS routes
  • • Hybrid-to-VPC path depends on the active VTEP endpoint
  • • Intra-hybrid paths bypass the gateway but may share failed infrastructure