Fail over to the secondary site

This describes the automatic and operational procedures necessary

This guide describes the steps to fail over from primary site to secondary site in a setup as outlined in Concepts for active-passive deployments together with the blueprints outlined in Building blocks active-passive deployments.

When to use procedure

A failover from the primary site to the secondary site will happen automatically based on the checks configured in the loadbalancer.

When the primary site loses its state in Infinispan or a network partition occurs that prevents the synchronization, manual procedures are necessary to recover the primary site before it can handle traffic again, see the Switch back to the primary site guide.

To prevent fallback to the primary site before those manual steps have been performed, follow the procedure outlined in this guide.

For a graceful switch to the secondary site, follow the instructions in the Switch over to the secondary site guide.

See the Multi-site deployments guide for different operational procedures.


Follow these steps to prevent an automatic failover back to the Primary site or to manually force a failover.


To force Route53 to mark the primary site as permanently not available and prevent an automatic fallback, edit the health check in AWS to point to a non-existent route (/lb-check-failed-over).

Optional: Failover Lambda

To prevent a failed Primary cluster from becoming active without SRE input, follow the steps outlined in the guide Deploy an AWS Route 53 Failover Lambda

On this page