Cloudflare's Meerkat: Achieving Strongly Consistent Global Coordination with QuePaxa

The Challenge of Global Consistency in Wide-Area Networks

Distributed systems operating across geographically dispersed data centers face significant challenges in maintaining strong consistency and high availability. Traditional consensus algorithms like Raft rely on a single leader for writes. While effective in localized networks, this leader-based approach introduces critical availability issues in wide-area networks (WANs). If the leader fails or becomes unreachable due to network degradation, the entire system can become unavailable until a new leader is elected through a timeout-driven process, leading to undesirable downtime.

Introducing Meerkat and the QuePaxa Consensus Algorithm

Cloudflare developed Meerkat, a control-plane service designed for strongly consistent global coordination. Meerkat is built upon the QuePaxa consensus algorithm, a notable departure from partially synchronous algorithms like Paxos and Raft. QuePaxa's key innovation is its ability to allow all replicas to accept writes without relying on a designated leader or timeouts. This design eliminates the single point of failure and availability loss associated with leader-based systems when a leader becomes isolated or fails across a WAN.

How Meerkat Achieves Strong Consistency

Meerkat provides a globally replicated consensus log. It ensures strong consistency by guaranteeing that all replicas agree on the order and values of committed operations, thereby providing linearizable reads and writes. The core invariant is that "if any two replicas decide on the value for a slot, those values are the same," preventing disagreements on decided log slots. This mechanism is foundational for building reliable distributed services atop Meerkat, such as transactional key-value stores and leasing systems.

Performance Considerations and Trade-offs

While QuePaxa offers improved availability characteristics in WAN environments, consensus algorithms inherently involve communication overhead. QuePaxa typically requires one to three round trips between the initial proposer and a majority of replicas to decide on a proposal. This can introduce latency, and some practitioners question its performance competitiveness in the normal case compared to partially synchronous algorithms. Meerkat is explicitly not designed for general-purpose data systems like traditional databases due to this cost, but rather for control-plane services where strong consistency and availability are paramount.

• Improved Availability: Achieved by leaderless writes, removing a single point of failure in WANs.
• Strong Consistency: Guarantees linearizable operations across global replicas.
• Latency Overhead: Consensus operations require multiple round-trips, which can impact performance, especially for general-purpose data systems.
• Complexity: Implementing and understanding asynchronous consensus algorithms like QuePaxa can be more complex than traditional ones.