LeaseGuard: Raft Leases Done Right

TL;DR

LeaseGuard introduces a simple, rigorously specified lease algorithm for Raft that significantly improves read and write performance and availability during leader failover in distributed databases.

Contribution

LeaseGuard provides a novel, well-specified lease protocol for Raft that enhances availability and throughput during leader transitions, addressing limitations of prior lease methods.

Findings

Reduces consistent read overhead from one to zero network roundtrips.

Increases write throughput from ~1,000 to ~10,000 writes per second.

Enables 99% of reads to succeed instantly after leader failover.

Abstract

Raft is a leading consensus algorithm for replicating writes in distributed databases. However, distributed databases also require consistent reads. To guarantee read consistency, a Raft-based system must either accept the high communication overhead of a safety check for each read, or implement leader leases. Prior lease protocols are vaguely specified and hurt availability, so most Raft systems implement them incorrectly or not at all. We introduce LeaseGuard, a novel lease algorithm that relies on guarantees specific to Raft elections. LeaseGuard is simple, rigorously specified in TLA+, and includes two novel optimizations that maximize availability during leader failover. The first optimization restores write throughput quickly, and the second improves read availability. We evaluate LeaseGuard with a simulation in Python and an implementation in LogCabin, the C++ reference implementation of Raft. By replacing LogCabin's default consistency mechanism (quorum checks), LeaseGuard reduces the overhead of consistent reads from one to zero network roundtrips. It also improves write throughput from ~1000 to ~10,000 writes per second, by eliminating contention between writes and quorum reads. Whereas traditional leases ban all reads on a new leader while it waits for a lease, in our LeaseGuard test the new leader instantly allows 99% of reads to succeed.