Multi-site
One platform instance, geo-distributed, able to lose a site.
What it is #
Multi-site is one platform instance spread across more than one location, for latency and for survival. Object storage that started single-zone expands in place to multi-zone, geo-distributed replication. Load-balanced DNS and edge routing send each user to a site that is actually healthy, and the secure overlay gives services in different buildings private names for each other.
The distinction from hybrid matters: hybrid separates workloads that should not mix, while multi-site replicates work that must not stop. Each site has a declared role, every axis of state has exactly one authoritative owner, and traffic decisions during a partition follow a rule you set in advance rather than a judgement call under pressure.
Who it is for
- An outage in one location cannot become an outage for your users.
- Your users are geographically spread and latency matters to them.
- You need capacity in more than one place but one platform to operate.
- Your continuity requirement is about surviving site loss, not about separating data classes.
Hybrid separates workloads that should not mix. Multi-site replicates work that must not stop.
What you get #
The whole platform runs here. These are the parts this pattern changes the shape of.
Geo-distributed by design #
A platform instance spans data centres for scale and resilience, with each site given an explicit role rather than being an accidental copy.
Replicated storage #
Object storage expands from one zone to many in place, with multi-zone replication and scheduled off-site backups for durability.
Routing that follows health #
Load-balanced DNS and edge routing move traffic toward healthy sites for geographic failover and latency, rather than pinning users to one region.
Private names across sites #
Mesh-internal DNS and the secure overlay let services and clusters resolve and reach each other by name between buildings, under zero-trust policy.
The operating model #
Nobody should discover who owns a failure while it is happening. This split is explicit before anything is signed, and it is the part of a deployment decision that outlives the architecture.
- One operator across all sites
- Global control, routing decisions and fleet-wide rollout, with local hands where hardware needs them.
- Each site has a role
- Primary, peer, standby, edge or management — declared, not inferred, so authority is never ambiguous.
- The operator handles
- Rollout waves across sites, version skew during a wave, and reconciliation for a site that was isolated.
- You decide in advance
- Which site wins a traffic decision during a partition, and what a recovered site must do before it rejoins.