Yes, I understand. (1) is based on there being manual intervention in the case where datacenter with 2 nodes goes down. In that case, the system would not accept writes and we either:
- Bring the dead nodes back online, or, if that is not possible or would be too long:
- Accept data loss and our new source of truth would be the single remaining node. Would have to shut down the 2 dead nodes completely and discard their data to ensure they don’t come back, then rebuild cluster.
This option is still preferable in my mind, because we want to handle individual machine failures automatically.
Related question: If a node dies completely, how do you bring a fresh node into the cluster? Can’t see anything in the docs about this.