The danger of changing the cluster
Changing which servers form a Raft cluster is risky because, during the switch, the old and new configurations could each form their own majority and elect two leaders. That would split the system. Raft must change membership without any moment where two disjoint majorities exist.
Joint consensus
Raft's general approach is joint consensus, a transitional configuration that requires agreement from majorities of both the old and new sets at once.
- The leader commits a special entry combining old and new members.
- While joint consensus holds, every decision needs a majority in the old set and a majority in the new set.
- Once that entry commits, the leader commits a second entry switching fully to the new set.
Because both majorities overlap during the transition, no two leaders can be elected.
Single server changes
A simpler, widely used variant adds or removes one server at a time. Any single member difference keeps old and new majorities overlapping automatically, so a configuration entry can be applied directly without a joint phase.
Key idea
Raft changes membership through joint consensus or single server steps so old and new majorities always overlap and two leaders can never arise.