Application controllers
An application controller works through the application’s own interface, not the platform under it (ADR 0005). It lets a plan watch the application’s health and restart it in place, check that a standby’s copy is recent enough to take over, fence it at the application level, and promote it, or move it in a planned switchover. Application controllers in Concepts explains how qfence uses them.
An application-level fence, such as a demoted primary or a masked unit, never proves that a site has stopped. Run it as a secondary fence, before the plan’s compute or network fence, which is the proof (infrastructure controllers).
| Guide | Manages | Reached over |
|---|---|---|
| systemd | A systemd unit on a Linux host | SSH |
| PostgreSQL | A primary and its streaming standbys | SQL, with TLS |
| Keycloak | Whether Keycloak can sign users in | HTTPS |
| Writing your own | Any other application | qfence’s external controller protocol, with mutual TLS |
The built-in types run inside each orchestrator. Your own runs as a service the orchestrators call. Either way, every command carries the plan’s generation, and a reply outside the protocol counts as UNKNOWN, never as success.