**Title:** Introducing Meerkat: Cloudflare’s New Global Control‑Plane Consensus Service
**Summary:** Cloudflare’s research team has built an experimental consensus service called **Meerkat**, powered by the **QuePaxa** algorithm, to meet the stringent consistency and availability requirements of global control‑plane data. Unlike traditional leader‑based protocols such as Raft, QuePaxa allows all replicas to accept writes simultaneously and avoids halting progress due to timeouts—making it well suited for Cloudflare’s wide‑area network. The post explains the consistency and fault‑tolerance guarantees needed from a global control‑plane system, how Meerkat’s log‑based architecture delivers linearizability, and why QuePaxa provides higher availability and better performance in adversarial network conditions. The authors note that Meerkat is still in development and is currently deployed only internally for small control‑plane state management, with plans for future public releases.
—
### What problem is Meerkat solving?
Many of Cloudflare’s internal services must read and modify shared control‑plane state across **330+ global data centers**. These services require:
1. **Strong consistency** — readers must always see the latest writes (linearizability).
2. **High availability** — the system must remain writable even when data centers or network links fail.
However, the Internet is inherently unreliable: servers crash, queues fill, links fail, and latency varies wildly. Traditional consensus algorithms like **Raft** rely on a single leader and rigid timeouts, which perform poorly—or fail outright—under these conditions.
### Why Raft isn’t enough
Raft guarantees safety and availability as long as a majority of replicas are alive, but it has two major drawbacks for global deployments:
– **Leader dependency**: If the leader fails or becomes slow, writes block until a new leader is elected via timeout-based elections.
– **Timeout sensitivity**: In wide‑area networks with unpredictable latency, choosing timeout values that work reliably is extremely difficult.
Cloudflare has experienced multiple incidents caused by exactly these leader‑related issues.
### Introducing QuePaxa and Meerkat
To overcome these limitations, Cloudflare partnered with researchers at EPFL to implement **QuePaxa**, a consensus algorithm published in 2023. Key characteristics include:
– **No required leader** — any replica can propose writes.
– **No blocking timeouts** — progress continues even under adverse network conditions.
– **Concurrent proposal support** — multiple replicas can propose values for the same log slot, and the protocol ensures only one value is chosen.
These properties make QuePaxa far more resilient in wide‑area, high‑latency environments.
Meerkat is the **service layer** built on top of QuePaxa. It exposes a consensus log that applications—such as a transactional key‑value store or a leasing system—can use to store and replicate control‑plane data.
### Architecture and guarantees
– A **Meerkat cluster** consists of replicas placed across selected data centers.
– Each replica communicates with all others and maintains the same **append‑only log** of operations.
– **Reads** can be served locally if stale reads are acceptable; otherwise they go through the consensus protocol to ensure linearizability.
– The system remains **correct** as long as no actor is malicious (non‑Byzantine).
– It tolerates **f failures** in a cluster of **2f + 1** replicas, provided a majority are reachable.
### Performance and tradeoffs
Consensus inherently adds communication overhead:
– A write typically requires **one to three round trips** across replicas.
– Leader‑based protocols have lower latency when the leader is healthy, but Meerkat avoids the risk of total unavailability when the leader fails.
Performance optimizations include:
– Placing replicas close together to reduce latency.
– Batching writes.
– Allowing stale local reads when strong consistency isn’t required.
– Bundling multiple operations into a single consensus round.
Despite these optimizations, Meerkat is best suited for **infrequent control‑plane updates** rather than high‑throughput data services.
### Current status and future work
Meerkat is still experimental and is currently used internally for small control‑plane state management. The authors report successful proof‑of‑concept runs with up to **50 replicas worldwide**, including scenarios where leaders constantly fail without disrupting service.
Future blog posts will cover:
– Internal workings of QuePaxa
– Formal verification of the Rust implementation
– Bootstrapping and cluster management
– Replica placement strategies
– Deterministic simulation testing
—
**Original article source:**
Cloudflare Blog. “Many internal services at Cloudflare need to read and modify the same control-plane state…” [https://blog.cloudflare.com/introducing-meerkat/](https://blog.cloudflare.com/introducing-meerkat/)
