Coordinator Node

For distributed operations, TKeeper uses request-driven coordination.

Any keeper node that receives a client request can act as the coordinator for that operation.

In TKeeper, coordinator capability means the node can accept and orchestrate protected write/compute operations such as:

• key generation flows (CREATE, ROTATE, REFRESH)
• threshold signing
• threshold encryption
• threshold decryption
• key destroy

This setting does not restrict read-only operations, for example public key retrieval.

Default behavior

• in a cluster, coordination is not pinned to one static leader
• the node that receives the request becomes coordinator for that request
• with a load balancer in front of keepers, coordinator choice follows request routing

Restricting which nodes can coordinate

If you want specific nodes to never coordinate client operations, disable coordinator mode on those nodes.

You can do this with either:

• system property: -Dkeeper.coordinator.enabled=false
• environment variable: KEEPER_COORDINATOR_ENABLED=false

Example:

java -Dkeeper.coordinator.enabled=false -jar tkeeper.jar

or:

export KEEPER_COORDINATOR_ENABLED=false