Distributed Lock Service · View 06 of 26 · 3 · Structure
Decisions
- The client library is a layer, not a convenience. Session keepalive, the local deadline and the fence callback live there because they must keep working while the network is failing.
- Coordination holds no durable state. Record holds all of it. Evidence is derived from Record and can lag or be rebuilt without touching a single grant.
- Platform services are consumed, not embedded. Replacing Keycloak or the metrics stack changes a configuration file, not the lock protocol.
What would break the layering
- A team embedding clientv3 and writing lock keys themselves. The etcd RBAC role that grants write access exists only for the arbiter and the Admin API.
- An arbiter feature that caches holder state to save a round trip. A cache that answers who holds is a second source of truth.
Assumptions
- Client libraries ship first in Go, then Java and Python. Each has the fence callback as a required constructor argument, so a caller cannot forget it.
