N+1 capacity - the math of headroom · Linux

N+1 capacity is the discipline of having one more unit than needed. This lesson covers how to calculate it and the common pitfalls.

N+1 defined

N+1 means: for N units of capacity needed, you have N+1.

Examples:

3 web servers needed: 4 total (one spare).
2 database replicas: 3 total (one spare).
5 Gbps bandwidth: 6 Gbps capacity (one link spare).

The “+1” absorbs: failure of one unit, maintenance on one unit, or growth.

Components

N+1 is not just “add one”. It has three components:

Failure capacity: replace a failed unit.
Maintenance capacity: take one unit offline for patching.
Growth capacity: room to grow.

For high availability:

Failure: at least 1 spare.
Maintenance: at least 1 spare.
Growth: 30-50% headroom for unplanned growth.

Total: 3x the steady-state load for a 3-node cluster, or N+2.

The 90% on 3 nodes trap

A common mistake: 3 nodes, each at 90% utilisation. This seems fine until:

One node fails: remaining two are at 135% utilisation. The cluster fails.
One node needs maintenance: the other two are at 90% but cannot absorb the 90% from the maintenance node.

The survivable ceiling

Redistributing a failed node onto the survivors gives the rule directly. With N nodes each at utilisation u, a single failure spreads N x u over N - 1 nodes:

per-node load after one failure = N x u / (N - 1)

Set that to 100% and solve for u:

  Nodes    Ceiling per node    Survivors after one failure
      2                 50%                           100%
      3               66.7%                           100%
      4                 75%                           100%
      5                 80%                           100%

The ceiling rises with node count because each survivor absorbs a smaller share. That is the capacity argument for larger clusters: a 2-node pair can never run above half utilisation without one failure taking the service down, while a 5-node cluster can sit at 80%.

Calculate headroom

Node capacity:          100 units each
Nodes:                    3
Cluster capacity:       300 units

Steady-state load:      200 units
Per-node load:         66.7 units = 66.7% utilised

On failure of 1 node:
  Load on remaining 2:  100 units each = 100% utilised
  Spare:                  0

That is the ceiling exactly: it survives, with nothing left. No margin for the split being uneven, no room to take a second node out, and both survivors at full capacity for the length of the incident.

Back the load off to 150 units and the same failure looks different:

Steady-state load:      150 units
Per-node load:           50 units = 50% utilised

On failure of 1 node:
  Load on remaining 2:   75 units each = 75% utilised
  Spare:                 25 units each

50% per node on 3 nodes is a defensible operating target precisely because it is not the ceiling. It leaves a quarter of each survivor free during a failure, which is what a second event or an uneven split eats into.

Plan for growth

Growth moves you toward the ceiling, so the useful output of a capacity plan is a date rather than a number.

Take that 3-node cluster: 300 units of capacity, 150 units of load, growing 20% per year. The ceiling is 66.7% per node, which is 200 units of load across the cluster.

Year 0: 150 units, 50% per node.
Year 1: 180 units, 60% per node - still under the ceiling.
Year 2: 216 units, 72% per node - past it.

So a fourth node has to be in service before year 2. That deadline is the plan. A single utilisation figure is not: 50% is healthy today and a countdown at the same time, and only the growth rate tells you which.

Tools for capacity planning

Grafana: dashboards with capacity utilisation.
Prometheus: alert on high utilisation.
Forecasting: simple linear extrapolation; more advanced ARIMA, ML.

Alert thresholds:

Utilisation > 70%: review.
Utilisation > 85%: scale soon.
Utilisation > 95%: emergency.