Only change to this comment I would make is: rather than an
active/active master cluster, I'd have it active/hot standby (i.e. the
VIP on the load balancer only directs connections to one master, and
fails over to the other master if that one is unavailable rather than
balancing connections between the two masters all the time, to
avoid/minimize write conflicts).
Good point, I hadn't considered write conflicts. Active/passive of
course won't provide you the read performance of active/active/LB, but I
doubt that's really the concern here anyway.