One way we dealt with this in the past was assigning an "affinity" to each tenant and basically routing their writes/reads to that host, excepting if that host

One way we dealt with this in the past was assigning an "affinity" to each tenant and basically routing their writes/reads to that host, excepting if that host was down. You would still get weird replication issues/conflicts when requests failed over in some conditions, but it worked fairly well the majority of the time. These days I'd stick to single primary/writer as much as possible though tbh.