> I'm using PHP's Mysqlnd replication and load balancing plugin, which has worked quite well. You can configure it to send all statements to the master, if within a transaction, which is how I handle the situation you describe.
"Critical Read" is a case where that won't work:
1. User adds a blog comment (written to the Master).
2. The user is sent to the next page, which contains a list of his comments.
This second page cannot be part of the same InnoDB transaction, and (being readonly) would be sent to some Slave.
There are many ways to "solve" the problem, none are really clean.
>> Plan C: Galera-based multi-master (MariaDB 10, Percona XtraDB Cluster, etc)
> This seems to be the only real option. Have you done this? Is it very difficult to setup/maintain?
It is the best "multi-master" I have found. No, I do not have enough experience to answer the rest of the question. (I am mostly looking over peoples shoulders, and listening to conference talk.)
Further advice on Galera:
http://mysql.rjweb.org/doc.php/galera
> No, I'm considering data centers in Sydney, London, Singapore and US regions.
> ... some clients would get higher latency, but ...
Upwards of 200ms. If you keep each web page and transaction to only a small number of SQL statements, 200ms is not bad. If you find the need to do "too many" statements, make a Stored Procedure on the Master and CALL it. This gets it back to being only one round trip.
With Galera, each write transaction would incur one (only one) 200ms delay (in your proposed topology). For reads, the operation would be "local", hence ~0ms. "Critical reads" may take longer than 0, but are easily handled and probably overlap with the transition from one page to the next; see my blog.
> What is typical for SaaS services?
Sorry, I have no insight here.
I will not decide for you whether to use a single Master or use a Galera-based system. I have tried to give you enough information to make an informed decision.
If you go with Galera, I suggest one read-write node in each of at least 3 datacenters, but not 4 datacenters. That way, you get a high degree of HA "for free". (4 nodes can't reach a quorum when one node dies.)