Personally, I run 2 clusters of 5 nodes each, in geographically disparate zones.

There are some shared infrastructure dependencies that aren't redundant, but generally speaking the system can survive loss of multiple nodes and/or an entire site.