Cluster Network Configuration Rollback for Zero-Trust Gateway Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved techniques to deploy and manage zero trust network access gateways, particularly in cloud-based clusters, to maintain availability during network configuration updates.
Innovation Solution
A method and system for sequentially updating network configuration settings in a cluster of nodes, where each node is isolated and tested for connectivity before being reintegrated, with the option to rollback if connectivity tests fail.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If network configuration settings are updated for all nodes simultaneously, then update speed is improved, but cluster availability deteriorates due to connectivity failures
Solution Approach 1:
The patent segments the update process by treating each node independently and sequentially. Instead of updating all nodes simultaneously, the system updates one node at a time, isolates it, verifies connectivity, and only then integrates it back into the cluster. This segmentation prevents simultaneous updates from causing connectivity failures across the entire cluster.
Solution Approach 2:
The patent applies preliminary action by testing connectivity of the updated node before integrating it back into the cluster. The system performs connectivity tests (such as ping tests or TCP connection tests) to verify the node is functioning correctly with the new configuration before allowing it to join the active cluster, preventing potential failures from affecting the entire cluster.
2Reliability
If nodes are isolated during update, then update reliability is improved, but operational time increases due to sequential processing
Solution Approach 1:
The system performs connectivity tests as a preliminary action before integrating the node back into the cluster. By verifying connectivity in advance and only isolating the node temporarily during the update process, the system ensures reliability while minimizing the time the node is isolated. The node is quickly tested and then reintegrated, reducing overall operational time.
Solution Approach 2:
The patent implements feedback mechanisms where the system monitors connectivity test results and uses this information to determine whether to proceed with integrating the node back into the cluster. If connectivity tests fail, the system receives feedback that the node is not ready and prevents integration, avoiding further time loss. This feedback loop ensures that only nodes passing connectivity verification are integrated, optimizing the balance between reliability and time.
3Measurement precision
If connectivity tests are performed for each node, then update accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent applies self-service by having each node perform its own connectivity tests independently. The node autonomously verifies its connectivity to the cluster after configuration updates without requiring manual intervention or complex centralized testing procedures. This self-service approach simplifies the overall processing complexity while maintaining accurate connectivity verification through standard network protocols.
Solution Approach 2:
The system manages processing complexity by changing parameters such as test duration, test frequency, and isolation time based on node-specific conditions. The connectivity tests use adjustable parameters (timeout values, retry counts, test protocols) that can be optimized for each node's specific requirements, achieving accurate measurement without uniform complexity across all nodes.
Data Source
AI summary
A cluster of nodes are sequentially updated with new network configuration settings in order to maintain availability of the cluster during the update. In the sequential update, each node conditionally updates network configuration settings, tests connectivity, and retains an update to the configuration only if the node is able to restore connectivity suitable for operation in the cluster.