Immutable Relational Database Deployment via Snapshot Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In mutable infrastructure environments, in-place upgrades for stateful machines are risky due to potential failures from misconfigurations and drift, leading to instability and increased security vulnerabilities, which are exacerbated in public cloud infrastructures that require continuous updates.
Innovation Solution
An immutable deployment method decouples stateful aspects of a service from the operating system and database engine, replacing them with updated binaries while maintaining datastores, using snapshots to configure new servers or virtual machines and forcing failovers to ensure seamless transitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If in-place upgrades are performed on stateful machines, then updates and security patches can be applied, but system stability and reliability deteriorate due to potential failures from misconfigurations and drift
Solution Approach 1:
The system separates the database workload into multiple segments (primary and secondary nodes) that can be independently managed. The secondary node is created as a separate entity with its own database instance, allowing it to be updated independently without affecting the primary node's operation. This segmentation enables risk isolation during upgrade operations.
Solution Approach 2:
The patent implements preliminary actions by creating a secondary node before performing upgrades on the primary node. This secondary node serves as a pre-prepared backup that can immediately take over if the primary node upgrade fails. The configuration and data are prepared in advance on the secondary node, ensuring readiness for failover.
2Object-affected harmful factors
If continuous updates are performed in public cloud infrastructure, then security vulnerabilities are reduced, but service disruptions increase due to upgrade failures
Solution Approach 1:
The system changes the operational parameters by introducing a failover mechanism that allows the secondary node to take over database operations. When the primary node is updated, the system parameter switches from primary-to-secondary read/write mode to secondary-as-primary mode, enabling continuous service operation during the update process.
Solution Approach 2:
The secondary node acts as an intermediary that can assume the primary role when needed. During upgrade operations, the secondary node serves as a mediator that maintains service continuity by handling database requests while the primary node is being updated, thus preventing service disruption.
3Productivity
If in-place upgrades are automated through systems management software, then upgrade efficiency is improved, but failure risk increases due to misconfigurations and drift
Solution Approach 1:
The system implements feedback mechanisms through automated monitoring of the failover process. The systems management software monitors the health and operational status of both primary and secondary nodes, providing feedback that triggers automatic failover if the primary node becomes unavailable during upgrade. This feedback loop ensures that automation enhances productivity without compromising reliability.
Data Source
AI summary
Systems and methods are provided for replacing a first server of a first node a computer network by adding a second server configured with a database system as a second node to the computer network. A snapshot of a first database of database files that is communicatively coupled to the first node may be taken. The snapshot may be applied to the second server by attaching the snapshot of the first database as a second database to the second server and configuring the second server to match the first server. A failover of the computer network to the second node with the second server having the second database attached may be forced. Voting may be switched to the second server of the second node of the computer network and the first node of the computer network may be removed when the forced failover is successful.