Shadow Dataplane Promotion for Uninterrupted Network Upgrades
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Upgrading network edge devices often results in disruptive downtime and uncertainty due to device failover, route re-convergence, and uncertainty about new software or policy performance in customer-specific environments, necessitating exhaustive checks and contingency plans.
Innovation Solution
Implementing a dual dataplane architecture with a primary and shadow dataplane, where the shadow dataplane performs verification testing of new software or policies, allowing seamless transitions by gradually shifting traffic to the verified new version without disrupting service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network device is shut down to upgrade the dataplane, then the upgrade can be performed, but service interruption occurs which is disruptive to users
Solution Approach 1:
The system divides the dataplane into two independent instances: a current dataplane handling active traffic and a shadow dataplane receiving upgrade candidates. This segmentation allows the upgrade process to occur in isolation without affecting live services, eliminating the need to shut down the entire device during upgrades.
Solution Approach 2:
The shadow dataplane is prepared in advance with the upgraded dataplane code before the actual switchover. Verification testing is performed on the shadow dataplane beforehand, so when promotion occurs, the new code is already validated and ready for immediate activation, enabling seamless transitions without service interruption.
2Reliability
If verification testing is performed on the shadow dataplane in the same environment as the customer's network, then upgrade reliability improves, but device complexity increases
Solution Approach 1:
The shadow dataplane is created as a copy of the current dataplane with identical hardware resources and configuration. This copying approach enables verification testing in the same environment as production without requiring separate test infrastructure, while the shadow dataplane's independent nature allows it to be discarded after promotion without adding permanent complexity.
Solution Approach 2:
The system dynamically switches between the current and shadow dataplanes based on promotion status. The shadow dataplane transitions from a static backup to an active verification environment, and finally to the new production dataplane. This dynamic behavior allows the same infrastructure to serve multiple purposes, reducing overall system complexity.
3Reliability
If exhaustive pre-upgrade and post-upgrade checks are performed, then upgrade reliability improves, but the upgrade process becomes more complex and time-consuming
Solution Approach 1:
All verification testing is performed on the shadow dataplane before promotion to the current dataplane. This preliminary verification includes functional testing, performance validation, and security checks, ensuring that only validated upgrades are deployed. The post-upgrade checks are eliminated since verification occurs beforehand in the shadow environment.
Solution Approach 2:
The shadow dataplane serves as an intermediary verification environment between the upgrade source and the production dataplane. It acts as a mediator that receives upgrade candidates, performs exhaustive verification, and only promotes validated versions to the current dataplane, simplifying the overall verification process while maintaining high reliability.
Data Source
AI summary
A system and method are provided for implementing a network component, such as a software-defined wide area network, a firewall, a router, or a load balancer. The network component can be an embedded network edge device that is implemented, e.g., in software, in circuitry, or using hardware acceleration (e.g., a data processing unit (DPU), a smart network interface card (SmartNIC), etc.). The system can a primary (first) dataplane and a shadow (second) dataplane. During verification testing, the network function (e.g., routing) is performed by transmitting the egress packets from the primary (first) dataplane, but using the egress packets from the shadow (second) dataplane only for verification testing. After verification testing, the shadow (second) dataplane is promoted to be a new primary dataplane by gradually increasing the ratio of the output packets that originate from the new primary (second) dataplane until all output packets originate from the second dataplane.