Shadow Dataplane Promotion for Uninterrupted Network Upgrades
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Upgrading network edge devices disrupts services due to downtime, device failover, route re-convergence, and uncertainty about new software or policy performance in customer networks, necessitating exhaustive checks and contingency plans.
Innovation Solution
Implementing a dual dataplane architecture with a primary and shadow dataplane, where the shadow dataplane performs verification testing of new software or policies, allowing seamless transitions and continuous operation without user disruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network device is shut down for dataplane upgrade, then the upgrade can be completed, but service interruption occurs which is disruptive to users
Solution Approach 1:
The system segments the dataplane into two independent instances: primary dataplane and shadow dataplane. This segmentation allows the shadow dataplane to be upgraded independently while the primary dataplane continues to handle traffic, eliminating service interruption during upgrades.
Solution Approach 2:
The shadow dataplane is prepared and upgraded in advance before taking over from the primary dataplane. Verification testing is performed preliminarily on the shadow dataplane to ensure readiness, allowing seamless failover without service disruption.
2Reliability
If exhaustive verification testing is performed before upgrade, then new software performance can be confirmed, but upgrade time and complexity increase
Solution Approach 1:
A shadow dataplane (copy of the primary dataplane structure) is created to perform verification testing. This copying allows exhaustive testing of new software in an isolated environment that mirrors production, confirming performance without affecting live services or increasing overall system complexity.
3Reliability
If the network device is shut down for upgrade, then the dataplane can be updated, but service disruption occurs
Solution Approach 1:
The primary dataplane continues to perform its useful action (packet forwarding) continuously while the shadow dataplane undergoes upgrade and verification. This continuity ensures service availability is maintained throughout the upgrade process, eliminating the need for maintenance windows.
4Ease of operation
If shadow dataplane verification is implemented, then seamless upgrade transition is enabled, but system complexity increases
Solution Approach 1:
The shadow dataplane acts as an intermediary between the primary dataplane and the upgrade process. It mediates the transition by providing a verified, ready-to-deploy instance that can seamlessly take over, simplifying the upgrade operation despite the added architectural element.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A system and method are provided for implementing a network component, such as a software-defined wide area network, a firewall, a router, or a load balancer. The network component can be an embedded network edge device that is implemented, e.g., in software, in circuitry, or using hardware acceleration (e.g., a data processing unit (DPU), a smart network interface card (SmartNIC), etc.). The system can a primary (first) dataplane and a shadow (second) dataplane. During verification testing, the network function (e.g., routing) is performed by transmitting the egress packets from the primary (first) dataplane, but using the egress packets from the shadow (second) dataplane only for verification testing. After verification testing, the shadow (second) dataplane is promoted to be a new primary dataplane by gradually increasing the ratio of the output packets that originate from the new primary (second) dataplane until all output packets originate from the second dataplane.