Standby copies withstand cascading fails

Abstract

A technique is configured to maintain multiple copies of data served by storage nodes of a cluster during upgrade of a storage node to ensure continuous protection of the data served by the nodes. The data is logically organized as one or more volumes on storage devices of the cluster and includes metadata that describe the data of each volume. A data protection system may be configured to maintain at least two copies of the data in the cluster during upgrade to a storage node that is assigned to host one of the copies of the data but that is taken offline during the upgrade. As a result, an original slice service of the node may be rendered unavailable during the upgrade. In response, the technique redirects replicated data targeted to the original slice service to a standby pool of slice services in accordance with a degraded redundant metadata service of the cluster. In the event the standby slice service itself subsequently becomes unavailable, another standby slice service from the standby pool is activated to receive the subsequent data. In this manner, cascading failure of secondary slice slices is handled.

Description

BACKGROUND

Technical Field

The present disclosure relates to protection of data served by storage nodes of a cluster and, more specifically, to ensuring continuous protection of data served by the storage nodes of the cluster.

Background Information

A plurality of storage nodes organized as a cluster may provide a distributed storage architecture configured to service storage requests issued by one or more clients of the cluster. The storage requests are directed to data stored on storage devices coupled to one or more of the storage nodes of the cluster. The data served by the storage nodes may be distributed across multiple storage units embodied as persistent storage devices, such as hard disk drives, solid state drives, flash memory systems, or other storage devices. The storage nodes may logically organize the data stored on the devices as volumes accessible as logical units. Each volume may be implemented as a set of data structures, such as data blocks that store data for the volume and metadata blocks that describe the data of the volume. For example, the metadata may describe, e.g., identify, storage locations on the devices for the data. The data of each volume may be divided into data blocks. The data blocks may be distributed in a content driven manner throughout the nodes of the cluster so as to even out storage utilization and input/output load across the cluster. To support increased durability of data, the data blocks may be replicated among the storage nodes.

To further improve storage capacity, data redundancy as provided by a data protection system (DPS) may be employed. A typical DPS implemented by a cluster is data replication, wherein multiple copies (e.g., two copies) of data may be hosted by storage nodes of the cluster. During upgrade to a storage node in the cluster, the node is taken offline and, thus, is unable to serve (i.e., host) a copy of the data. Accordingly, data received at the cluster may not be replicated at the upgraded node resulting in only one copy of the data served by the cluster. As a result, the cluster is exposed to loss of data if there is a failure to the remaining node hosting the single copy of the data.

A possible approach to this existing problem involves transfer of data from the storage node being upgraded to another node of the cluster. However, this approach is costly in terms of time and bandwidth due to a possible substantial amount of data migration, thus complicating the upgrade effort.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and further advantages of the embodiments herein may be better understood by referring to the following description in conjunction with the accompanying drawings in which like reference numerals indicate identically or functionally similar elements, of which:

FIG. 1 is a block diagram of a plurality of storage nodes interconnected as a cluster;

FIG. 2 is a block diagram of a storage node;

FIG. 3A is a block diagram of a storage service of the storage node;

FIG. 3B is a block diagram of an exemplary embodiment of the storage service;

FIG. 4 illustrates a write path of the storage node;

FIG. 5 is a block diagram illustrating details of a block identifier; and

FIG. 6 illustrates an example workflow for maintaining protection of data during upgrade of a storage node in the cluster.

OVERVIEW

The embodiments described herein are directed to a degraded redundant metadata (DRuM) technique configured to maintain multiple copies of data for storage nodes of a cluster during upgrade of a storage node to ensure continuous protection of the data served by the nodes. The data is logically organized as one or more volumes on storage devices of the cluster and includes metadata that describe the data of each volume. Nodes of the cluster provide slice services that present client facing tasks that initially store the data and metadata for eventual synchronization to back-end block services (i.e., data at rest) also hosted on the nodes. The cluster may be configured to maintain primary and secondary slice services such that the secondary slice service includes a copy of the initial data and thus can failover in the event that the primary slice service is unavailable. Illustratively, a data protection system (DPS) may be configured to maintain two initial copies (first and second copies) of the data in the cluster during upgrade of a storage node (e.g., a software or hardware update) that is assigned to store one of the copies of the data but that is taken offline during the upgrade. As a result, an original slice service (SS) operating as the secondary SS of the secondary node may become unavailable during the upgrade, i.e., the secondary SS effectively fails for a period of time. Accordingly, failover of the remaining SS, e.g., the primary SS, becomes impossible, leaving initially stored data vulnerable to loss. In response to the unavailability of the original SS (i.e., the secondary SS or its replacement standby SS), the storage of subsequent data received at (i.e., targeted to) the original SS may be redirected to a first standby SS of a pool of standby SSs in accordance with an extended DRuM service of the cluster. In the event the first standby SS subsequently becomes unavailable, the extended DRuM technique activates another (e.g., a second) standby SS of the standby pool to receive the subsequent data. In this manner, cascading failure of secondary SS's is handled by activating a next standby SS from the standby SS pool to act as a replacement standby SS.

In an embodiment, a standby SS receives no data (i.e., is inactive) until activation (e.g., in response to the upgrade bringing the original SS offline), at which time it receives only new incoming data received at the cluster after the original or previously activated standby SS is unavailable, i.e., brought offline. Note that the data received by the standby SS is not the entire copy (second copy) of data for the volume unlike the failover (e.g., secondary) SS, but rather only the new incoming write data of the second copy after the original or previous standby SS is brought offline, e.g., as a result of a failure or upgrade. This new incoming data of the second copy (which may be distributed among one or more activated standby SSs) may be combined with (added to) the existing data of the second copy maintained by the original SS (i.e., the failed secondary SS) in a chronological order to form a complete, valid second copy of the data. That is, the data received by each activated standby SS includes only new incoming portions of the replicated (i.e., second copy) data received at the cluster during downtime of the storage node (e.g., during upgrade). Accordingly, ordering of the data is significant as is the union of the existing copy portion of the data stored at the original SS and the new incoming copy portion of the data stored at each standby SS. That is, a group of standby SSs, activated from cascading failure as a whole, stores the incoming copy portion of the data after unavailability (e.g., failure) of the original SS (i.e., secondary SS).

In an embodiment, each standby SS is assigned an Index Incarnation Number (IIN) upon activation, wherein the IIN denotes a point in time at which the standby SS became active. For example, a first standby SS may be assigned a first IIN denoting a first point in time at which the first standby SS became active. In response to subsequent unavailability (failure) of the first standby SS, a second standby SS may be assigned a second (incremented) IIN denoting a second, subsequent point in time at which the second standby SS became active. Notably, the IINs may be used to facilitate the chronological ordering of the subsequent incoming data distributed among the standby SSs when forming the complete second copy of data.

Illustratively, the IIN represents a version of a SS assignment data structure, i.e., a SS assignment table, of a distributed database that is reflective of a latest activated standby SS. Note that each activated SS assumes a role (e.g., a primary, secondary or standby SS) per volume that is maintained in the SS assignment table. In other words, a SS can assume different roles for different volumes; however, the SS can only assume one role for one volume at a time. In an embodiment, the IIN represents a version of the SS assignment table, wherein versioning of the SS assignment table occurs by appending changes/updates to the database on a per volume granularity, i.e., the database records the entire chronological history of SS roles for volumes as appended “meta logs”.

Advantageously, the DRuM technique ensures that there are multiple full (complete) copies of data at all times (i.e., initial store of data and at rest) in accordance with the DPS, despite the fact that portions of those copies may be distributed across multiple storage nodes. The DRuM technique allows rebuilding of the data from the distributed portions with no data loss to thereby ensure that at least one complete copy of the data is reconstructable at any given time.

DESCRIPTION

Storage Cluster

FIG. 1 is a block diagram of a plurality of storage nodes 200 interconnected as a storage cluster 100 and configured to provide storage service for information, i.e., data and metadata, organized and stored on storage devices of the cluster. The storage nodes 200 may be interconnected by a cluster switch 110 and include functional components that cooperate to provide a distributed, scale-out storage architecture of the cluster 100. The components of each storage node 200 include hardware and software functionality that enable the node to connect to and service one or more clients 120 over a computer network 130, as well as to an external storage array 150 of storage devices, to thereby render the storage service in accordance with the distributed storage architecture.

Each client 120 may be embodied as a general-purpose computer configured to interact with the storage node 200 in accordance with a client/server model of information delivery. That is, the client 120 may request the services of the storage node 200, and the node may return the results of the services requested by the client, by exchanging packets over the network 130. The client may issue packets including file-based access protocols, such as the Network File System (NFS) and Common Internet File System (CIFS) protocols over the Transmission Control Protocol/Internet Protocol (TCP/IP), when accessing information on the storage node in the form of storage objects, such as files and directories. However, in an embodiment, the client 120 illustratively issues packets including block-based access protocols, such as the Small Computer Systems Interface (SCSI) protocol encapsulated over TCP (iSCSI) and SCSI encapsulated over Fibre Channel (FCP), when accessing information in the form of storage objects such as logical units (LUNs).

FIG. 2 is a block diagram of storage node 200 illustratively embodied as a computer system having one or more processing units (processors) 210, a main memory 220, a non-volatile random access memory (NVRAM) 230, a network interface 240, one or more storage controllers 250 and a cluster interface 260 interconnected by a system bus 280. The network interface 240 may include one or more ports adapted to couple the storage node 200 to the client(s) 120 over computer network 130, which may include point-to-point links, wide area networks, virtual private networks implemented over a public network (Internet) or a shared local area network. The network interface 240 thus includes the mechanical, electrical and signaling circuitry needed to connect the storage node to the network 130, which may embody an Ethernet or Fibre Channel (FC) network.

The main memory 220 may include memory locations that are addressable by the processor 210 for storing software programs and data structures associated with the embodiments described herein. The processor 210 may, in turn, include processing elements and/or logic circuitry configured to execute the software programs, such as one or more metadata services 320a-n and block services 340a-n of storage service 300 as well as a degraded redundant metadata (DRuM) service 600, and manipulate the data structures. An operating system 225, portions of which are typically resident in memory 220 (in-core) and executed by the processing elements (e.g., processor 210), functionally organizes the node by, inter alia, invoking operations in support of the storage service implemented by the node. A suitable operating system 225 may include a general-purpose operating system, such as the UNIX® series or Microsoft Windows® series of operating systems, or an operating system with configurable functionality such as microkernels and embedded kernels. However, in an embodiment described herein, the operating system is illustratively the Linux® operating system. It will be apparent to those skilled in the art that other processing and memory means, including various computer readable media, may be used to store and execute program instructions pertaining to the embodiments herein.

The storage controller 250 cooperates with the storage service 300 implemented on the storage node 200 to access information requested by the client 120. The information is preferably stored on storage devices such as internal solid state drives (SSDs) 270, illustratively embodied as flash storage devices, as well as SSDs of external storage array 150 (i.e., an additional storage array attached to the node). In an embodiment, the flash storage devices may be block-oriented devices (i.e., drives accessed as blocks) based on NAND flash components, e.g., single-level-cell (SLC) flash, multi-level cell (MLC) flash, triple-level cell (TLC) flash, or quad-level cell (QLC) flash and the like although it will be understood to those skilled in the art that other block-oriented, non-volatile, solid-state electronic devices (e.g., drives based on storage class memory components) may be advantageously used with the embodiments described herein. The storage controller 250 may include one or more ports having I/O interface circuitry that couples to the SSDs 270 over an I/O interconnect arrangement, such as a conventional serial attached SCSI (SAS), serial ATA (SATA), and non-volatile memory express (NVMe) PCI topology.

The cluster interface 260 may include one or more ports adapted to couple the storage node 200 to the other node(s) of the cluster 100. In an embodiment, dual 10 Gbps Ethernet ports may be used for internode communication, although it will be apparent to those skilled in the art that other types of protocols and interconnects may be utilized within the embodiments described herein. The NVRAM 230 may include a back-up battery or other built-in last-state retention capability (e.g., non-volatile semiconductor memory such as storage class memory) that is capable of maintaining data in light of a failure to the storage node and cluster environment.

Storage Service

FIG. 3A is a block diagram of the storage service 300 implemented by each storage node 200 of the storage cluster 100. The storage service 300 is illustratively organized as one or more software modules or layers that cooperate with other functional components of the nodes 200 to provide the distributed storage architecture of the cluster 100. In an embodiment, the distributed storage architecture aggregates and virtualizes the components (e.g., network, memory, and compute resources) to present an abstraction of a single storage system having a large pool of storage, i.e., all storage, including internal SSDs 270 and external storage arrays 150 of the nodes 200 for the entire cluster 100. In other words, the architecture consolidates storage throughout the cluster to enable storage of the LUNs, each of which may be apportioned into one or more logical volumes (“volumes”) having a logical block size of either 4096 bytes (4 KB) or 512 bytes. Each volume may be further configured with properties such as size (storage capacity) and performance settings (quality of service), as well as access control, and may be thereafter accessible (i.e., exported) as a block storage pool to the clients, preferably via iSCSI and/or FCP. Both storage capacity and performance may then be subsequently “scaled out” by growing (adding) network, memory and compute resources of the nodes 200 to the cluster 100.

Each client 120 may issue packets as input/output (I/O) requests, i.e., storage requests, to access data of a volume served by a storage node 200, wherein a storage request may include data for storage on the volume (i.e., a write request) or data for retrieval from the volume (i.e., a read request), as well as client addressing in the form of a logical block address (LBA) or index into the volume based on the logical block size of the volume and a length. The client addressing may be embodied as metadata, which is separated from data within the distributed storage architecture, such that each node in the cluster may store the metadata and data on different storage devices (e.g., data on SSDs 270a-n and metadata on SSD 270x) of the storage coupled to the node. To that end, the storage service 300 implemented in each node 200 includes a metadata layer 310 having one or more metadata services 320a-n configured to process and store the metadata, e.g., on SSD 270x, and a block server layer 330 having one or more block services 340a-n configured to process and store the data, e.g., on the SSDs 270a-n. For example, the metadata services 320a-n map between client addressing (e.g., LBA indexes) used by the clients to access the data on a volume and block addressing (e.g., block identifiers) used by the block services 340a-n to store and/or retrieve the data on the volume, e.g., of the SSDs.

FIG. 3B is a block diagram of an alternative embodiment of the storage service 300. When issuing storage requests to the storage nodes, clients 120 typically connect to volumes (e.g., via indexes or LBAs) exported by the nodes. To provide an efficient implementation, the metadata layer 310 may be alternatively organized as one or more volume services 350a-n, wherein each volume service 350 may perform the functions of a metadata service 320 but at the granularity of a volume, i.e., process and store the metadata for the volume. However, the metadata for the volume may be too large for a single volume service 350 to process and store; accordingly, multiple slice services 360a-n may be associated with each volume service 350. The metadata for the volume may thus be divided into slices and a slice of metadata may be stored and processed on each slice service 360. In response to a storage request for a volume, a volume service 350 determines which slice service 360a-n contains the metadata for that volume and forwards the request the appropriate slice service 360.

FIG. 4 illustrates a write path 400 of a storage node 200 for storing data on a volume of storage. In an embodiment, an exemplary write request issued by a client 120 and received at a storage node 200 (e.g., primary node 200a) of the cluster 100 may have the following form:write (volume, LBA, data)

wherein the volume specifies the logical volume to be written, the LBA is the logical block address to be written, and the data is the actual data to be written. Illustratively, the data received by a slice service 360a of the primary node 200a is divided into 4 KB block sizes. At box 402, each 4 KB data block is hashed using a conventional cryptographic hash function to generate a 128-bit (16 B) hash value (recorded as a block identifier of the data block); illustratively, the block ID is used to address (locate) the data on the internal SSDs 270 as well as the external storage array 150. A block ID is thus an identifier of a data block that is generated based on the content of the data block. The conventional cryptographic hash function, e.g., Skein algorithm, provides a satisfactory random distribution of bits within the 16 B hash value/block ID employed by the technique. At box 404, the data block is compressed using a conventional, e.g., LZW (Lempel-Zif-Welch), compression algorithm and, at box 406a, the compressed data block is stored in NVRAM. Note that, in an embodiment, the NVRAM 230 is embodied as a write cache. Each compressed data block is then synchronously replicated to the NVRAM 230 of one or more additional storage nodes (e.g., secondary node 200b) in the cluster 100 for data protection (box 406b). An acknowledgement is returned to the client when the data block has been safely and persistently stored in the NVRAM of the multiple storage nodes 200a,b of the cluster 100.

FIG. 5 is a block diagram illustrating details of a block identifier. In an embodiment, content 502 for a data block is received by storage service 300. As described above, the received data is divided into data blocks having content 502 that may be processed using hash function 504 to determine block identifiers (IDs). That is, the data is divided into 4 KB data blocks, and each data block is hashed to generate a 16 B hash value recorded as a block ID 506 of the data block; illustratively, the block ID 506 is used to locate the data on one or more storage devices. The data is illustratively organized within bins that are maintained by a block service 340a-n for storage on the storage devices. A bin may be derived from the block ID for storage of a corresponding data block by extracting a predefined number of bits from the block ID 506.

In an embodiment, the bin may be divided into buckets or “sublists” by extending the predefined number of bits extracted from the block ID. For example, a bin field 508 of the block ID may contain the first two (e.g., most significant) bytes (2 B) of the block ID 506 used to generate a bin number (identifier) between 0 and 65,535 (depending on the number of 16-bits used) that identifies a bin. The bin identifier may also be used to identify a particular block service 340a-n and associated SSD 270. A sublist field 510 may then contain the next byte (1 B) of the block ID used to generate a sublist identifier between 0 and 255 (depending on the number of 8 bits used) that identifies a sublist with the bin. Dividing the bin into sublists facilitates, inter alia, network transfer (or syncing) of data among block services in the event of a failure or crash of a storage node. The number of bits used for the sublist identifier may be set to an initial value, and then adjusted later as desired. Each block service 340a-n maintains a mapping between the block ID and a location of the data block on its associated storage device/SSD, i.e., block service drive (BSD).

Illustratively, the block ID (hash value) may be used to distribute the data blocks among bins in an evenly balanced (distributed) arrangement according to capacity of the SSDs, wherein the balanced arrangement is based on “coupling” between the SSDs, i.e., each node/SSD shares approximately the same number of bins with any other node/SSD that is not in a same failure domain, i.e., protection domain, of the cluster. As a result, the data blocks are distributed across the nodes of the cluster based on content (i.e., content driven distribution of data blocks). This is advantageous for rebuilding data in the event of a failure (i.e., rebuilds) so that all SSDs perform approximately the same amount of work (e.g., reading/writing data) to enable fast and efficient rebuild by distributing the work equally among all the SSDs of the storage nodes of the cluster. In an embodiment, each block service maintains a mapping of block ID to data block location on storage devices (e.g., internal SSDs 270 and external storage array 150) coupled to the node.

Illustratively, bin assignments may be stored in a distributed key-value store across the cluster. Referring again to FIG. 4, the distributed key-value storage may be embodied as, e.g., a “zookeeper” database 450 configured to provide a distributed, shared-nothing (i.e., no single point of contention and failure) database used to store bin assignments (e.g., a bin assignment table) and configuration information that is consistent across all nodes of the cluster. In an embodiment, one or more nodes 200c has a service/process associated with the zookeeper database 450 that is configured to maintain the bin assignments (i.e., mappings) in connection with a data structure, e.g., bin assignment table 470. Illustratively the distributed zookeeper is resident on up to, e.g., five (5) selected nodes in the cluster, wherein all other nodes connect to one of the selected nodes to obtain the bin assignment information. Thus, these selected “zookeeper” nodes have replicated zookeeper database images distributed among different failure domains of nodes in the cluster so that there is no single point of failure of the zookeeper database. In other words, other nodes issue zookeeper requests to their nearest zookeeper database image (zookeeper node) to obtain current bin assignments, which may then be cached at the nodes to improve access times.

For each data block received and stored in NVRAM 230, the slice services 360a,b compute a corresponding bin number and consult the bin assignment table 470 to identify the SSDs 270a,b to which the data block is written. At boxes 408a,b, the slice services 360a,b of the nodes 200a,b then issue store requests to asynchronously flush copies of the compressed data block to the block services 340a,b associated with the identified SSDs 270a,b. An exemplary store request issued by each slice service 360a,b and received at each block service 340a,b may have the following form:store (block ID, compressed data)

The block services 340a,b confirm receipt of the flushed data block copies to thereby assume “ownership” of the data. The block service 340a,b for each SSD 270a,b also determines if it has previously stored a copy of the data block. If not, the block service 340a,b stores the compressed data block associated with the block ID on the SSD 270a,b. Note that the block storage pool of aggregated SSDs is organized by content of the block ID (rather than when data was written or from where it originated) thereby providing a “content addressable” distributed storage architecture of the cluster. Such a content-addressable architecture facilitates deduplication of data “automatically” at the SSD level (i.e., for “free”), except for at least two copies of each data block stored on at least two SSDs of the cluster. In other words, the distributed storage architecture utilizes a single replication of data with inline deduplication of further copies of the data, i.e., there are at least two copies of data for redundancy purposes in the event of a hardware failure.

DRuM Service

The embodiments described herein are directed to a degraded redundant metadata (DRuM) technique configured to maintain multiple (e.g., two) copies of data for storage nodes of a cluster during upgrade of a storage node (e.g., a software or hardware update to the storage node) to ensure continuous protection of the data served by the nodes. The data is logically organized as one or more volumes on storage devices of the cluster and includes metadata that describe the data of each volume. As stated previously, nodes of the cluster provide slice services that present client facing tasks that initially store the data and metadata for eventual synchronization to the back-end block services (i.e., data at rest) also hosted on the nodes. The cluster may be configured to maintain primary and secondary slice services such that the secondary slice service includes a copy of the initial data and, thus, can failover in the event that the primary slice service is unavailable. Illustratively, a data protection system (DPS) may be configured to maintain two copies (first and second copies) of the data in the cluster during upgrade (or other unavailability) of a storage node that is assigned to store one of the copies of the data but that is taken offline during the upgrade, i.e., the secondary SS effectively fails for a period of time. As a result, an original slice service (SS), operating as the secondary SS, of the secondary node may become unavailable during the upgrade. Accordingly, failover of the remaining SS, e.g., the primary SS, becomes impossible, leaving initially stored data vulnerable to loss. In response to the unavailability of the original SS, the storage of subsequent data received at (i.e., targeted to) the original SS may be redirected to a first standby SS of a pool of standby SSs in accordance with an extended DRuM service of the cluster. In the event the first standby SS subsequently becomes unavailable, the extended DRuM technique activates another (e.g., a second) standby SS of the standby pool to receive the subsequent data. Note that unavailability of the primary SS may result in promotion of the secondary SS as the primary SS. In this manner, cascading failure of secondary SS's is handled by activating a next standby SS from the standby SS pool to act as a replacement standby SS.

FIG. 6 illustrates an example workflow for maintaining protection of data during upgrade (or other unavailability) of a storage node in the cluster in accordance with the extended DRuM technique. Assume an upgrade to the operating system 225 is being performed on a storage node 200, such as secondary node 200b. The secondary node 200b is taken offline such that substantially all services of the node are unavailable. Therefore, the secondary node 200b cannot store new data or serve its hosted data, which includes both (block) data and metadata during the upgrade. The technique described herein is directed to slice services (SS) 360 of the nodes 200 and, in particular, to (block) data that is maintained by the SS 360 but not yet flushed to block services (BS) 340 as well as metadata that describes the block data (hereinafter collectively “data”). The data maintained by the primary SS is particularly vulnerable during upgrade and similar outages of the secondary SS, because transfer of ownership of the data from the primary SS is not effective until flushing of its block data has been confirmed on multiple (e.g., two) BSs. In contrast, a BS with permanent or transient faults may not be problematic during such upgrade outages because transfer of ownership of the flushed data cannot be confirmed (nor even accepted) by a faulty BS. As such, vulnerability of the SS during upgrades extends to servicing of both metadata and block data that the SS maintains (owns) because it has not (or cannot) transfer ownership to the BSs.

Illustratively, a SS 360 (e.g., primary SS 360a and original SS 360b acting as a secondary SS) executes on each storage node 200 in the cluster and the DRuM technique chooses another SS from a pool of SSs 650 to use as a standby SS 360s1,s2 of a volume. The standby SS 360s1,s2 is an alternative SS that may be “spun up” (initialized) from the standby SS pool 650 to temporarily maintain data redundancy in the cluster. In an embodiment, a standby SS 360s1,s2 is assigned (i.e., a node 200s is assigned as candidate for the standby SS to be started when necessary) for every original SS, a priori, and is always available in the cluster until needed, at which time incoming data (destined to the offline SS of a node being upgraded) is forwarded to the standby SS. Note that the original SS 360b may have been initially designated as the primary SS and the “current” primary SS 360a may have been initially designated as the secondary SS which was promoted to become the current primary SS when the original SS 360b became unavailable. An SS assignment algorithm is employed that assigns original primary and secondary SSs 360a,b on primary and secondary nodes 200a,b, respectively, as well as standby SSs 360s1,s2 on standby nodes 200s1,s2, to one or more volumes. The assignments are illustratively based on criteria such as, e.g., storage capacity of a node, size of a volume (slice), minimum quality of service (QoS) parameter settings, etc.

Notably, the DRuM technique is directed primarily to an original secondary SS 360b of a secondary node 200b that is brought offline for upgrade or similar outages; however the technique does contemplate an original primary SS 360a of a primary node 200a being brought offline and an original secondary SS being promoted as primary SS. For least disruption of slice service failure, an upgrade (i.e., planned or expected outage) is thus generally directed to a secondary SS 360b. Note that the technique applies equally to unplanned outages (e.g., node failures) in which case failover to the secondary SS then promoted to primary SS is performed first. Thereafter, when the original primary SS is brought back online, the roles may be reversed. Illustratively, an update algorithm of the DRuM service 600 ensures that a primary SS 360a is available and that only a secondary SS is updated.

The primary node/primary SS assignments are exported to the clients 120 (e.g., iSCSI initiators) to enable the clients to directly connect and communicate with (e.g., write data to) the appropriate node (primary node 200a) of the cluster. As described above with respect to FIG. 4, data written by a client 120 to the primary node 200a transcends the write path 400 of the primary node 200a, where data is hashed 402, compressed 404 and stored on the NVRAM 406a of the primary node as data of a first (1^st) copy. The data is then replicated to the secondary node 200b, e.g., as data of a second (2^nd) copy) in accordance with a SS assignment data structure, i.e., a slice service (SS) assignment table 480, of the zookeeper database 450. The secondary SS 360b on the secondary node 200b also accesses the zookeeper assignments to determine that the data is a replicated write and thus stores the replicated data in the NVRAM 230b on the secondary node. The secondary SS 360b then acknowledges persistent storage of the data to the primary SS 360a on the primary node 200a. The primary node, in turn, acknowledges back to the client 120 that the write has been persistently stored. Flushing of the data to the block services 340a,b may subsequently occur as a background operation.

In the write path 400 of the primary node 200a, the primary SS 360a replicates the write data to the secondary SS 360b up to the point when the secondary SS 360b becomes offline during, e.g., an upgrade. Software (logic) of the DRuM service 600 on the primary node 200a detects that the secondary SS 360b of the secondary node 200b is offline by, e.g., examining the SS assignment table 480 of the zookeeper database 450 (e.g., a state of a zookeeper session from the secondary SS 360b becomes closed). Note that at the start of an upgrade (update), the node to be upgraded is identified and, if necessary, the role of that node (e.g., if primary) is switched to secondary to ensure that the DRuM technique is invoked as described herein. In essence, when one of the multiple (e.g., two) original primary/secondary SSs is taken off line for an upgrade, the DRuM service 600 detects that the node/SS is unavailable and replicates newly received incoming data by writing (forwarding) that data to the standby SS 360s1. To that end, the DRuM service 600 of primary node 200a resends any “inflight” replicated write data (copy) that has not been acknowledged by the secondary SS (hereinafter “original SS 360b”) to the assigned standby SS 360s1,s2 along with any new write data of the 2^nd copy. Forwarding of data to the standby SS 360s1,s2 continues until the original SS 360b is subsequently brought back online (the upgrade completes) and may resume its original role.

In an embodiment, the standby SS 360s1 receives no data until the upgrade, at which time it receives only new incoming (write) data of the 2^nd copy forwarded by the primary node 200a after the original (secondary) SS 360b or a previously activated standby SS (e.g., 360s1) is unavailable, e.g., brought offline. Note that the data received by the standby SS 360s1,s2 is not the entire copy (2^nd copy) of data for the volume, unlike the failover (e.g., secondary) SS 360b, but rather only the new incoming write data of the 2^nd copy after the original SS 360b or previous standby SS 360s1,s is brought offline, e.g., as a result of a failure or upgrade. This new incoming data of the 2^nd copy (which may be distributed among one or more standby SSs that have been activated) is essentially combined with (added to) the existing data of the 2^nd copy maintained by the original SS 360b (i.e., the failed secondary SS) in chronological order to form a complete, valid 2^nd copy of the data. That is, the data received by each standby SS 360s includes only new incoming portions (i.e., deltas) of the replicated (i.e., 2^nd copy) data received at the cluster during downtime of the storage node being upgraded. The “delta” write data is forwarded to a standby SS until either the original secondary SS comes back online or the standby SS becomes unavailable and another standby SS is activated. When the 2^nd copy is eventually reconstituted, the write data “deltas” are combined with the existing data in a specific, chronological ordering based on, e.g., a time sequence as described below. Accordingly, ordering of the data is significant as is the union of the existing copy portion of the data stored at the original (secondary) SS 360b and the new incoming copy portion of the data stored at each standby SS 360s. That is, a group of standby SSs, activated from cascading failure, as a whole, store the incoming copy portion of the data after unavailability (e.g., failure) of the original SS (i.e., secondary SS).

In an embodiment, each standby SS is assigned an Index Incarnation Number (IIN) upon activation, wherein the IIN denotes a point in time at which the standby SS became active. For example, a first standby SS 360s1 may be assigned a first IIN denoting a first point in time at which the first standby SS 360s1 became active. In response to subsequent unavailability (failure) of the first standby SS 360s1, a second standby SS 360s2 may be assigned a second (incremented) IIN denoting a second, subsequent point in time at which the second standby SS 360s2 became active. For example, assume the first standby SS 360s1 is activated and assigned a first IIN (e.g., I²N1), which represents the time period for which the first standby SS 360s1 was active, e.g., from time t1 to t5. The first standby SS 360s1 subsequently becomes unavailable and the second standby SS 360s2 is activated and assigned an incremented, second IIN (e.g., I²N2), which represents the time period for which the second standby SS 360s2 is active, e.g., from t6 to present. To that end, the IIN may be embodied as a logical incarnation number that specifies a sequence (or temporal occurrence) of events. Notably, the IINs may be used to facilitate the chronological ordering of the subsequent incoming data distributed among the standby SSs when forming the complete second copy of data.

Illustratively, the IIN represents a version of a SS assignment data structure, i.e., a SS assignment table, of a distributed database that is reflective of a latest activated standby SS. Note that each activated SS assumes a role (e.g., a primary, secondary or standby SS) per volume that is maintained in the SS assignment table. In other words, a SS can assume different roles for different volumes; however, the SS can only assume one (persistent) role for one volume at a time. The write data (and deltas) are saved and managed by each SS on a per volume basis, based on its role. Information pertaining to the volume and the associated role of the SS is illustratively embedded in a messaging protocol of the cluster, such that when a SS receives a write request (message), the message specifies the targeted volume and the SS saves the write data in a “bucket” for that volume. In an embodiment, the IIN represents a version of the SS assignment table, wherein versioning of the SS assignment table occurs by appending changes/updates to the database on a per volume granularity, i.e., the database records the entire chronological history of SS roles for volumes as appended “meta logs.”

Advantageously, the extended DRuM technique ensures that there are multiple, e.g., two, full (complete) copies of data at all times (i.e., initial store of data by the SSs and data at rest in the BSs) in accordance with the DPS, despite the fact that portions of those copies may be distributed across multiple, e.g., two or more, storage nodes. The extended DRuM technique allows rebuilding of the data from the distributed portions with no data loss to thereby ensure that at least one complete copy of the data may be reconstructed at any given time. Note that in the event a primary SS fails during upgrade of an original (secondary) SS so that no primary or secondary SS is available, a “data unavailability” state is entered because the standby SS cannot serve the data by itself (no complete copy). Service of the data may then be suspended until either (i) the primary SS comes back online or (ii) the secondary SS being upgraded and the standby SS are online and functional, e.g., through manual administrative configuration.

The foregoing description has been directed to specific embodiments. It will be apparent, however, that other variations and modifications may be made to the described embodiments, with the attainment of some or all of their advantages. For instance, it is expressly contemplated that the components and/or elements described herein can be implemented as software encoded on a tangible (non-transitory) computer-readable medium (e.g., disks, electronic memory, and/or CDs) having program instructions executing on a computer, hardware, firmware, or a combination thereof. Accordingly, this description is to be taken only by way of example and not to otherwise limit the scope of the embodiments herein. Therefore, it is the object of the appended claims to cover all such variations and modifications as come within the true spirit and scope of the embodiments herein.

Claims

1. A method comprising: maintaining first and second copies of data on first and second slice services of respective first and second storage nodes of a cluster, the first slice service receiving a first write request having initial data from a client;in response to receiving the first write request, copying the initial data from the first slice service to the second slice service;in response to copying the initial data, acknowledging receiving the first write request to the client;in response to an unavailability of the second slice service, redirecting new incoming data of a second write request received at the first slice service to a first standby slice service of a first standby node in the cluster without replicating the data copied to the second slice service prior to the unavailability;in response to the unavailability of the first standby slice service, redirecting subsequent incoming data of a subsequent write request received at the first slice service to a second standby slice service of a second standby node in the cluster; andcombining the initial data at the second slice service with the new and subsequent incoming data at the first and second standby slice services to form a complete second copy of the received data.

2. The method of claim 1 wherein the second slice is a primary slice service and the first slice service is a secondary slice service promoted to the primary slice service in response to the unavailability of the second slice service.

3. The method of claim 1 wherein the unavailability of the second slice service results from an update to the second node.

4. The method of claim 1 wherein combining the existing data further comprises combining the initial data maintained by the second slice service with the new and subsequent incoming data maintained at the first and second standby slice services in a chronological order to form the complete second copy of the received data.

5. The method of claim 1 wherein each standby slice service comprises an alternative slice service that is initialized to temporarily maintain data redundancy in the cluster.

6. The method of claim 1 wherein each standby slice service is assigned a priori and is available in the cluster until needed.

7. The method of claim 1 further comprising employing a slice service assignment algorithm that assigns the first and second slice services to the first and second nodes, respectively, as well as the standby slice services on the standby nodes, to one or more volumes of the cluster.

8. The method of claim 7 wherein the assignments are based on one or more criteria such as storage capacity of a node, size of a volume, and quality of service (QoS) parameter settings.

9. The method of claim 1 further comprising: in response to the second slice service subsequently becoming available, synchronizing the new incoming data to the second slice service from first slice service.

10. The method of claim 1, wherein a synchronizing of the existing data and new incoming data is performed as background process on the first node.

11. A system comprising: a cluster of storage nodes, each storage node having a processor coupled to a network interface, wherein the processor of a first and second storage node is configured to: maintain first and second copies of data on first and second slice services of the respective first and second storage nodes of a cluster, the first slice service receiving a first write request having initial data from a client;in response to receiving the write request, copy the initial data from the first slice service to the second slice service;in response to copying the existing data, acknowledge receiving the first write request to the client;in response to an unavailability of the second slice service, redirect new incoming data of a second write request received at the first slice service to a first standby slice service of a first standby node in the cluster without replicating the data copied to the second slice service prior to the unavailability;in response to the unavailability of the first standby slice service, redirect subsequent incoming data of a subsequent write request received at the first slice service to a second standby slice service of a second standby node in the cluster; andcombine the initial data at the second slice service with the new and subsequent incoming data at the first and second standby slice services to form a complete second copy of the received data.

12. The system of claim 11 wherein the standby slice service is assigned a priori and is available in the cluster until needed.

13. The system of claim 11 wherein the standby slice service comprises an alternative slice service that is initialized to temporarily maintain data redundancy in the cluster.

14. The system of claim 13 wherein the second slice is a primary slice service and the first slice service is a secondary slice service promoted to the primary slice service in response to the unavailability of the second slice service.

15. The system of claim 13 wherein the unavailability of the second slice service results from an update to the second node.

16. The system of claim 13 wherein the processor configured to combine the existing data further comprises combine the initial data maintained by the second slice service with the new and subsequent incoming data maintained at the first and second standby slice services in a chronological order to form the complete second copy of the received data.

17. A non-transitory computer readable medium containing executable program instructions to: maintain first and second copies of data on first and second slice services of respective first and second storage nodes of a cluster, the first slice service receiving a first write request having initial data from a client;in response to receiving the first write request, copy the initial data from the first slice service to the second slice service;in response to copying the initial data, acknowledge receiving the first write request to the client;in response to an unavailability of the second slice service, redirect new incoming data of a second write request received at the first slice service to a first standby slice service of a first standby node in the cluster without replicating the data copied to the second slice service prior to the unavailability;in response to the unavailability of the first standby slice service, redirect subsequent incoming data of a subsequent write request received at the first slice service to a second standby slice service of a second standby node in the cluster; andcombine the initial data at the second slice service with the new and subsequent incoming data at the first and second standby slice services to form a complete second copy of the received data.

18. The non-transitory computer readable medium of claim 17, wherein the second slice is a primary slice service and the first slice service is a secondary slice service promoted to the primary slice service in response to the unavailability of the second slice service.

19. The non-transitory computer readable medium of claim 17, wherein the unavailability of the second slice service results from an update to the second node.

20. The non-transitory computer readable medium of claim 17, wherein each standby slice service is assigned a priori and is available in the cluster until needed.