High availability deployment solutions for OceanBase clusters

OceanBase Database adopts a shared-nothing architecture with multiple replicas to ensure zero single point of failure and system continuity. OceanBase supports high availability and disaster recovery (HA/DR) at the IDC (single IDC deployment of OceanBase clusters), region (multi IDC deployment of OceanBase clusters in the same region), and multi-region (multi-region deployment of OceanBase clusters) levels. You can deploy OceanBase clusters in one IDC, in two IDCs in the same region, or in three IDCs across two regions, and deploy the arbitration service to reduce costs.

Deployment scenarios

Solution 1: Deploy three replicas across three IDCs in the same region

Characteristics:

• The three IDCs form a cluster, with each IDC being a zone. The network latency between zones is generally 0.5 to 2 ms.
• If two IDCs go down, the remaining IDC still hosts the majority of replicas and can synchronize redo logs to ensure RPO=0.
• It cannot protect against disasters at the region level.

Deployment diagram:

Solution 2: Deploy five replicas across three IDCs in different regions

Characteristics:

• The five replicas across the three IDCs in different regions form a cluster.
• If an IDC or region goes down, the majority of replicas remain and RPO=0 can still be ensured.
• More than three replicas are required to form a majority. Therefore, to reduce latency, IDC 1 and IDC 2, which are located in the same region, should be as close as possible to expedite the synchronization of redo logs.

Deployment diagram:

Solution 3: Deploy two OceanBase clusters in the same region in a "primary/standby" configuration

Characteristics:

• Each IDC hosts an OceanBase cluster, one as the primary cluster and the other as the standby cluster. Each cluster has its own Paxos group to ensure multi-replica consistency.
• Data is synchronized between clusters through redo logs. This setup is similar to the conventional "primary/standby" replication mode in which data is asynchronously synchronized from the primary database to the standby database.

Deployment diagram:

Solution 4: Deploy three replicas across two IDCs in different regions in a "primary/standby" configuration

Characteristics:

• The five replicas across the two IDCs in different regions form a cluster. The loss of up to two replicas from the primary region does not break the majority. The remaining three replicas still form the majority.
• The standby region hosts a three-replica cluster as the standby database. The primary database asynchronously synchronizes data to the standby database.
• If the primary region encounters a disaster, the standby region takes over the business.

Deployment diagram:

Solution 5: Deploy the arbitration service in the same region

Characteristics:

• The three IDCs form a cluster. The network latency between zones is generally 0.5 to 2 ms. Two IDCs host full-featured replicas, with each IDC being a zone. To reduce costs, the third IDC hosts the arbitration service without synchronizing logs.
• If an IDC goes down, the replicas in the remaining IDCs can compete for the leader and perform arbitration downgrading (if a zone hosting a full-featured replica goes down) to ensure RPO=0.
• It cannot protect against disasters at the region level.

For more information about the arbitration service, see Overview.

Deployment diagram:

Solution 6: Deploy the arbitration service across regions

Characteristics:

• The five IDCs across three regions are deployed as follows: IDC 1 and IDC 2 in region 1 are close to each other and host full-featured replicas; IDC 3 in region 2 hosts the arbitration service to reduce costs (log synchronization is not required). IDC 3 in region 3 hosts no full-featured replica.
• If an IDC goes down, the full-featured replicas in the remaining IDCs still form the majority (3/4) and can ensure RPO=0.
• If two IDCs or a region go down, the two down IDCs or the down region are from the same zone. In this case, the remaining full-featured replicas cannot form the majority (less than 2/4). The system can be restored by downgrading the two down replicas or the down region as learners (arbitration downgrading). This ensures RPO=0.
• More than three replicas are required to form a majority. Therefore, to reduce latency, IDC 1 and IDC 2, which are located in the same region, should be as close as possible to expedite the synchronization of redo logs.

Deployment diagram:

Solution 7: Deploy the arbitration service across two IDCs in one region

Characteristics:

• The primary region has two IDCs, each of which contains two zones for deploying full-featured replicas.
• The standby region has one IDC for deploying the arbitration service, which helps reduce deployment costs and cross-region bandwidth overheads.
• Unable to cope with the major city disaster, but the backup city disaster has no impact.
• A disaster in the primary region cannot be handled, but a disaster in the standby region does not have any impact.

Deployment scenario:

References

• Disaster recovery deployment plan
• Overview of the arbitration service