OceanBase Database adopts a shared-nothing architecture with multiple replicas to ensure zero single point of failure and system continuity. OceanBase supports high availability and disaster recovery (HA/DR) at the IDC (single IDC deployment of OceanBase clusters), region (multi IDC deployment of OceanBase clusters in the same region), and multi-region (multi-region deployment of OceanBase clusters) levels. You can deploy OceanBase clusters in one IDC, in two IDCs in the same region, in three IDCs across two regions, or in five IDCs across three regions. You can also deploy the arbitration service to reduce costs.
Deployment solutions
Solution 1: Deploy three replicas across three IDCs in the same region
Characteristics:
- The three IDCs form a cluster, with each IDC being a zone. The network latency between IDCs ranges from 0.5 to 2 ms.
- In the case of a disaster at one IDC, the remaining two replicas are still in the majority. They can continue to synchronize redo logs, ensuring RPO=0.
- The solution cannot protect against disasters at the region level.
Deployment diagram:
Solution 2: Deploy five replicas across three regions and two IDCs in each region
Characteristics:
- The five replicas across three regions form a cluster.
- A disaster in any IDC or region will not affect the majority. This ensures RPO=0.
- More than three replicas are required to form a majority. Therefore, to reduce latency, IDCs 1 and 2 in a region should be located close to each other to expedite the synchronization of redo logs.
Deployment diagram:
Solution 3: Deploy two OceanBase clusters in the same region in a "primary/standby" configuration
Characteristics:
- Each IDC hosts an OceanBase cluster, one as the primary cluster and the other as the standby cluster. Each cluster has its own Paxos group to ensure multi-replica consistency.
- Data is synchronized between clusters through redo logs. This is similar to primary/standby replication in traditional databases, where the primary database asynchronously synchronizes data to the standby database. This is similar to the maximum performance mode in Oracle Data Guard.
Deployment diagram:
Solution 4: Deploy three IDCs in two regions in a "primary/standby" configuration
Characteristics:
- The five IDCs across the two regions form a cluster. A disaster in any IDC or region will not affect the majority. This ensures RPO=0.
- IDC 3 in the standby region builds a separate three-replica cluster as a standby database. The primary cluster asynchronously synchronizes data to the standby cluster.
- If the primary region encounters a disaster, the standby region can take over the business.
Deployment diagram:
Solution 5: Deploy an arbitration service across three IDCs in the same region
Characteristics:
- The three IDCs form a cluster. The network latency between IDCs ranges from 0.5 to 2 ms. Two IDCs host full-featured replicas, each of which is a zone. To reduce costs, the arbitration service is deployed in the third IDC (without synchronizing logs).
- In the case of a disaster in one IDC, the replicas in the remaining IDCs can compete for the leader and run in arbitration mode (if the IDC where the full-featured replica is located encounters a disaster). This ensures RPO=0.
- The solution cannot protect against disasters at the region level.
For more information about the arbitration service, see Overview.
Deployment diagram:
Solution 6: Deploy an arbitration service across five IDCs in three regions
Characteristics:
- The five IDCs across three regions are deployed in IDCs 1 and 2 of regions 1 and 2, and IDC 3 of region 3. IDCs 1 and 2 in a region are located close to each other to reduce the latency of redo log synchronization. IDC 3 is deployed to reduce costs.
- A disaster in any IDC will not affect the majority (three out of four). This ensures RPO=0.
- A disaster in any two IDCs or regions, provided that the disasters affect full-featured replicas, will leave only two full-featured replicas, which is insufficient to form a majority (two out of four). In this case, the system can enter arbitration mode (two of the full-featured replicas are downgraded to Learner mode). This ensures RPO=0.
- More than three replicas are required to form a majority. Therefore, to reduce latency, IDCs 1 and 2 in a region should be located close to each other to expedite the synchronization of redo logs.
Deployment diagram:
Scenario 7: Arbitration service deployed across two IDCs in one region
Characteristics:
- The primary region has two IDCs, each containing two zones, for deploying full-featured replicas.
- The standby region has one IDC for deploying the arbitration service to reduce deployment costs and cross-region bandwidth overheads.
- If an IDC in the primary region fails, at most two replicas are lost. In this case, the remaining replicas may not form a majority (2/4). The arbitration service can trigger a downgrade and restore, ensuring RPO=0.
- A disaster in the primary region cannot be addressed, but a disaster in the standby region does not cause any impact.
Deployment scenario: