OceanBase Database uses a shared-nothing architecture with multiple replicas to ensure zero single point of failure (SPOF) and system continuity. It supports high availability (HA) and disaster recovery at the node, Internet data center (IDC), and region levels. You can deploy OceanBase Database in a single IDC, in two IDCs in the same region, in three IDCs across two regions, or in five IDCs across three regions. You can also deploy the arbitration service to reduce the cost.
Deployment solutions
Solution 1: Three IDCs in the same region
Characteristics of this deployment solution are as follows:
- Three IDCs in the same region form a cluster with three replicas. Each IDC is a zone, with network latency between IDCs ranging from 0.5 ms to 2 ms.
- If an IDC fails, the remaining two replicas are still in the majority. They can enable redo log synchronization and guarantee a recovery point objective (RPO) of zero.
- This deployment solution cannot cope with region-wide disasters.
Solution 2: Five IDCs across three regions
Characteristics of this deployment solution are as follows:
- Five IDCs across three regions form a cluster with five replicas.
- In the case of an IDC or region-wide failure, the remaining replicas are still in the majority and can guarantee an RPO of zero.
- The majority must contain at least three replicas. However, each region has at most two replicas. To reduce the latency for synchronizing redo logs, two of the regions must be close to each other, such as Hangzhou and Shanghai in the following diagram.
Solution 3: Primary/standby deployment of two IDCs in the same region
Characteristics of this deployment solution are as follows:
Each IDC is deployed with an OceanBase cluster, with one serving as the primary database and the other as the standby database. Each cluster has its own dedicated Paxos group to ensure data consistency across multiple replicas.
Data is synchronized between clusters by using redo logs, which is similar to the leader-follower replication mode of conventional databases. Data can be synchronized in asynchronous synchronization mode, which is similar to the Maximum Performance mode of Oracle Data Guard.
Solution 4: Primary/standby deployment of three IDCs across two regions
Characteristics of this deployment solution are as follows:
- The primary region and the standby region form a cluster with five replicas. When an IDC in the primary region fails, at most two replicas become unavailable, and the remaining three replicas are still in the majority.
- Meanwhile, a cluster with three replicas is deployed in the standby region, serving as a standby database that asynchronously synchronizes data with the primary database.
- When the primary region encounters a disaster, the standby region can take over its services.
Solution 5: Three IDCs in the same region with the arbitration service
Characteristics of this deployment solution are as follows:
Three IDCs in the same region form a cluster, with network latency between IDCs ranging from 0.5 ms to 2 ms. Two of the IDCs hold full-featured replicas, each serving as a separate zone. To reduce costs, the third IDC is deployed with the arbitration service without the need for log synchronization.
In the event of an IDC failure, a new leader can be elected from replicas in the remaining two IDCs and a downgrade operation can be performed by the arbitration service if the IDC with full-featured replicas fails. This ensures an RPO of zero.
This deployment solution cannot cope with region-wide disasters.
For more information about the arbitration service, see Overview of the arbitration service.
Solution 6: Five IDCs across three regions with the arbitration service
Characteristics of this deployment solution are as follows:
- Five IDCs across three regions form a cluster. Region1 and Region2 are close to each other, and IDCs in these two regions are deployed with full-featured replicas. To reduce costs, Region3 is deployed with the arbitration service without the need for log synchronization.
- When one IDC fails, the remaining three out of four full-featured replicas are still in the majority to guarantee an RPO of zero.
- When two IDCs or a region with full-featured replicas fails, the remaining two out of four full-featured replicas are not in the majority. The database service can be restored to guarantee an RPO of zero by using the arbitration service to downgrade the two faulty replicas to learners.
- The majority must contain at least three replicas. However, each region has at most two replicas. To reduce the latency for synchronizing redo logs, Region1 and Region2 must be close to each other.
Solution 7: Three IDCs across two regions with the arbitration service
Characteristics of this deployment solution are as follows:
- The primary region has two IDCs, each containing two zones for deploying full-featured replicas.
- The standby region has one IDC, where the arbitration service is deployed to reduce deployment costs and cross-region bandwidth overhead.
- When an IDC in the primary region fails, at most two replicas become unavailable and the remaining two out of four full-featured replicas are not in the majority. However, the arbitration service can trigger a downgrade recovery to ensure an RPO of zero.
- This deployment solution cannot cope with disasters in the primary region, but ensures the database service when disasters take place in the standby region.
