Settings for fault tolerance of user data and management functions

User data protection methods

VSP One SDS Block supports HPEC (Hitachi Polyphase Erasure Coding) and Mirroring to protect user data. HPEC is the Hitachi proprietary data protection method developed for SDS systems with low network bandwidth between storage nodes. HPEC stores user data on a local drive. Mirroring is a data protection method that stores a copy of user data on another storage node.

For HPEC, the 4D+1P or 4D+2P method can be selected. For Mirroring, only Duplication can be selected. Note, however, that selecting either of these might cause restrictions on the combination of functions that can be used. For details, see Settings and functions for fault tolerance supported by VSP One SDS Block.

• HPEC 4D+1P (4 data +1 parity): Set it when capacity efficiency and performance are important. The number of storage nodes or drive failures allowed is one.

• HPEC 4D+2P (4 data +2 parity): Set if you want to focus on the number of failures allowed. The number of storage nodes or drive failures allowed is two.

• Mirroring Duplication (1 data +1 copydata): Select this method if performance is priority. The Mirroring method is superior to the HPEC methods in fault tolerance against storage node or drive failures, as well as in performance during normal operation. The number of storage nodes or drive failures allowed is one.

for HPEC 4D+1P

• User data and its parities are stored on five or more different storage nodes for redundancy.

• At least five storage nodes are required.

• You can use a maximum of 60% to 75% of physical capacity.

  However, if the rebuild capacity policy (rebuildCapacityPolicy) is set to "Fixed" (default), you can use a maximum of 60% to 75% of the physical capacity excluding the rebuild capacity on each storage node. For details about the rebuild capacity, see Rebuild capacity of a storage pool in the VSP One SDS Block and SDS Cloud System Administration.

• The read performance is the same as HPEC 4D+2P, but the write performance is better than HPEC 4D+2P.

• The number of storage node or drive failures allowed is one. The number is the sum of the number of defective storage nodes and the number of defective drives. However, the number is counted as one failure in the following cases.

  • One or more drive failures occurred on a faulty storage node.
  • Drive failures occurred on a single storage node.

for HPEC 4D+2P

• User data and its parities are stored on six or more different storage nodes for redundancy.

• At least six storage nodes are required.

• You can use a maximum of 50% to 65% of physical capacity.

  However, if the rebuild capacity policy (rebuildCapacityPolicy) is set to "Fixed" (default), you can use a maximum of 50% to 65% of the physical capacity excluding the rebuild capacity on each storage node. For details about the rebuild capacity, see Rebuild capacity of a storage pool in the VSP One SDS Block and SDS Cloud System Administration.

• The read performance is the same as HPEC 4D+1P, but the write performance is about 60% of HPEC 4D+1P.

• The number of storage node or drive failures allowed is two. The number is the sum of the number of defective storage nodes and the number of defective drives. However, the number is counted as one failure in the following cases.

  • One or more drive failures occurred on a faulty storage node.
  • Drive failures occurred on a single storage node.

(A) Store data locally and reduce network communication during read

(B) Primary coding: Coding reduces data volume for two redundancies

(C) Secondary coding: Data storage capacity is reduced to achieve capacity efficiency that is equivalent to EC (Erasure Coding)

for Mirroring Duplication

• User data and its copies are stored on two different storage nodes for redundancy.

• At least three storage nodes are required.

• You can use a maximum of 40% to 48% of physical capacity.

  However, if the rebuild capacity policy (rebuildCapacityPolicy) is set to "Fixed" (default), you can use a maximum of 40% to 48% of the physical capacity excluding the rebuild capacity on each storage node. For details about the rebuild capacity, see Rebuild capacity of a storage pool in the VSP One SDS Block and SDS Cloud System Administration.

• The read performance of this method is equivalent to the HPEC 4D+1P and HPEC 4D+2P methods, but the write performance is superior to the HPEC 4D+1P method. Additionally, the fault tolerance against storage node or drive failures is also superior to the HPEC methods.

• The allowable number of defective storage nodes or drives is 1. The number is the sum of the number of defective storage nodes and the number of defective drives. However, the number is counted as one failure in the following cases.

  • One or more drive failures occurred on a faulty storage node.
  • Drive failures occurred on a single storage node.

  However, two or more failures can be allowed except in the following cases.

  • Condition 1: Storage node or drive failures occur on both storage nodes that belong to redundant storage controllers. For details about storage controllers, see Redundancy of the storage controller.

    CAUTION:

    Failures might not be allowed even when Condition 1 is not met for the following cases:

    • After adding storage nodes until drive data relocation is completed

    • While the storage node is being removed

  • Condition 2: Failures occur on two or more cluster master nodes. For details about cluster master nodes, see Redundancy of the cluster master node.

For how to design the capacity for the HPEC 4D+1P, HPEC 4D+2P, or Mirroring Duplication method, see Capacity Design (for HPEC 4D+1P) (Bare metal), Capacity Design (for HPEC 4D+2P), or Capacity design (for Mirroring) in the VSP One SDS Block and SDS Cloud System Administration.

Redundancy of the storage controller

Storage controllers are part of VSP One SDS Block processes that manage storage node capacities and volumes.

An equal number of storage controllers and storage nodes manage the capacity and volumes of each storage node. Each storage controller manages one storage node and can also manage one or more other storage nodes for redundancy in case a storage node failure occurs.

The following two settings are available that determine the degree of redundancy of the storage controller. Do not explicitly specify the degree of redundancy of the storage controller, because it is automatically determined depending on the user data protection method. For details about the combination of the user data protection method and the degree of redundancy of the storage controller, see Settings and functions for fault tolerance supported by VSP One SDS Block.

• OneRedundantStorageNode (degree = 2)

  The system can continue to operate if a maximum of one storage node becomes faulty.

  The following example shows assigning storage controllers to storage nodes if OneRedundantStorageNode is selected:

  
  
  

• TwoRedundantStorageNodes (degree = 3)

  The system can continue to operate if a maximum of two storage nodes become faulty.

  The following example shows assigning storage controllers to storage nodes if OneRedundantStorageNode is selected:

  
  
  

Redundancy of the cluster master node

Storage nodes are classified into cluster master nodes and cluster worker nodes. Cluster master nodes are further classified into primary and secondary nodes. Only one cluster master node (primary) in a storage cluster manages and controls the entire storage cluster. If a failure occurs on the cluster master node (primary), one of the cluster master nodes (secondary) becomes the primary node, so that the entire storage cluster can continue to operate.

The user needs to select which storage nodes are to be used as cluster master nodes. For the selected storage nodes, which node becomes the primary node (and which storage nodes become secondary nodes) is automatically determined in the storage cluster.

The number of cluster master nodes is set by selecting from the following two options. Note, however, that selecting either of these options might cause restrictions on the combination of functions that can be used. For details, see Settings and functions for fault tolerance supported by VSP One SDS Block.

• 3 nodes

  The system can continue to operate if a maximum of one cluster master node becomes faulty.

  The following example shows the 3-node configuration:

  
  
  

• 5 nodes

  The system can continue to operate if a maximum of two cluster master nodes become faulty.

  The following example shows the 5-node configuration:

  
  
  

Fault domain

A fault domain is a group of storage nodes that share hardware, such as the same power supply system or network switch.

By isolating hardware such as power supplies and network switches for each fault domain, the storage system can continue to operate if another fault domain is successful, even if a hardware failure occurs within one fault domain.

The number of fault domains is set by selecting from the following two.

• Number of fault domains 1

  Set it up when you want to focus on ease of deployment and configuration scalability. You can configure a storage cluster without being aware of fault domains. On the other hand, if hardware such as power systems or network switches shared by storage nodes fails, operations may be stopped.

• Number of fault domains 3

  Set it when you want to focus on the number of failures allowed. If hardware such as power systems or network switches shared within one fault domain fails, data, parity, and storage controllers are in place to protect user data, so that if the other two fault domains are healthy, they can continue to operate. On the other hand, a fault domain of 3 limits the configuration of the storage cluster.

When the number of fault domains is 1

• Either the plus-1 or plus-2 redundant configuration can be used.

• The maximum number of storage node or drive failures that can be allowed depends on the configuration. In the plus-1 redundant configuration, a maximum of one storage node or drive failure can be allowed. In the plus-2 redundant configuration, a maximum of two storage node or drive failures can be allowed.

  Note, however, that if the user data protection method is "Mirroring Duplication", failures can be allowed except in the following cases.

  • Condition 1: Storage node or drive failures occur on both storage nodes that redundant storage controllers belong to.

  • Condition 2: Failures occur on two or more cluster master nodes.

  The number is the sum of the number of defective storage nodes and the number of defective drives. However, the number is counted as one failure in the following cases.

  • One or more drive failures occurred on a faulty storage node.
  • Drive failures occurred on a single storage node.

• The number of storage nodes that can comprise a configuration depends on the user data protection method. For HPEC 4D+1P, the configuration can comprise of 5 to 32 storage nodes. For HPEC 4D+2P, the configuration can comprise of 6 to 32 storage nodes. For Mirroring Duplication, the configuration can comprise of 3 to 32 storage nodes.

• Storage nodes can be added in units of one.

• Storage nodes can be removed.

• Take a redundant configuration so that a single power failure does not cause power to the storage node to stop.

• Have a redundant configuration so that a single network switch failure does not cause network failure on multiple storage nodes.

When the number of fault domains is 3:

• The plus-1 redundant configuration is used and the user data protection method is "Mirroring Duplication."

  • The number of storage node or drive failures allowed is as follows:

    • If the storage node or drive failure is in the same fault domain, it is acceptable if all storage nodes or drives fail.

    • If storage node or drive failures occur in different fault domains, the failures can be tolerated until either of the following conditions is met:

      • Condition 1: Storage node or drive failures occur on both storage nodes that redundant storage controllers belong to.

      • Condition 2: Failures occur on two or more cluster master nodes.

  • A configuration can comprise 3, 6, 9, 12, 15, 18, 21, 24, 27, or 30 storage nodes.

  • Storage nodes can be added in units of 3.

  • Storage nodes cannot be removed.

  • Each fault domain must consist of the same number of storage nodes and one of the storage nodes must be set as a cluster master node (three cluster master nodes in total).

  • The power supply must be independent for each fault domain so that a single power failure does not stop powering multiple fault domains. If you have a power supply that shares between fault domains, you have a redundant configuration.

  • The network switch must be independent for each fault domain so that a single network switch failure does not cause network failure on fault domains. If you have network switches to share between fault domains, you have a redundant configuration.

• The plus-2 redundant configuration is used.

  • The number of storage node or drive failures allowed is as follows:

    • If the storage node or drive failure is in the same fault domain, it is acceptable if all storage nodes or drives fail.

    • If storage node or drive failures occur on different fault domains, the system can allow failures on a maximum of 2 storage nodes or drives.

    The number is the sum of the number of defective storage nodes and the number of defective drives. However, the number is counted as one failure in the following cases.

    • One or more drive failures occurred on a faulty storage node.
    • Drive failures occurred on a single storage node.

  • A configuration can comprise 6, 12, 18, 24, or 30 storage nodes.

  • Storage nodes can be added in units of 6.

  • Storage nodes cannot be removed.

  • Each fault domain must consist of the same number of storage nodes and one or two of the storage nodes must be set as cluster master nodes (five cluster master nodes in total).

  • The power supply must be independent for each fault domain so that a single power failure does not stop powering multiple fault domains. If you have a power supply that shares between fault domains, you have a redundant configuration.

  • The network switch must be independent for each fault domain so that a single network switch failure does not cause network failure on fault domains. If you have network switches to share between fault domains, you have a redundant configuration.

Here is an example configuration when the number of fault domains is 3.

In the configuration example, the network switches and power supplies connected to the storage node are independent for each fault domain. This configuration allows operations to continue in the event of a failure of a shared power supply or network switch within a fault domain because the scope of the failure is limited within that fault domain.

Also, for the BMC network, as well as for other networks, separate hardware.