Google云计算解决方案分布式系统综述.pptVIP

? Spinnaker Labs, Inc. Reliability Demands Support partial failure Total system must support graceful decline in application performance rather than a full halt ? Spinnaker Labs, Inc. Reliability Demands Data Recoverability If components fail, their workload must be picked up by still-functioning units ? Spinnaker Labs, Inc. Reliability Demands Individual Recoverability Nodes that fail and restart must be able to rejoin the group activity without a full group restart ? Spinnaker Labs, Inc. Reliability Demands Consistency Concurrent operations or partial internal failures should not cause externally visible nondeterminism ? Spinnaker Labs, Inc. Reliability Demands Scalability Adding increased load to a system should not cause outright failure, but a graceful decline Increasing resources should support a proportional increase in load capacity ? Spinnaker Labs, Inc. Reliability Demands Security The entire system should be impervious to unauthorized access Requires considering many more attack vectors than single-machine systems ? Spinnaker Labs, Inc. Ken Arnold, CORBA designer: “Failure is the defining difference between distributed and local programming” ? Spinnaker Labs, Inc. Component Failure Individual nodes simply stop ? Spinnaker Labs, Inc. Data Failure Packets omitted by overtaxed router Or dropped by full receive-buffer in kernel Corrupt data retrieved from disk or net ? Spinnaker Labs, Inc. Network Failure External internal links can die Some can be routed around in ring or mesh topology Star topology may cause individual nodes to appear to halt Tree topology may cause “split” Messages may be sent multiple times or not at all or in corrupted form… ? Spinnaker Labs, Inc. Timing Failure Temporal properties may be violated Lack of “heartbeat” message may be interpreted as component halt Clock skew between nodes may confuse version-aware data readers ? Spinnaker Labs, Inc. Byzantine Failure Difficult-to-reason-about circumstances arise Commands sent to foreig