This topic describes how to perform a disaster recovery drill on a PolarDB for MySQL cluster.
Overview
You can use the Disaster Recovery Drill feature to simulate failures on a PolarDB for MySQL cluster. A Disaster Recovery Drill supports two dimensions: the node dimension and the zone dimension. In a node-dimension drill, you can test only one node at a time. During the drill, once the system injects a fault, the specified node becomes unavailable, and the PolarDB for MySQL cluster recovers based on a fixed strategy. For more information about the recovery strategy, see Recovery phase.
This feature is in canary release. To use it, contact us to be added to the allowlist and enable the feature.
Prerequisites
Your PolarDB for MySQL cluster must meet the following requirements:
-
Edition: Enterprise Edition.
-
Database engine:
-
MySQL 5.6, with a revision version of 5.6.1.0.42 or later.
-
MySQL 5.7, with a revision version of 5.7.1.0.26 or later.
-
MySQL 8.0.1, with a revision version of 8.0.1.1.30.2 or later.
-
MySQL 8.0.2, with a revision version of 8.0.2.2.19 or later.
-
Usage notes
A disaster recovery drill carries risks, such as transient connection interruptions and data loss. To avoid impacting your business, we strongly recommend running drills on a cloned cluster. You can also use Intelligent Stress Testing to simulate production workloads during a drill.
Risk of data loss:
-
For a zone-dimension drill, there is a risk of data loss if the Recovery Point Objective (RPO) is less than 60 seconds.
-
For a node-dimension drill, if a Read-only Node (Standby) or a Read-only Node exists, the RPO is 0 and there is no risk of data loss.
Procedure
-
Log on to the PolarDB console. In the left-side navigation pane, click Clusters, select the region where the cluster resides, and then click the ID of the target cluster to go to the cluster details page.
-
In the left-side navigation pane, click Service availability, and then click the Disaster Recovery Drill tab.
-
On the Disaster Recovery Drill page, select the zone or node for the drill. Then, click Start Drill.
Note-
The Disaster Recovery Drill page provides shortcuts to Intelligent Stress Testing and Clone Cluster.
-
If you select a zone, the drill runs on all nodes in that zone.
-
-
In the Fault Injection Method dialog box, select Fault Injection By Node. Click OK.
-
On the Disaster Recovery Drill page, you can view the status and phases of the current drill task in the Drills section at the bottom of the page.
-
Node-dimension schematic:
-
The drill list table contains columns such as Task ID, Drill Mode, Fault Injection Method, Start Time, End Time, Drill Status, and Node Information.
-
When you expand a task, you can view the Disaster Recovery Drill Phase Display, which contains three phases: Fault Injection (fault injection on the primary node), Recovery Phase (the primary node is restored and available), and Post-processing Phase. After each phase is completed, a green check mark is displayed.
-
-
Zone-dimension schematic:
-
The drill list table contains columns such as Task ID, Drill Mode, Fault Injection Method, Start Time, End Time, Drill Status, and Node Information.
-
When you expand a task, you can view the Disaster Recovery Drill Phase Display, which contains three phases: Fault Injection (fault injection on the read-only node and on the primary node), Recovery Phase (the primary node is restored and available), and Post-processing Phase (standby rebuild). After each phase is completed, a green check mark is displayed.
-
-
Drill phases
Fault injection
A fault is injected based on the selected Drill Nodes and Fault Injection Method.
Recovery phase
Node dimension
-
If you select the Primary Node for the drill and a Read-only Node (Standby) exists, the Primary Node fails over to the Read-only Node (Standby).
-
If you select the Primary Node for the drill, and no Read-only Node (Standby) exists but a Read-only Node does, the Primary Node fails over to the Read-only Node.
-
If you select the Primary Node for the drill and no Read-only Node (Standby) or Read-only Node exists, the system performs a Zone dimension drill.
-
If you select a Read-only Node for the drill, the system starts a new read-only node for the failover.
Zone dimension
If you select a zone for the drill, the drill runs on all nodes in that zone. The primary node and other nodes fail over to the secondary zone. The following figures show the architecture in each scenario:
Before the drill
Fault drill on all nodes in the zone
Primary node restored
Resource replenishment
The system determines whether to replenish resources based on the resource availability in the new primary zone (Zone 2 in this example). If the system replenishes resources, the following figure shows the architecture.
Post-drill phase
This phase is triggered only for a Zone dimension drill. The time required for this phase varies based on the data volume and network latency. This phase does not affect your business.
Resource replenishment
-
Rebuild Backup Database
-
Primary Node Switchback
No resource replenishment
-
Rebuild Backup Database
-
Primary Node Switchback