prty Contact

Architecture

How it works, and how it fails.

prty is three blocks. The data plane serves your database and looks after itself. The control plane builds and changes it. Monitoring carries what the data plane observes to the control plane and to people. Each page says what the block is, draws it, lists the failures that matter and the problems the design solves, and gives the objectives we hold it to, marking which are measured and which are still estimates.

The three blocks

The three blocks of prty and who talks to whom The control plane sends commands to the data plane. The data plane pushes metrics and logs to monitoring. The Autopilot, part of the control plane, reads monitoring and decides when to act. The data plane's own decisions, such as electing a primary, never leave the data plane. Control plane API + durable operations: create, grow, upgrade, replace a member Autopilot: decides when (disk growth) Monitoring metrics + logs stores, status page fed by agents, read by the Autopilot and by operators Data plane: clusters, three members in three zones, no public address Primaryzone a Replicazone b Arbiterzone c: votes, no data commands metrics reads
Solid: a command or replication. Dashed: observation or voting. What keeps your data safe, voting and fencing and promotion, happens inside the data plane and uses nothing from the other two.

Data plane

The clusters. Three members in three zones that elect their own primary and fail over in about 30 s. Deep dives: creating a cluster, quorum and failover, minor upgrades.

Control plane

One management server per deployment: how it is rolled out, how operations survive failures, and the Autopilot that decides when to grow a disk.

Monitoring

An agent on every database machine pushes metrics and logs to stores on the management server. Fed by the data plane, read by the control plane, on neither’s critical path.

The split is the main idea. What must keep working during an outage lives in the data plane. What can wait lives in the control plane and monitoring. Losing the management server costs you changes, automation and dashboards; it does not take a database down.

Terms, and what they are on AWS

These pages use generic words. AWS is the only cloud prty runs on today, so this is what they mean there. Another cloud would need its own equivalents and its own reliability numbers worked out (reliability).

We sayOn AWS
VMEC2 instance
Persistent diskEBS volume, bound to one zone
ZoneAvailability Zone
Private networkVPC with one private subnet per zone
FirewallSecurity group; network ACL for the hard fence
Machine imageAMI, built with Packer
Private DNS nameRoute 53 private hosted zone
Volume cloneEBS volume created from a snapshot of another volume, usable at once while AWS fills it in
Host watchdogLinux softdog on the VM, which resets it if the sidecar stops answering
Cheap interruptible capacitySpot instances: used for tests only, never for customers’ databases

How to read the objectives

Every page ends with an objectives table. The last column says how much to trust a row:

  • Measured we have seen this number in a test, and say where.
  • Design the number follows from a timeout or a rule we set, and has not been separately timed.
  • Estimate our best guess. It says what to measure to replace it. Do not treat it as a commitment.

None of these is an SLA. The commitments we will and will not make are on the reliability page.