Share
Embed
Bolt-on Causal Consistency
pbailis
June 27, 2013
Transcript
190 slides
-
Causal Consistency Peter Bailis, Ali Ghodsi, Joseph M. Hellerstein, Ion
Stoica UC Berkeley Bolt on -
July 2000: CAP Conjecture A system facing network partitions must
choose between either availability or strong consistency -
July 2000: CAP Conjecture A system facing network partitions must
choose between either availability or strong consistency Theorem -
NoSQL Strong consistency is out! “Partitions matter, and so does
low latency” [cf. Abadi: PACELC] ...offer eventual consistency instead -
Eventual Consistency eventually all replicas agree on the same value
Extremely weak consistency model: -
Eventual Consistency eventually all replicas agree on the same value
Extremely weak consistency model: Any value can be returned at any given time ...as long as it’s eventually the same everywhere -
Eventual Consistency eventually all replicas agree on the same value
Extremely weak consistency model: Any value can be returned at any given time ...as long as it’s eventually the same everywhere Provides liveness but no safety guarantees Liveness: something good eventually happens Safety: nothing bad ever happens -
Do we have to give up safety if we want
availability? -
Do we have to give up safety if we want
availability? ? -
Do we have to give up safety if we want
availability? ? No! There’s a spectrum of models. -
Do we have to give up safety if we want
availability? ? No! There’s a spectrum of models. -
Do we have to give up safety if we want
availability? ? No! There’s a spectrum of models. UT Austin TR: No model stronger than Causal Consistency is achievable with HA -
Why Causal Consistency? Highly available, low latency operation Long-identified useful
“session” model Natural fit for many modern apps [Bayou Project, 1994-98] [UT Austin 2011 TR] -
Dilemma! Eventual consistency is the lowest common denominator across systems...
...yet eventual consistency is often insufficient for many applications... -
Dilemma! Eventual consistency is the lowest common denominator across systems...
...and no production-ready storage systems offer highly available causal consistency. ...yet eventual consistency is often insufficient for many applications... -
In this talk... show how to upgrade existing stores to
provide HA causal consistency -
In this talk... show how to upgrade existing stores to
provide HA causal consistency Approach: bolt on a narrow shim layer to upgrade eventual consistency -
In this talk... show how to upgrade existing stores to
provide HA causal consistency Approach: bolt on a narrow shim layer to upgrade eventual consistency Outcome: architecturally separate safety and liveness properties -
Consistency-related Safety Mostly algorithmic Small code base Separation of Concerns
Shim handles: Consistency/visibility -
Consistency-related Safety Mostly algorithmic Small code base Separation of Concerns
Shim handles: Consistency/visibility Underlying store handles: Messaging/propagation Durability/persistence Failure-detection/handling -
Consistency-related Safety Mostly algorithmic Small code base Separation of Concerns
Shim handles: Consistency/visibility Liveness and Replication Lots of engineering Reuse existing efforts! Underlying store handles: Messaging/propagation Durability/persistence Failure-detection/handling -
Consistency-related Safety Mostly algorithmic Small code base Separation of Concerns
Shim handles: Consistency/visibility Liveness and Replication Lots of engineering Reuse existing efforts! Underlying store handles: Messaging/propagation Durability/persistence Failure-detection/handling Guarantee same (useful) semantics across systems! Allows portability, modularity, comparisons -
Bolt-on Architecture Bolt-on shim layer upgrades the semantics of an
eventually consistent data store Clients only communicate with shim Shim communicates with one of many different eventually consistent stores (generic) -
Bolt-on Architecture Bolt-on shim layer upgrades the semantics of an
eventually consistent data store Clients only communicate with shim Shim communicates with one of many different eventually consistent stores (generic) Treat EC store as “storage manager” of distributed DBMS -
Bolt-on Architecture Bolt-on shim layer upgrades the semantics of an
eventually consistent data store Clients only communicate with shim Shim communicates with one of many different eventually consistent stores (generic) Treat EC store as “storage manager” of distributed DBMS for now, an extreme: unmodified EC store -
What is Causal Consistency? Reads obey: 1.) Writes Follow Reads
(“happens-before”) 2.) Program order 3.) Transitivity [Lamport 1978] -
What is Causal Consistency? Reads obey: 1.) Writes Follow Reads
(“happens-before”) 2.) Program order 3.) Transitivity [Lamport 1978] Here, applications explicitly define happens-before for each write (“explicit causality”) [Ladin et al. 1990, cf. Bailis et al. 2012] -
What is Causal Consistency? Reads obey: 1.) Writes Follow Reads
(“happens-before”) 2.) Program order 3.) Transitivity [Lamport 1978] Here, applications explicitly define happens-before for each write (“explicit causality”) [Ladin et al. 1990, cf. Bailis et al. 2012] First Tweet Reply to Alex -
What is Causal Consistency? Reads obey: 1.) Writes Follow Reads
(“happens-before”) 2.) Program order 3.) Transitivity [Lamport 1978] Here, applications explicitly define happens-before for each write (“explicit causality”) [Ladin et al. 1990, cf. Bailis et al. 2012] First Tweet Reply to Alex happens-before -
1.) Representing Order Two Tasks: How do we efficiently store
causal ordering in the EC system? 2.) Controlling Order How do we control the visibility of new updates to the EC system? -
1.) Representing Order Two Tasks: How do we efficiently store
causal ordering in the EC system? 2.) Controlling Order How do we control the visibility of new updates to the EC system? -
1.) Representing Order Two Tasks: How do we efficiently store
causal ordering in the EC system? 2.) Controlling Order How do we control the visibility of new updates to the EC system? -
1.) Representing Order Two Tasks: How do we efficiently store
causal ordering in the EC system? 2.) Controlling Order How do we control the visibility of new updates to the EC system? -
Strawman: use vector clocks Representing Order First Tweet :0 {
} :1, :1 { } :1, Reply-to Alex [e.g., Bayou, Causal Memory] -
Strawman: use vector clocks Representing Order First Tweet :0 {
} :1, :1 { } :1, Reply-to Alex Problem? Given missing dependency (from vector), what key should we check? [e.g., Bayou, Causal Memory] -
Strawman: use vector clocks Representing Order First Tweet :0 {
} :1, :1 { } :1, Reply-to Alex Problem? Given missing dependency (from vector), what key should we check? If I have <3,1>; where is <2,1>? <1,1>? Write to same key? Write to different key? Which? [e.g., Bayou, Causal Memory] -
Strawman: use dependency pointers First Tweet A @ timestamp 1092,
dependencies = {} Representing Order [e.g., Lazy Replication, COPS] -
Strawman: use dependency pointers First Tweet A @ timestamp 1092,
dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order [e.g., Lazy Replication, COPS] -
Strawman: use dependency pointers Problem? First Tweet A @ timestamp
1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order [e.g., Lazy Replication, COPS] -
Strawman: use dependency pointers Problem? First Tweet A @ timestamp
1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 [e.g., Lazy Replication, COPS] -
C@3 A@1 Strawman: use dependency pointers Problem? First Tweet A
@ timestamp 1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 B@2 [e.g., Lazy Replication, COPS] -
C@3 A@1 Strawman: use dependency pointers Problem? First Tweet A
@ timestamp 1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 B@2 [e.g., Lazy Replication, COPS] -
C@3 A@1 Strawman: use dependency pointers Problem? First Tweet A
@ timestamp 1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 B@2 [e.g., Lazy Replication, COPS] -
C@3 A@1 Strawman: use dependency pointers Problem? First Tweet A
@ timestamp 1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 B@7 [e.g., Lazy Replication, COPS] -
C@3 A@1 Strawman: use dependency pointers Problem? First Tweet A
@ timestamp 1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 B@7 [e.g., Lazy Replication, COPS] -
C@3 A@1 Strawman: use dependency pointers Problem? First Tweet A
@ timestamp 1092, dependencies = {} Reply-to Alex B @ timestamp 1109, dependencies={A@1092} Representing Order A@1→B@2→C@3 B@7 single pointers can be overwritten! [e.g., Lazy Replication, COPS] -
Strawman: use dependency pointers Representing Order single pointers can be
overwritten “overwritten histories” Strawman: use vector clocks don’t know what items to check -
Strawman: use dependency pointers Representing Order single pointers can be
overwritten “overwritten histories” Strawman: use vector clocks don’t know what items to check Strawman: use N2 items for messaging -
Strawman: use dependency pointers Representing Order single pointers can be
overwritten “overwritten histories” Strawman: use vector clocks don’t know what items to check Strawman: use N2 items for messaging highly inefficient! -
Representing Order Solution: store metadata about causal cuts short answer:
consistent cut applied to data items; not quite the transitive closure -
short answer: consistent cut applied to data items; not quite
the transitive closure Representing Order Solution: store metadata about causal cuts -
short answer: consistent cut applied to data items; not quite
the transitive closure Representing Order Solution: store metadata about causal cuts A@1→B@2→C@3 Causal cut for C@3: {B@2, A@1} -
short answer: consistent cut applied to data items; not quite
the transitive closure Representing Order Solution: store metadata about causal cuts A@1→B@2→C@3 Causal cut for C@3: {B@2, A@1} A@6→B@17→C@20 A@10→B@12 Causal cut for C@20: {B@17, A@10} -
Two Tasks: 1.) Representing Order How do we efficiently store
causal ordering in the EC system? 2.) Controlling Order How do we control the visibility of new updates to the EC system? -
Two Tasks: 1.) Representing Order 2.) Controlling Order How do
we control the visibility of new updates to the EC system? Shim stores causal cut summary along with every key due to overwrites and “unreliable” delivery -
Two Tasks: 1.) Representing Order 2.) Controlling Order How do
we control the visibility of new updates to the EC system? Shim stores causal cut summary along with every key due to overwrites and “unreliable” delivery -
Controlling Order Standard technique: reveal new writes to readers only
when dependencies have been revealed Inductively guarantee clients read from causal cut -
Controlling Order Standard technique: reveal new writes to readers only
when dependencies have been revealed Inductively guarantee clients read from causal cut In bolt-on causal consistency, two challenges: -
Controlling Order Standard technique: reveal new writes to readers only
when dependencies have been revealed Inductively guarantee clients read from causal cut In bolt-on causal consistency, two challenges: Each shim has to check dependencies manually Underlying store doesn’t notify clients of new writes -
Controlling Order Standard technique: reveal new writes to readers only
when dependencies have been revealed Inductively guarantee clients read from causal cut In bolt-on causal consistency, two challenges: Each shim has to check dependencies manually Underlying store doesn’t notify clients of new writes EC store may overwrite “stable” cut Clients need to cache relevant cut to prevent overwrites -
Controlling Order Standard technique: reveal new writes to readers only
when dependencies have been revealed Inductively guarantee clients read from causal cut In bolt-on causal consistency, two challenges: Each shim has to check dependencies manually Underlying store doesn’t notify clients of new writes EC store may overwrite “stable” cut Clients need to cache relevant cut to prevent overwrites -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut SHIM -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut SHIM EC Store -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} read(A) -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} read(A) A@1092, deps={} -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} read(A) A@1092, deps={} B@1109 -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} read(A) A@1092, deps={} B@1109 -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} A@1092, deps={} -
Each shim has to check dependencies manually EC store may
overwrite “stable” cut read(B) SHIM EC Store read(B) B@1109, deps={A@1092} A@1092, deps={} Cache this value for A! EC store might overwrite it with “unresolved” write -
1.) Representing Order Two Tasks: 2.) Controlling Order How do
we control the visibility of new updates to the EC system? Shim stores causal cut summary along with every key due to overwrites and “unreliable” delivery -
1.) Representing Order Two Tasks: 2.) Controlling Order Shim performs
dependency checks for client, caches dependencies Shim stores causal cut summary along with every key due to overwrites and “unreliable” delivery -
UpgradeD CASSANDRA to Causal consistency 322 lines Java for CORE
Safety Custom serialization Client-side caching -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile -
Dataset Chain Length Message Depth Serialized Size (b) Twitter 2
4 169 Flickr 3 5 201 Metafilter 6 18 525 TUAW 13 8 275 Median Twitter 40 230 5407 Flickr 44 100 2447 Metafilter 170 870 19375 TUAW 62 100 2438 99th percentile Most chains are small Metadata often < 1KB Power laws mean some chains are difficult -
Strategy 1: Resolve dependencies at read time Often (but not
always) within 40% of eventual Long chains hurt throughput -
Strategy 1: Resolve dependencies at read time Often (but not
always) within 40% of eventual Long chains hurt throughput N.B. Locality in YCSB workload greatly helps read performance; dependencies (or replacements) often cached (used 100x default # keys, but still likely to have concurrent write in cache) -
A thought... Causal consistency trades visibility for safety How far
can we push this visibility? -
SHIM EC Store What if we serve entirely from cache
and fetch new data asynchronously? -
read(B) SHIM EC Store What if we serve entirely from
cache and fetch new data asynchronously? -
read(B) SHIM EC Store B from cache What if we
serve entirely from cache and fetch new data asynchronously? -
read(B) SHIM EC Store read(B) B from cache What if
we serve entirely from cache and fetch new data asynchronously? -
read(B) SHIM EC Store read(B) B@1109, deps=... B from cache
What if we serve entirely from cache and fetch new data asynchronously? -
read(B) SHIM EC Store read(B) B@1109, deps=... read(A) B from
cache What if we serve entirely from cache and fetch new data asynchronously? -
read(B) SHIM EC Store read(B) B@1109, deps=... read(A) A@1092, deps={}
B from cache What if we serve entirely from cache and fetch new data asynchronously? -
read(B) SHIM EC Store read(B) B@1109, deps=... read(A) A@1092, deps={}
B from cache What if we serve entirely from cache and fetch new data asynchronously? EC store reads are async -
A thought... Causal consistency trades visibility for safety How far
can we push this visibility? What if we serve reads entirely from cache and fetch new data asynchronously? -
A thought... Causal consistency trades visibility for safety How far
can we push this visibility? What if we serve reads entirely from cache and fetch new data asynchronously? Continuous trade-off space between dependency resolution depth and fast-path latency hit -
Throughput exceeds eventual configuration Still causally consistent, more stale reads
Strategy 2: Fetch dependencies asynchronously -
Sync Reads Async Reads Reading from cache is fast; linear
speedup ...but not reading most recent data... ...in this case, effectively a straw-man. -
Lessons Causal consistency is achievable without modifications to existing stores
represent and control ordering between updates EC is “orderless” until convergence trade-off between visibility and ordering -
Lessons Causal consistency is achievable without modifications to existing stores
works well for workloads with small causal histories, good temporal locality represent and control ordering between updates EC is “orderless” until convergence trade-off between visibility and ordering -
Rethinking the EC API Uncontrolled overwrites increased metadata and local
storage requirements Clients had to check causal dependencies independently, with no aid from EC store -
Rethinking the EC API What if we eliminated overwrites? via
multi-versioning, conditional updates or immutability -
Rethinking the EC API What if we eliminated overwrites? via
multi-versioning, conditional updates or immutability No more overwritten histories Decrease metadata Still have to check for dependency arrivals -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? put( after converges) -
Rethinking the EC API What if the EC store notified
us when dependencies converged (arrived everywhere)? Wait to place writes in shared EC store until dependencies have converged No need for metadata No need for additional checks Ensure durability with client-local EC storage -
Multi-versioning or Conditional Update Stable Callback Reduces Metadata YES YES
No Dependency Checks NO YES -
Multi-versioning or Conditional Update Stable Callback Reduces Metadata YES YES
No Dependency Checks NO YES -
Multi-versioning or Conditional Update Stable Callback Reduces Metadata YES YES
No Dependency Checks NO YES -
Multi-versioning or Conditional Update Stable Callback Reduces Metadata YES YES
No Dependency Checks NO YES Data Store Multi-versioning or Conditional Update Stable Callback Amazon DynamoDB YES NO Amazon S3 NO NO Amazon SimpleDB YES NO Amazon Dynamo YES NO Cloudant Data Layer YES NO Google App Engine YES NO Apache Cassandra NO NO Apache CouchDB YES NO Basho Riak YES NO LinkedIn Voldemort YES NO MongoDB YES NO Yahoo! PNUTS YES NO ...not (yet) common to all stores -
Rethinking the EC API Our extreme approach (unmodified EC store)
definitely impeded efficiency (but is portable) Opportunities to better define surgical improvements to API for future stores/shims! -
Bolt-on Causal Consistency Modular, “bolt-on” architecture cleanly separates safety and
liveness upgraded EC (all liveness) to causal consistency, preserving HA, low latency, liveness Challenges: overwrites, managing causal order -
Bolt-on Causal Consistency Modular, “bolt-on” architecture cleanly separates safety and
liveness upgraded EC (all liveness) to causal consistency, preserving HA, low latency, liveness Challenges: overwrites, managing causal order large design space: took an extreme here, but: room for exploration in EC API bolt-on transactions? -
(Some) Related Work • S3 DB [SIGMOD 2008]: foundational prior
work building on EC stores, not causally consistent, not HA (e.g., RYW implementation), AWS- dependent (e.g., assumes queues) • 28msec architecture [SIGMOD Record 2009]: like SIGMOD 2008, treat EC stores as cheap storage • Cloudy [VLDB 2010]: layered approach to data management, partitioning, load balancing, messaging in middleware; larger focus: extensible query model, storage format, routing, etc. • G-Store [SoCC 2010]: provide client and middleware implementation of entity-grouped linearizable transaction support • Bermbach et al. middleware [IC2E 2013]: provides read-your-writes guarantees with caching • Causal Consistency: Bayou [SOSP 1997], Lazy Replication [TOCS 1992], COPS [SOSP 2011], Eiger [NSDI 2013], ChainReaction [EuroSys 2013], Swift [INRIA] are all custom solutions for causal memory [Ga Tech 1993] (inspired by Lamport [CACM 1978])