Microservices prefer letting each service manage its own database, either different instances of the same database technology, or entirely different database systems - an approach called Polyglot Persistence.
Microservice architectures are doomed to become inconsistent after disaster strikes
How do you back up a monolith?
How do you back up one microservice?
How do you back up an entire microservice architecture?
Are you sure?
Example
Data relationships across microservices = Hypermedia
Independent Backup
Backups taken independently at different times
Disaster Strikes
Disaster Strikes
One microservice is lost
Recovery from Backup
Broken link after recovery
Eventual Inconsistency
Synchronized Backups
Backups of all microservices taken at the same time.
Limited Availability
No updates allowed anywhere while backing up the microservices
The BAC theorem
When Backing up a microservice architecture, it is not possible to have both Consistency and Availability
Consistency
During normal operations, each microservice will eventually reach a consistent state
Referential integrity: links across microservice boundaries are guaranteed not to be broken
Availability
It is possible to both read and update the state of any microservice at any time
Backup
While backing up the system, is it possible to take a consistent snapshot of all microservices without affecting their availability?
No.
Backup + Availability
Backing up each microservice independently will eventually lead to inconsistency after recovering from backups taken at different times
Backup + Consistency
Taking a consistent backup requires to:
disallow updates anywhere during the backup (limited availability)
wait for the slowest microservice to complete the backup
agree among all microservices on when to perform the backup
Shared Database
A centralized, shared database would require only one backup
Is this still a microservice architecture?
Shared Database, Split Schema
A centralized, shared database would require only one backup
Each microservice must use a logically separate schema
What happened to polyglot persistence?
Links can break
No guarantees for references crossing microservice boundaries
Microservices inherit a fundamental property of the Web
Splitting the Monolith
Keep data together for microservices that cannot tolerate eventual inconsistency
Unstoppable System
An expensive, replicated database with high-availability for every microservice
Unstoppable System
How do you restart an unstoppable system?
Does it apply to you?
More than one stateful microservice
Polyglot persistence
Cross-microservice references
Disaster recovery based on backup/restore
Independent backups
Eventual inconsistency (after disaster recovery)
Does it apply to you?
More than one stateful microservice
Polyglot persistence
Cross-microservice references
Disaster recovery based on backup/restore
Synchronized backups (limited availability)
Consistent Disaster Recovery
Eventual Consistency
Retries are enough to deal with temporary failures of read operations, eventually the missing data will be found
Eventual Inconsistency
Retries are useless to deal with permanent failures of read operations, which used to work just fine before disaster recovery
The BAC Theorem
The BAC Theorem
When Backing up a whole microservice architecture, it is not possible to have both Consistency and Availability
Corollaries
Microservice architectures eventually become inconsistent after disaster strikes when recovering from independent backups
Achieving consistent backups can be attempted by limiting the full availability of the system and synchronizing the backups
References
Guy Pardon, Cesare Pautasso, Olaf Zimmermann, Consistent Disaster Recovery for Microservices: the BAC Theorem, IEEE Cloud Computing, Accepted October 2017, To Appear (Pre-print doi: 10.1109/MCC.2017.455154634)
Guy Pardon, Olaf Zimmermann, Frank Leymann, Florian Haupt, Silvia Schreier, Ana Ivanchikj, Mathias Weske, Adriatik Nikaj, Sankalita Mandal, Hagen Overdick, Jesus Bellido, Rosa Alarcón, Alessio Gambi, Daniele Bonetta, Achille Peternier, Erik Wilde, Mike Amundsen, Stefan Tilkov, James Lewis