Filestore now offers asynchronous replication for your instances.

A source instance can be continuously and asynchronously replicated to astandby instance in a location of your choice.

To select customers, Filestore offers instance replication support forinstances created in the followingservice tiers:

• Zonal
• Regional
• Enterprise

Instance replication compared to other data recovery options

The following sections cover the advantages of instance replication compared tosnapshots and backups.

Snapshots

Snapshots are resources that consume capacitywithin the instance and allow you to revert the current state of your instancedata to a previous, specific point in time. Users can also elect to revert to aprevious version of a specific file.

Snapshots don't replicate any data or consume capacity until the data on theinstance is modified. All snapshots of an instance share in-common data, meaningthat the instance preserves only the differences between the snapshots.

While snapshots do offer cost efficiency when compared to other Filestoredata recovery operations, available instance capacity continuously decreases asfile modifications are made.

Reverting an instance to a previous state is destructive, as it deletes thelatest version of instance data, and should be used carefully.

Backups

Backups are external resources that reside outsideof the instance, consuming their own separate capacity. The first backup is acomplete copy of instance data, with each subsequent backup only consuming thedata necessary to trackincremental and differentialchanges since the previous backup. Internally, abackup chain'shistory is tracked using snapshots, which consume capacity on the sourceinstance.

Instance replication

Instance replication pairs a source instance with a replica instance,a separate resource in a secondary location that continuously monitors anychanges made to the source and asynchronously replicates those changes to thereplica instance within a targetrecovery point objective (RPO)of approximately 30 minutes.

This process relies on snapshots and similarly consumes capacity. As snapshotsbecome obsolete, they are deleted to free up instance capacity in both instances.

The replica instance is a continuously updated, complete copy of the sourceinstance. Most copies are scheduled every five to ten minutes. Metrics areavailable indicating the timestamp of the last full instance copy. For moreinformation, seeMonitoring.

Instance pair roles

When instance replication is enabled, each instance in the pair is assigned arole:

• ACTIVE

  The source instance.

• STANDBY

  The replica instance.

Role changes are not automatic and can only be initiated by the user.

Pause and resume replication

When the replication is paused, the replica's instance status changes fromSTANDBY toACTIVE based on the most recent successful data point.

When you resume replication, the client access to the replica is removed, and theinstance reverts to its original data point, deleting all test data. After this,standard replication from the active instance restarts. Resuming replicationmight take longer for initial synchronization, depending on the pause duration and the number of changes on the active instance.

For more information, seePause replication andResume replication.

Promote replica

While the replica instance can't be mounted or written to directly, in the eventof a service outage, the replica can perform apromote-replicaoperation. This same operation is accessible from the Google Cloud console.

This operation initiates the following actions:

• Stops replication between theACTIVE andSTANDBY instances.
• Unpairs the two resources.
• Promotes the replica to a regular instance that is capable of clientconnections and writes just as any other instance.
• The replication role, whetherACTIVE orSTANDBY, is removed from bothinstances.
• When the operation successfully completes, the replica instance's state changesfromPROMOTING toREADY.

Once your application is back online, this new source instance can then bepaired with a new replica and you can initiate instance replication once again.

For more information, seeBreak replication and promote replica.

Promote a paused replica

Promoting a paused replica is useful for disaster recovery if the active instance becomes unavailable. When you promote a paused replica, the instance reverts to the last completed data point, deleting all test data.

The replica instance synchronizes any remaining data in transit from the source instance and becomes a new active instance. Promoting a replica means a break in the replication process. As a result, the original replication link is severed and replication can't be resumed.

Failback

Thepromote-replica operation initiates a break in replication. It is aswitchover not a failover event, meaning thatfailback isn't automatic. Once the operation is complete, administrators mustreconnect their applications to the new source instance.

Limitations

The following limitations apply:

• Instance replication is not available in the following service tiers:

  • Basic HDD
  • Basic SSD

• The following specifications must be the same for each instance in the pair:

  • Project
  • Service tier, including capacity range

The following sections cover other feature limitations related to RPO, operations,network traffic, performance, and availability in detail:

RPO

• Quoted RPO times are approximate and not supported under anyFilestore service level agreement (SLA).

• The target 30-minute RPO applies to instances with a change rate of100 MB per second and an IOPS rate of 300 per second, where IOPS aredefined as anycreate,edit, ordelete operation applied to any file ordirectory.

  Instances with a higher change rate may experience longer replication periods.RPO times vary and don't strictly map linearly with higher change rates. Forexample, if the change rate doubles, the RPO window won't necessarily double.

• Instance replication is specified at instance creation. If you want to pair areplica with a source instance, you must enable instance replication on theinstance when creating it, and then pair it with the replica. An existinginstance can't be used as a replica.

Operations

• The following operations are disabled on theACTIVE instance:

  • Instance deletion
  • Revert to snapshot

• The following limitations apply to theSTANDBY instance:

  • Doesn't support NFS access
  • Backups are disabled
  • Snapshots are disabled

Network traffic

• Continuous data replication between the source and replica instances accruesnetwork traffic fees. For more information, seeFilestore pricing or your Filestorerepresentative.

Performance

• Continuous data replication between the pair impacts IOPS performance on thesource instance.

Availability

• Some restrictions apply when choosing a region for your replica instance. Formore information, see your Filestore representative.

• Deleting the source instance won't delete its associated replica. If thesource instance no longer exists, and you want to delete the instancepreviously used as its replica, usegcloud to locate and delete the instance.

Recommendations

For a robust disaster recovery solution, users are strongly encouraged to choosea separate region rather than a separate zone for the replica instance.

Monitoring

Thetime_since_last_replication metric represents the timestamp of the lastfull copy of the active instance.

For more information, see the following resources:

• Monitor instance replication
• Monitoring instances
• Filestore metrics

Pricing

When you use instance replication, charges for instances and cross-regionnetworking apply. Replicating instances is offered at no additional charge. Thereplica instance is a continuously updated, complete copy of the sourceinstance. Pricing is commensurate with the data recovery support provided in acontinuous data recovery option suitable for enterprise workloads.

For more information, see your Filestore representative.

What's next

• Configure instance replication
• Instance replication reference documentation