Storage Tiering Service  ·  View 07 of 31  ·  3 · Structure

Layered Architecture

Seven layers in dependency order. Callers sit above what they call, and the access layer shares no arrow with the two layers that decide and move.

Editable source SVG draw.io All views
Callers File service reads · uploads Export · eDiscovery bulk recall ML pipelines non-promoting Access and recall Placement resolver Go · bounded cache Read router ranges · pack offsets Placement API register · tombstone Recall service jobs · budgets Tiering control Classifier ClickHouse SQL Break-even evaluator Go · ladder maths Shadow runner 0 bytes moved Ring controller Temporal Movement Mover workers copy · verify · commit Pack builder seal · read back Budget authority $ and req/s leases Reconciler notify + scan Catalogue Placement catalogue Vitess · 64 shards Release gate delete identity Record and policy Event log Kafka · RF3 Analytics ClickHouse Decision records Parquet · Object Lock Policy and ladder Git · PostgreSQL Storage tiers Hot Ceph · NVMe Warm Ceph · HDD EC Cold · packed Ceph · dense HDD Archive · packed EOS + CTA · LTO resolve plans CAS commit Layered Architecture External / third party Interface / broker Application we own Decision point Security / platform Data store Queue / topic synchronous event / async No arrow from Access and recall reaches Tiering control or Movement. Remove both bands and every read still resolves. v 1.0 · owner Storage Platform Architecture · date 2026-09

Decisions

  • Tiering control and Movement sit between the access layer and the catalogue on the page, but no access component calls either. They could be deleted from the estate and reads would not notice for months.
  • The release gate lives beside the catalogue rather than in the movement layer, because deleting a source copy is conditional on committed catalogue state and on nothing else (ADR-29).
  • Records and policy is a layer of its own: four stores with four different recovery obligations, none of which is on the read path.

Deliberate omissions

  • Identity, key management and observability run under every layer and are drawn on views 28, 29 and 25.
  • The bytes a file service reads go straight from the read router to Ceph. The service does not proxy user traffic.

Risk

  • The read router is a library inside the file service, which means pack offsets and range translation ship with another team's release. It is versioned against the catalogue schema and tested against a corpus of real placements for that reason.
◀  Journey: Reverse a Bad Policy at 03:10 All views Container Architecture  ▶
Solution Architecture v1.0 · Storage Platform Architecture · 2026-09 · 31 views · open source, fully on-premises07-layered-architecture