High availability in-service software upgrade using virtual machine instances in dual computing appliances

A network device comprising one or more processors configured to operate as:

• a primary appliance;
• a secondary appliance;
• a first hypervisor that runs one or more virtual machines on the primary appliance;
• a second hypervisor that runs one or more virtual machines on the secondary appliance;
• a first primary virtual machine (VM) running on the primary appliance, wherein the first primary VM is configured to execute a first operating system that controls functionality of the primary appliance;
• and
• a second primary VM running on the secondary appliance, wherein the second primary VM is configured to execute the first operating system and provide high availability for the primary appliance,
• wherein, in response to receiving an in-service software upgrade (ISSU) request, the first hypervisor initializes a first secondary VM on the primary appliance and the second hypervisor initializes a second secondary VM on the secondary appliance, wherein each of the first secondary VM and the second secondary VM execute the first operating system,
• wherein the first hypervisor performs the ISSU on the primary appliance to upgrade the first secondary VM to a second operating system, switch control of the primary appliance from the first primary VM to the first secondary VM, and upgrade the first primary VM to the second operating system, wherein, during the ISSU of the primary appliance when the first primary VM and the first secondary VM on the primary appliance are executing different operating systems, the second primary VM executing the first operating system on the secondary appliance provides high availability for the primary appliance, and
• wherein, if the first primary VM on the primary appliance fails during the ISSU of the primary appliance when the first primary VM and the first secondary VM on the primary appliance are executing different operating systems, the first and second hypervisors switch control of the functionality of the primary appliance from the first primary VM on the primary appliance to the second primary VM on the secondary appliance, wherein the second secondary VM on the secondary appliance provides high availability for the secondary appliance.

A non-transitory, computer-readable storage medium comprising instructions that cause one or more programmable processors to:

• run a first primary virtual machine (VM) on a primary appliance of a network device, wherein the first primary VM executes a first operating system that controls functionality of the primary appliance;
• run a second primary VM on a secondary appliance of the network device, wherein the second primary VM on the secondary appliance executes the first operating system and provides high availability for the primary appliance;
• in response to receiving an in-service software upgrade (ISSU) request, initialize a first secondary VM on the primary appliance and a second secondary VM on the secondary appliance, wherein each of the first secondary VM and the second secondary VM execute the first operating system;
• perform the ISSU on the primary appliance by upgrading the first secondary VM on the primary appliance to a second operating system, switch control of the primary appliance from the first primary VM to the first secondary VM, and upgrade the first primary VM to the second operating system, wherein, during the ISSU of the primary appliance when the first primary VM and the first secondary VM on the primary appliance are executing different operating systems, the second primary VM executing the first operating system on the secondary appliance provides high availability for the primary appliance;
• and
• if the first primary VM on the primary appliance fails during the ISSU of the primary appliance when the first primary VM and the first secondary VM on the primary appliance are executing different operating systems, switch control of the functionality of the primary appliance from the first primary VM on the primary appliance to the second primary VM on the secondary appliance, wherein the second secondary VM on the secondary appliance provides high availability for the secondary appliance.