Spanner Omni runs Google's database on customer-run infrastructure without an availability SLA

Spanner can run on a software clock because of how it already spends its waiting time. Google says the database does other work while it waits out clock uncertainty, so it can get by with looser uncertainty bounds than TrueTime actually achieves ^[5]. On that account, much of the atomic clocks' precision was margin Spanner did not use. Google spent that margin to keep time across heterogeneous hardware without, it says, limiting availability or performance ^[5]. This is good engineering. Paxos consensus, automatic sharding and synchronous replication carry over unchanged ^[6].

Google is just as direct about storage. The new file layer is not Colossus, the company says, but a sufficient stand-in to perform comparably to the managed service for most workloads ^[3]. Its internal benchmarks claim millions of queries per second across petabytes in a single regional deployment ^[7]. That is Google's number from Google's own runs ^[7]. For it to transfer, the software clock's error bound on your servers has to stay inside what the overlapped waits absorb. Your workload also has to be one of the "most workloads" in Google's caveat ^[3].

Carlos Pérez Martín, CTO at Q2BSTUDIO, put the operating consequence plainly. "The interesting shift is operational, not architectural: once the same engine runs in your racks, the failure domains become yours," he said ^[8]. His first example is topology. Quorum and witness placement has to be re-derived for the local latency budget, he said, and when a whole datacenter is the unit of failure, p99 latency, not the mean, is what the application feels ^[9].

Google's documentation reaches the same place. It gives customer-managed infrastructure as the reason Google offers no availability SLA, and says its reference architectures help achieve comparable high availability ^[12]. A reference architecture does not issue service credits. The multi-zone design needs at least three zones with three servers each, so nine servers is the minimum for that layout ^[19].

With general availability come audit logging, backup and restore, TLS encryption, and authentication and authorization, plus worker nodes: stateless compute that handles background operations so the primary servers don't have to ^[18]. The query languages carry over: GoogleSQL, PostgreSQL and Spanner Graph Language ^[17].

I think the pilot Pérez Martín proposes is the right first test, and I would add the software clock's measured error bound under production load to what it records ^[11]. "A like-for-like pilot against the managed service, measured on tail latency and ops toil instead of feature parity, is the cheapest way to price that trade," he said ^[11].