How to perform a switchover/failover

vmk8s

Charmed PostgreSQL constantly monitors the cluster status and performs automated failover in case the primary unit is gone.

Sometimes, a manual switchover is necessary for hardware maintenance reasons. Check the difference between them here.

A manual switchover is possible using Juju action promote-to-primary.

Charmed PostgreSQL has been designed for maximum guarantee of data survival in all corner cases. As such, allowed actions depend on the configured Juju unit state.

Switchover

To switchover the PostgreSQL Primary (write-endpoint) to new Juju unit, use Juju action promote-to-primary (on the unit <unit number>, which will be promoted as a new primary):

juju run postgresql/<unit number> promote-to-primary scope=unit

juju run postgresql-k8s/<unit number> promote-to-primary scope=unit

Note that:

  • a manual switchover is possible on the healthy sync standby unit only. Otherwise it will be rejected by Patroni with the reason explanation.

  • the Juju leader unit and PostgreSQL primary unit are normally pointing to different Juju units. Juju leader failover is fully automated and can be enforced for educational purpose only! Do not trigger Juju leader election to move the primary.

Failover

Charmed PostgreSQL doesn’t provide manual failover due to lack of data safety guarantees.

Advanced users can still execute it using patronictl and the Patroni REST API. The same time Charmed PostgreSQL allows the cluster recovery using the full PostgreSQL/Patroni/Raft cluster re-initialisation.

Raft re-initialisation (VM only)

vm

This is the worst possible recovery case scenario when Primary and ALL Sync Standby units lost simultaneously and their data cannot be recovered from the disc.

In this case, Patroni cannot perform automatic failover for the only available Replica(s) units. Still Patroni provides the read-only access to the data.

A manual failover procedure cannot guarantee the availability of the latest SQL transactions on the replica unit(s) due to the lag distance to the primary.

Additionally, Raft cluster consensus is not possible