Date: Thu, 25 Oct 2018 20:45:57 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
Cc: Nikolay Samokhvalov <samokhvalov@gmail.com>,
	pgsql-docs@lists.postgresql.org, pgsql-hackers@postgresql.org
Subject: Re: Using old master as new replica after clean switchover
Message-ID: <20181025114557.GB1327@paquier.xyz>
References: 
 <CANNMO+KYuH3Gh7BZp=UGXpoos4tBR0AFgoONkqWBrokuJthEug@mail.gmail.com>
 <20181025111551.620c6460@firost>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="LpQ9ahxlCli8rRTG"
Content-Disposition: inline
In-Reply-To: <20181025111551.620c6460@firost>
Precedence: bulk


--LpQ9ahxlCli8rRTG
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Oct 25, 2018 at 11:15:51AM +0200, Jehan-Guillaume de Rorthais wrote:
> On Thu, 25 Oct 2018 02:57:18 -0400
> Nikolay Samokhvalov <samokhvalov@gmail.com> wrote:
>> My research shows that some people already rely on the following when
>> planned failover (aka switchover) procedure, doing it in production:
>>=20
>>  1) shutdown the current master
>>  2) ensure that the "master candidate" replica has received all WAL data
>> including shutdown checkpoint from the old master
>>  3) promote the master candidate to make it new master
>>  4) configure recovery.conf on the old master node, while it's inactive
>>  5) start the old master node as a new replica following the new master.
>=20
> Indeed.

The important point here is that the primary will wait for the shutdown
checkpoint record to be replayed on the standbys before finishing to
shut down.

> The only additional nice step would be to be able to run some more safety=
 tests
> AFTER the switchover process on te old master. The only way I can think of
> would be to run pg_rewind even if it doesn't do much.

Do you have something specific in mind here?  I am curious if you're
thinking about things like page-level checks for LSN matches under some
threshold or such, because you should not have pages on the previous
primary which have LSNs newer than the point up to which the standby has
replayed.

>> if so, let's add it to the documentation, making it official. The patch =
is
>> attached.
>=20
> I suppose we should add the technical steps in a sample procedure?

If an addition to the docs is done, symbolizing the steps in a list
would be cleaner, with perhaps something in a dedicated section or a new
sub-section.  The failover flow you are mentioning is good practice
because that's safe, and there is always room for improvements in the
docs.
--
Michael

--LpQ9ahxlCli8rRTG
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlvRrPUACgkQnvQgOdby
QH2YEw//R9/eM3HIfverbYuff2hdOKsm3Xx4YrxHV9IG3xasRHhSg63ubqao30LM
lshVDqdu7e8AcmCndtCYkqZ66Ci+xdLVbBZ5HToChlBSDGHVCK74oHd43736U0cn
K/h47o16u8anVvJuB7yXdmpA3HjBOIOY/zn5B35NcAinuwSDgxZ2377I/Yz588SE
5bPtXOujEQt2yrTL7uJgln7ZquR8RxIPl4FaYdgfp+ddsqahN32vAWDNndSeBlCf
EZl9tLLXjQfo9aGhsFCq7BEbNnHAUB76ZaMuoPVYWglYK/zxYbyEERBHwJ8yAOeB
PxFDUzPOe2hAza2lBNFzeX5gxS5fm9i/1F4pQzBMiowhOxuvKuOQ4+7yp9u+MuO9
kmS3dNgcIsE+r198JwpkOz2T9/Yolftj+XdfkVu6oURaiP3f51Fs5gMKsgB/o2y+
TPIAxn/kdKQ+NhOtfxD9RZgE5JvHzq741ZC/Sw2KQ1LNnUSxKdUvhzglvALU2H+y
0hIaLSomF62i32TASsypQEDPz3Ico7uMUsmWDpeGPA5NfMYNeZ61SwHhGbxIzWTf
gHiDuaCW+c3qc7oBH145hjICypC+ggCpf+Xeds2/mvpWPZLHAJWvDmiruuvmBBXs
Ki+5H4voB7roYkjKr2VKkNpUINv4srRarkd2bI60bDhjBZ2WaWs=
=4Gen
-----END PGP SIGNATURE-----

--LpQ9ahxlCli8rRTG--