[surrealwolf]

CloudNativePG rolls every instance on operator upgrades and on spec changes that need a restart. With primaryUpdateMethod: restart the primary is restarted in place, so the database is down until it comes back. On 2026-10-04 that took Authentik SSO down for about 4 minutes (server pods hit their liveness probe while the primary restarted).

switchover updates the replicas first, then promotes an updated replica and only then recreates the old primary. Clients see one short reconnect (seconds).

This only changes the Cluster spec, not the pod template, so merging it does not roll any pods. It is a prerequisite for the CNPG operator upgrade 1.28.0 → 1.30.1 (rancher-deploy UPGRADE_PLAN item #3).

Cluster: high-command/high-command-postgres (prd-apps). The manifest mirrors live (Fleet adopted it), so only this one field changes.

---

Note

Low Risk
Single Cluster spec field with no immediate pod rollout; lowers outage risk during future CNPG-managed primary updates on production Postgres.

Overview
Sets primaryUpdateMethod on the high-command-postgres CloudNativePG cluster from restart to switchover, so future operator-driven primary updates roll replicas first, promote an updated replica, then rebuild the old primary instead of restarting the primary in place.

That avoids multi-minute primary downtime (e.g. Authentik SSO during a 2026-10-04 incident) in favor of a brief client reconnect. Merging only updates the Cluster spec—no pod template change—so it does not roll instances now; it prepares the cluster for the planned CNPG operator upgrade (1.28.0 → 1.30.1).

^{Reviewed by Cursor Bugbot for commit 8357295. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that signal was skipped, and no applicable approval policy required human review. This automation has no prior approval on the current head.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}