Dcdr cli - #837
Merged
Merged
Conversation
…tions Adds `kubectl dba dc-dr` with nine commands, each live-verified against a three data center cluster before documenting: switchover planned zero-RPO move of the primary role (hub) status one-shot state + step-by-step switchover progress (hub) abort abort an in-flight switchover via the explicit abort signal accept-data-loss release a failover held by the RPO budget, --yes required handoff move the failover authority; the scope-local failover lever pin-primary break-glass: this DC stays primary and writable, no failover pin-standby this DC never promotes active-dc who holds the primary role, read from the Lease itself debug failover / switchover / fence symptom walkers DC-DR spans three API surfaces, so each command states which it needs. The coordination control plane is a separate apiserver: its kubeconfig is resolved from a file, a ConfigMap, or a Secret (defaulting to the dc-failover/coord-kubeconfig the chart mints), via the shared --coord-* flags. The pin commands act on a spoke by design, which is why they still work when the hub is unreachable. Scope resolution mirrors the operator's own (PlacementPolicy failoverPolicy trigger, then the legacy annotation, then Global) so the CLI can never disagree with the controller about which Lease a database follows. Guards refuse an Arbiter or Witness target, a no-op self-target, an unconfirmed data-loss acceptance, and a handoff into a break-glass-pinned scope. Documented in docs/CLI.md with real captured output. Signed-off-by: Tamal Saha <tamal@appscode.com>
…-hold The override-hold annotation on the Lease is normally cleared only by the pinned DC's own agent when its override ConfigMap disappears. If that DC dies with the pin standing, the annotation persists and every handoff refuses, which blocks the deliberate promote-the-survivor runbook exactly when it is needed. --remove --force, run from any live cluster with the --coord-* flags, tolerates the failed ConfigMap delete and clears the annotation directly on the Lease. Refuses to run without a reachable coordination plane. Live-proven in the bank two-site dc-loss drill: handoff refused while the pin stood, force cleared it, dr acquired and promoted cleanly. Signed-off-by: Tamal Saha <tamal@appscode.com>
Signed-off-by: Tamal Saha <tamal@appscode.com>
Discard fmt.Fprint* return values explicitly, matching the repo's existing _, _ = convention, and simplify the pin-primary force guard per De Morgan (QF1001). Signed-off-by: Tamal Saha <tamal@appscode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.