From 76f408e31367fce83e926793c6286e09e59ae228 Mon Sep 17 00:00:00 2001 From: 1gtm <1gtm@appscode.com> Date: Sat, 8 Aug 2026 04:40:16 +0000 Subject: [PATCH] Update docs for kubedb/cli@0787f602 Signed-off-by: 1gtm <1gtm@appscode.com> --- docs/reference/cli/kubectl-dba.md | 1 + docs/reference/cli/kubectl-dba_dc-dr.md | 68 +++++++++++++++ docs/reference/cli/kubectl-dba_dc-dr_abort.md | 69 +++++++++++++++ .../cli/kubectl-dba_dc-dr_accept-data-loss.md | 74 ++++++++++++++++ .../cli/kubectl-dba_dc-dr_active-dc.md | 82 ++++++++++++++++++ docs/reference/cli/kubectl-dba_dc-dr_debug.md | 62 ++++++++++++++ .../cli/kubectl-dba_dc-dr_debug_failover.md | 77 +++++++++++++++++ .../cli/kubectl-dba_dc-dr_debug_fence.md | 71 ++++++++++++++++ .../cli/kubectl-dba_dc-dr_debug_switchover.md | 67 +++++++++++++++ .../cli/kubectl-dba_dc-dr_handoff.md | 82 ++++++++++++++++++ .../cli/kubectl-dba_dc-dr_pin-primary.md | 84 +++++++++++++++++++ .../cli/kubectl-dba_dc-dr_pin-standby.md | 80 ++++++++++++++++++ .../reference/cli/kubectl-dba_dc-dr_status.md | 69 +++++++++++++++ .../cli/kubectl-dba_dc-dr_switchover.md | 72 ++++++++++++++++ .../cli/kubectl-dba_remote-config_postgres.md | 18 ++-- 15 files changed, 970 insertions(+), 6 deletions(-) create mode 100644 docs/reference/cli/kubectl-dba_dc-dr.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_abort.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_accept-data-loss.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_active-dc.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_debug.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_debug_failover.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_debug_fence.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_debug_switchover.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_handoff.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_pin-primary.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_pin-standby.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_status.md create mode 100644 docs/reference/cli/kubectl-dba_dc-dr_switchover.md diff --git a/docs/reference/cli/kubectl-dba.md b/docs/reference/cli/kubectl-dba.md index 4e2bd270b5..a09c8995dc 100644 --- a/docs/reference/cli/kubectl-dba.md +++ b/docs/reference/cli/kubectl-dba.md @@ -60,6 +60,7 @@ kubectl-dba [flags] * [kubectl-dba completion](/docs/reference/cli/kubectl-dba_completion.md) - Generate completion script * [kubectl-dba connect](/docs/reference/cli/kubectl-dba_connect.md) - Connect to a database. * [kubectl-dba data](/docs/reference/cli/kubectl-dba_data.md) - Insert, Drop or Verify data in a database +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis * [kubectl-dba debug](/docs/reference/cli/kubectl-dba_debug.md) - Debug any Database issue * [kubectl-dba describe](/docs/reference/cli/kubectl-dba_describe.md) - Show details of a specific resource or group of resources * [kubectl-dba exec](/docs/reference/cli/kubectl-dba_exec.md) - Execute script or command to a database. diff --git a/docs/reference/cli/kubectl-dba_dc-dr.md b/docs/reference/cli/kubectl-dba_dc-dr.md new file mode 100644 index 0000000000..615df301e4 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr.md @@ -0,0 +1,68 @@ +--- +title: Kubectl-Dba Dc-Dr +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr + name: Kubectl-Dba Dc-Dr + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr + +Cross data center DR operations: switchover, failover, pins, and diagnosis + +### Synopsis + +Operate a KubeDB database that is distributed across data centers: trigger and monitor planned switchovers, accept a held failover's data loss, move the failover authority, pin a data center, and diagnose a failover that is not happening. + +``` +kubectl-dba dc-dr +``` + +### Options + +``` + -h, --help help for dc-dr +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba](/docs/reference/cli/kubectl-dba.md) - kubectl plugin for KubeDB +* [kubectl-dba dc-dr abort](/docs/reference/cli/kubectl-dba_dc-dr_abort.md) - Abort an in-flight planned switchover and restore writes to the current active DC +* [kubectl-dba dc-dr accept-data-loss](/docs/reference/cli/kubectl-dba_dc-dr_accept-data-loss.md) - Release a failover held by the RPO budget, explicitly accepting the data loss +* [kubectl-dba dc-dr active-dc](/docs/reference/cli/kubectl-dba_dc-dr_active-dc.md) - Print the data center that currently holds the primary role +* [kubectl-dba dc-dr debug](/docs/reference/cli/kubectl-dba_dc-dr_debug.md) - Diagnose DC-DR symptoms: failover not happening, switchover stuck, fenced database +* [kubectl-dba dc-dr handoff](/docs/reference/cli/kubectl-dba_dc-dr_handoff.md) - Move the failover authority for a scope by handing off its primary-DC Lease +* [kubectl-dba dc-dr pin-primary](/docs/reference/cli/kubectl-dba_dc-dr_pin-primary.md) - Pin this data center as primary (break-glass override): no failover, writable through a control-plane outage +* [kubectl-dba dc-dr pin-standby](/docs/reference/cli/kubectl-dba_dc-dr_pin-standby.md) - Pin this data center as a standby (standby-hold): it never promotes +* [kubectl-dba dc-dr status](/docs/reference/cli/kubectl-dba_dc-dr_status.md) - Show DC-DR state and switchover progress once (re-run to see further progress) +* [kubectl-dba dc-dr switchover](/docs/reference/cli/kubectl-dba_dc-dr_switchover.md) - Trigger a planned zero-RPO switchover of a distributed database to another data center + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_abort.md b/docs/reference/cli/kubectl-dba_dc-dr_abort.md new file mode 100644 index 0000000000..a014a43b4d --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_abort.md @@ -0,0 +1,69 @@ +--- +title: Kubectl-Dba Dc-Dr Abort +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-abort + name: Kubectl-Dba Dc-Dr Abort + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr abort + +Abort an in-flight planned switchover and restore writes to the current active DC + +### Synopsis + +Sets the dr.kubedb.com/switchover-abort annotation. Its PRESENCE aborts: the hub clears the quiesce so the original active data center resumes accepting writes, and removes every switchover annotation once done. + + Do NOT abort by deleting the switchover-to annotation: in a scope shared by several databases the hub re-propagates it to every sibling each pass, so a bare removal silently reappears. This explicit abort signal is propagated and honored scope-wide. A switchover that cannot complete also auto-aborts on its own after the switchover timeout (default 10m, dr.kubedb.com/switchover-timeout to override). + + KUBECONFIG: the hub cluster. + +``` +kubectl-dba dc-dr abort DB_NAME [flags] +``` + +### Examples + +``` + kubectl dba dc-dr abort pg-dcdr -n demo +``` + +### Options + +``` + -h, --help help for abort +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_accept-data-loss.md b/docs/reference/cli/kubectl-dba_dc-dr_accept-data-loss.md new file mode 100644 index 0000000000..80437bc7f6 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_accept-data-loss.md @@ -0,0 +1,74 @@ +--- +title: Kubectl-Dba Dc-Dr Accept-Data-Loss +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-accept-data-loss + name: Kubectl-Dba Dc-Dr Accept-Data-Loss + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr accept-data-loss + +Release a failover held by the RPO budget, explicitly accepting the data loss + +### Synopsis + +When the surviving data center lags more than spec.replication.bestEffortCrossDCLagBytesForFailover (or its lag cannot be measured), the promotion is HELD: the un-replicated WAL of the lost data center is unrecoverable, so choosing between an outage and a loss larger than the budget belongs to a human. This command records that decision by setting dr.kubedb.com/accept-failover-data-loss=true; both promotion paths (the hub gate and the coordinator's data-plane gate) honor it within seconds, and the operator removes the annotation automatically once the failover it authorized lands, so it cannot linger and approve a later, unrelated loss. + + Where the hold is visible before you decide: status.disasterRecovery.protectionMessage (the measured lag), condition DCDRPromotionStalled, and dc-dr status. + + KUBECONFIG: the hub cluster. + +``` +kubectl-dba dc-dr accept-data-loss DB_NAME --yes [flags] +``` + +### Examples + +``` + # See what would be lost first + kubectl dba dc-dr status pg-dcdr -n demo + + # Accept it + kubectl dba dc-dr accept-data-loss pg-dcdr -n demo --yes +``` + +### Options + +``` + -h, --help help for accept-data-loss + --yes Confirm accepting data loss beyond the configured RPO budget +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_active-dc.md b/docs/reference/cli/kubectl-dba_dc-dr_active-dc.md new file mode 100644 index 0000000000..7e3794038b --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_active-dc.md @@ -0,0 +1,82 @@ +--- +title: Kubectl-Dba Dc-Dr Active-Dc +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-active-dc + name: Kubectl-Dba Dc-Dr Active-Dc + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr active-dc + +Print the data center that currently holds the primary role + +### Synopsis + +Reads the primary-DC Lease from the coordination control plane, the authority for which data center is active. + + Given a database name, its failover scope is resolved first (the PlacementPolicy's failoverPolicy trigger, exactly as the operator resolves it) and the matching Lease is read. Given --lease, that Lease is read directly, which also works for a scope whose database is gone. + + KUBECONFIG: the hub cluster (to read the Postgres and its PlacementPolicy, and by default to read the coordination kubeconfig Secret). The coordination plane itself is reached with the --coord-* flags. + +``` +kubectl-dba dc-dr active-dc [DB_NAME] [--lease NAME] [flags] +``` + +### Examples + +``` + # By database + kubectl dba dc-dr active-dc pg-dcdr -n demo + + # By Lease name, with an explicit coordination kubeconfig file + kubectl dba dc-dr active-dc --lease primary-dc --coord-kubeconfig /tmp/coord.yaml + + # Scriptable: just the DC name + kubectl dba dc-dr active-dc pg-dcdr -n demo -q +``` + +### Options + +``` + --coord-kubeconfig string Path to a kubeconfig file for the coordination control plane (overrides the secret/configmap sources) + --coord-kubeconfig-configmap string ConfigMap ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig + --coord-kubeconfig-secret string Secret ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig (default "dc-failover/coord-kubeconfig") + --coord-namespace string Namespace on the coordination plane that holds the primary-DC Leases (default "dc-failover") + -h, --help help for active-dc + --lease string Read this Lease directly instead of resolving a database's scope + -q, --quiet Print only the active DC name +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_debug.md b/docs/reference/cli/kubectl-dba_dc-dr_debug.md new file mode 100644 index 0000000000..53ed0820e6 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_debug.md @@ -0,0 +1,62 @@ +--- +title: Kubectl-Dba Dc-Dr Debug +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-debug + name: Kubectl-Dba Dc-Dr Debug + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr debug + +Diagnose DC-DR symptoms: failover not happening, switchover stuck, fenced database + +### Synopsis + +Walk the DC-DR decision chain and report, in order, every condition that would stop the thing you are waiting for. + +``` +kubectl-dba dc-dr debug +``` + +### Options + +``` + -h, --help help for debug +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis +* [kubectl-dba dc-dr debug failover](/docs/reference/cli/kubectl-dba_dc-dr_debug_failover.md) - Diagnose why a cross-DC failover is not happening +* [kubectl-dba dc-dr debug fence](/docs/reference/cli/kubectl-dba_dc-dr_debug_fence.md) - Diagnose a database whose primary is fenced read-only +* [kubectl-dba dc-dr debug switchover](/docs/reference/cli/kubectl-dba_dc-dr_debug_switchover.md) - Diagnose a planned switchover that is not completing + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_debug_failover.md b/docs/reference/cli/kubectl-dba_dc-dr_debug_failover.md new file mode 100644 index 0000000000..4f83f4d81c --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_debug_failover.md @@ -0,0 +1,77 @@ +--- +title: Kubectl-Dba Dc-Dr Debug Failover +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-debug-failover + name: Kubectl-Dba Dc-Dr Debug Failover + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr debug failover + +Diagnose why a cross-DC failover is not happening + +### Synopsis + +Walks every gate between "something is wrong" and "another data center is primary", reporting which one is holding: + + 1. is the scope registered at all (no PlacementPolicy failoverPolicy means no Lease, so nothing can ever move); + 2. does the Lease exist, who holds it, and is it still being renewed (a renewed Lease means the holder's agent is alive: by design NO database-level condition, client errors, QPS, lag, or a crashed postgres, ever moves it); + 3. is a break-glass pin or a standby-hold blocking the move; + 4. is the RPO budget holding the promotion (the accept remedy); + 5. are there stale or failed ForceFailOver ops, or a tripped retry cap, that make the hub skip evaluation. + + KUBECONFIG: the hub cluster; the coordination plane via --coord-*. + +``` +kubectl-dba dc-dr debug failover DB_NAME [flags] +``` + +### Examples + +``` + kubectl dba dc-dr debug failover pg-dcdr -n demo +``` + +### Options + +``` + --coord-kubeconfig string Path to a kubeconfig file for the coordination control plane (overrides the secret/configmap sources) + --coord-kubeconfig-configmap string ConfigMap ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig + --coord-kubeconfig-secret string Secret ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig (default "dc-failover/coord-kubeconfig") + --coord-namespace string Namespace on the coordination plane that holds the primary-DC Leases (default "dc-failover") + -h, --help help for failover +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr debug](/docs/reference/cli/kubectl-dba_dc-dr_debug.md) - Diagnose DC-DR symptoms: failover not happening, switchover stuck, fenced database + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_debug_fence.md b/docs/reference/cli/kubectl-dba_dc-dr_debug_fence.md new file mode 100644 index 0000000000..a243d0cd97 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_debug_fence.md @@ -0,0 +1,71 @@ +--- +title: Kubectl-Dba Dc-Dr Debug Fence +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-debug-fence + name: Kubectl-Dba Dc-Dr Debug Fence + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr debug fence + +Diagnose a database whose primary is fenced read-only + +### Synopsis + +A DC-DR database goes read-only by design when its local marker is missing, stale past its TTL, or names another data center, so that at most one data center is ever writable. This reports which of those applies, whether the authority itself is healthy, and what to do when the coordination plane is the thing that is broken. + + KUBECONFIG: the hub cluster; the coordination plane via --coord-*. + +``` +kubectl-dba dc-dr debug fence DB_NAME [flags] +``` + +### Examples + +``` + kubectl dba dc-dr debug fence pg-dcdr -n demo +``` + +### Options + +``` + --coord-kubeconfig string Path to a kubeconfig file for the coordination control plane (overrides the secret/configmap sources) + --coord-kubeconfig-configmap string ConfigMap ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig + --coord-kubeconfig-secret string Secret ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig (default "dc-failover/coord-kubeconfig") + --coord-namespace string Namespace on the coordination plane that holds the primary-DC Leases (default "dc-failover") + -h, --help help for fence +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr debug](/docs/reference/cli/kubectl-dba_dc-dr_debug.md) - Diagnose DC-DR symptoms: failover not happening, switchover stuck, fenced database + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_debug_switchover.md b/docs/reference/cli/kubectl-dba_dc-dr_debug_switchover.md new file mode 100644 index 0000000000..35892ef47b --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_debug_switchover.md @@ -0,0 +1,67 @@ +--- +title: Kubectl-Dba Dc-Dr Debug Switchover +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-debug-switchover + name: Kubectl-Dba Dc-Dr Debug Switchover + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr debug switchover + +Diagnose a planned switchover that is not completing + +### Synopsis + +Reports which of the switchover's gates is holding and why, including the one that surprises people most: every gate measures by dialing the ACTIVE primary, so a switchover cannot proceed while that primary is unreachable. + + KUBECONFIG: the hub cluster. + +``` +kubectl-dba dc-dr debug switchover DB_NAME [flags] +``` + +### Examples + +``` + kubectl dba dc-dr debug switchover pg-dcdr -n demo +``` + +### Options + +``` + -h, --help help for switchover +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr debug](/docs/reference/cli/kubectl-dba_dc-dr_debug.md) - Diagnose DC-DR symptoms: failover not happening, switchover stuck, fenced database + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_handoff.md b/docs/reference/cli/kubectl-dba_dc-dr_handoff.md new file mode 100644 index 0000000000..0ac6c8a11a --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_handoff.md @@ -0,0 +1,82 @@ +--- +title: Kubectl-Dba Dc-Dr Handoff +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-handoff + name: Kubectl-Dba Dc-Dr Handoff + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr handoff + +Move the failover authority for a scope by handing off its primary-DC Lease + +### Synopsis + +Writes dr.open-cluster-management.io/handoff-to on the scope's primary-DC Lease. The holding data center's agent releases the Lease once, the target acquires it within a retry tick, and the annotation clears itself. + + This is the scope-local FAILOVER lever, and the correct tool when the active data center's database is down but its data center is alive: no quiesce and no catch-up wait happen, so loss is bounded by the RPO budget rather than zero. For a healthy primary prefer "dc-dr switchover", which is zero-RPO. + + It moves EVERY database sharing the scope. Do NOT stop a DC's agent to force a failover instead: one agent serves every scope its DC holds, so that expires all of them together. + + KUBECONFIG: the hub cluster (to resolve a database's scope and read the coordination kubeconfig Secret). The Lease is written on the coordination plane via the --coord-* flags. + +``` +kubectl-dba dc-dr handoff (DB_NAME | --lease NAME) --to DC [flags] +``` + +### Examples + +``` + # Fail a database's scope over to dc-b + kubectl dba dc-dr handoff pg-dcdr -n demo --to dc-b --yes + + # Move a scope by Lease name (works with no database left) + kubectl dba dc-dr handoff --lease primary-dc-orders --to dc-a --yes +``` + +### Options + +``` + --coord-kubeconfig string Path to a kubeconfig file for the coordination control plane (overrides the secret/configmap sources) + --coord-kubeconfig-configmap string ConfigMap ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig + --coord-kubeconfig-secret string Secret ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig (default "dc-failover/coord-kubeconfig") + --coord-namespace string Namespace on the coordination plane that holds the primary-DC Leases (default "dc-failover") + -h, --help help for handoff + --lease string Act on this Lease directly instead of resolving a database's scope + --to string Target data center + --yes Confirm the handoff (it moves every database in the scope) +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_pin-primary.md b/docs/reference/cli/kubectl-dba_dc-dr_pin-primary.md new file mode 100644 index 0000000000..98d8c06afd --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_pin-primary.md @@ -0,0 +1,84 @@ +--- +title: Kubectl-Dba Dc-Dr Pin-Primary +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-pin-primary + name: Kubectl-Dba Dc-Dr Pin-Primary + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr pin-primary + +Pin this data center as primary (break-glass override): no failover, writable through a control-plane outage + +### Synopsis + +Creates the human-owned break-glass override ConfigMap -override in the coordination namespace of the CURRENT cluster, which must be the data center you are pinning (its own spoke). + + Two effects, both live-proven: this DC's agent mirrors the pin onto the Lease so every other Member defers permanently, and this DC's coordinator forces its leader ACTIVE regardless of marker state, so a sustained coordination-plane outage no longer fences it read-only after the usual marker TTL plus uncertainty hold. + + Use it when the failover authority is unreachable and the surviving primary must keep accepting writes, or as a deliberate "never fail this scope over" policy. While it stands there is no split-brain protection for the scope, and nothing takes over if this DC dies. + + KUBECONFIG: the SPOKE of the data center being pinned. + +``` +kubectl-dba dc-dr pin-primary (--scope LEASE | --db DB_NAME) [flags] +``` + +### Examples + +``` + # Keep dc-b primary for the global scope, come what may (run against dc-b) + kubectl dba dc-dr pin-primary --scope primary-dc --yes --kubeconfig ~/.kube/dc-b.yaml + + # Clear it once the emergency is over + kubectl dba dc-dr pin-primary --scope primary-dc --remove --yes --kubeconfig ~/.kube/dc-b.yaml +``` + +### Options + +``` + --coord-kubeconfig string Path to a kubeconfig file for the coordination control plane (overrides the secret/configmap sources) + --coord-kubeconfig-configmap string ConfigMap ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig + --coord-kubeconfig-secret string Secret ([namespace/]name, key "kubeconfig") on the current cluster holding the coordination-plane kubeconfig (default "dc-failover/coord-kubeconfig") + --coord-namespace string Namespace on the coordination plane that holds the primary-DC Leases (default "dc-failover") + --db string Resolve the scope from this database instead (requires the kubeconfig to reach the hub) + --force With --remove: also clear the override-hold annotation directly on the Lease, for when the pinned DC is dead and its agent cannot clear it (run against any live cluster; needs the --coord-* flags to reach the coordination plane) + -h, --help help for pin-primary + --remove Remove the pin instead of creating it + --scope string Primary-DC Lease name of the scope (for example primary-dc or primary-dc-orders) + --yes Confirm +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_pin-standby.md b/docs/reference/cli/kubectl-dba_dc-dr_pin-standby.md new file mode 100644 index 0000000000..076b374c72 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_pin-standby.md @@ -0,0 +1,80 @@ +--- +title: Kubectl-Dba Dc-Dr Pin-Standby +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-pin-standby + name: Kubectl-Dba Dc-Dr Pin-Standby + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr pin-standby + +Pin this data center as a standby (standby-hold): it never promotes + +### Synopsis + +Creates the human-owned standby-hold ConfigMap -standby-hold in the coordination namespace of the CURRENT cluster, which must be the data center you are holding down. + + While it exists that DC never contends for the scope's primary-DC Lease, never promotes (it refuses even an explicit handoff naming it), and its coordinator refuses destructive cross-DC rewinds or re-seeds of the data it holds. It fails CLOSED: if the ConfigMap cannot be read the hold is assumed, so a flaky apiserver never silently drops the protection. + + It is deliberately ignored on the data center that is currently ACTIVE, because demoting the active DC without a quiesce is unsafe; move the primary away with a planned switchover first. + + KUBECONFIG: the SPOKE of the data center being held. + +``` +kubectl-dba dc-dr pin-standby (--scope LEASE | --db DB_NAME) [flags] +``` + +### Examples + +``` + # Never let dc-a take the primary role for this scope (run against dc-a) + kubectl dba dc-dr pin-standby --scope primary-dc --yes --kubeconfig ~/.kube/dc-a.yaml + + # Release it + kubectl dba dc-dr pin-standby --scope primary-dc --remove --yes --kubeconfig ~/.kube/dc-a.yaml +``` + +### Options + +``` + --coord-namespace string Namespace on this spoke that holds the marker ConfigMaps (default "dc-failover") + --db string Resolve the scope from this database instead (requires the kubeconfig to reach the hub) + -h, --help help for pin-standby + --remove Remove the pin instead of creating it + --scope string Primary-DC Lease name of the scope (for example primary-dc or primary-dc-orders) + --yes Confirm +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_status.md b/docs/reference/cli/kubectl-dba_dc-dr_status.md new file mode 100644 index 0000000000..7d5b9a3b41 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_status.md @@ -0,0 +1,69 @@ +--- +title: Kubectl-Dba Dc-Dr Status +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-status + name: Kubectl-Dba Dc-Dr Status + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr status + +Show DC-DR state and switchover progress once (re-run to see further progress) + +### Synopsis + +Prints the database's failover scope, per data center state, protection verdict, and, when a planned switchover is in flight, its step-by-step progress: what has completed, what is happening NOW, and what remains. + + One-shot by design: it does not follow. Run it again to see the next state, which keeps its output readable in tickets and transcripts. + + KUBECONFIG: the hub cluster. + +``` +kubectl-dba dc-dr status DB_NAME [flags] +``` + +### Examples + +``` + kubectl dba dc-dr status pg-dcdr -n demo +``` + +### Options + +``` + -h, --help help for status +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_dc-dr_switchover.md b/docs/reference/cli/kubectl-dba_dc-dr_switchover.md new file mode 100644 index 0000000000..f052a18e38 --- /dev/null +++ b/docs/reference/cli/kubectl-dba_dc-dr_switchover.md @@ -0,0 +1,72 @@ +--- +title: Kubectl-Dba Dc-Dr Switchover +menu: + docs_{{ .version }}: + identifier: kubectl-dba-dc-dr-switchover + name: Kubectl-Dba Dc-Dr Switchover + parent: reference-cli +menu_name: docs_{{ .version }} +section_menu_id: reference +--- +## kubectl-dba dc-dr switchover + +Trigger a planned zero-RPO switchover of a distributed database to another data center + +### Synopsis + +Sets the dr.kubedb.com/switchover-to annotation on the Postgres. The hub operator then quiesces the active primary (write-locked), waits for the target data center to catch up to the frozen LSN, hands off the primary-DC Lease, and clears the annotation. Requires the active primary to be up and accepting connections: the safety gates measure by dialing it and fail closed, so a dead primary cannot be switched away from (use the failover path instead: dc-dr handoff, and dc-dr accept-data-loss if the RPO budget holds it). + + KUBECONFIG: the hub cluster (where the Postgres CR lives). + +``` +kubectl-dba dc-dr switchover DB_NAME --to DC [flags] +``` + +### Examples + +``` + # Move demo/pg-dcdr to data center dc-a, with zero data loss + kubectl dba dc-dr switchover pg-dcdr -n demo --to dc-a + + # Watch the progress (one-shot, run repeatedly) + kubectl dba dc-dr status pg-dcdr -n demo +``` + +### Options + +``` + -h, --help help for switchover + --to string Target data center (must be a Member DC of the database's PlacementPolicy) +``` + +### Options inherited from parent commands + +``` + --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. + --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. + --as-uid string UID to impersonate for the operation. + --cache-dir string Default cache directory (default "/home/runner/.kube/cache") + --certificate-authority string Path to a cert file for the certificate authority + --client-certificate string Path to a client certificate file for TLS + --client-key string Path to a client key file for TLS + --cluster string The name of the kubeconfig cluster to use + --context string The name of the kubeconfig context to use + --default-seccomp-profile-type string Default seccomp profile + --disable-compression If true, opt-out of response compression for all requests to the server + --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure + --kubeconfig string Path to the kubeconfig file to use for CLI requests. + --match-server-version Require server version to match client version + -n, --namespace string If present, the namespace scope for this CLI request + --password string Password for basic authentication to the API server + --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") + -s, --server string The address and port of the Kubernetes API server + --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used + --token string Bearer token for authentication to the API server + --user string The name of the kubeconfig user to use + --username string Username for basic authentication to the API server +``` + +### SEE ALSO + +* [kubectl-dba dc-dr](/docs/reference/cli/kubectl-dba_dc-dr.md) - Cross data center DR operations: switchover, failover, pins, and diagnosis + diff --git a/docs/reference/cli/kubectl-dba_remote-config_postgres.md b/docs/reference/cli/kubectl-dba_remote-config_postgres.md index 3bba0fd3ee..a8bad04423 100644 --- a/docs/reference/cli/kubectl-dba_remote-config_postgres.md +++ b/docs/reference/cli/kubectl-dba_remote-config_postgres.md @@ -31,12 +31,18 @@ kubectl dba remote-config mysql -n -u -p$ -d-remote-replica-auth) + --ca-cert string path to a CA certificate PEM; when set (together with --ca-key) the client certificate is issued locally from this CA instead of through cert-manager + --ca-key string path to the CA private key PEM matching --ca-cert; required to sign the client certificate + --client-sans strings comma separated DNS names to set as SANs on the generated client certificate + -d, --dns string dns name for the remote replica (default "localhost") + -h, --help help for postgres + -n, --namespace string host namespace for the remote replica (default "default") + -p, --pass string password name for the remote replica (default "password") + --port int32 port the source is reachable on from the remote cluster; written into the generated AppBinding (also accepted as -d host:port) (default 5432) + --replica-name string when set, also emit a ready-to-apply remote replica Postgres manifest with this name, sized from the source spec + -u, --user string user name for the remote replica (default "postgres") + -y, --yes permission for alter password for the remote replica ``` ### Options inherited from parent commands