Establish a Process for Rolling Upgrades to Apply Security Patches Without Downtime

MoyenneNiveau 1Revue manuellecockroachdb

Description

CockroachDB supports rolling upgrades, allowing administrators to apply security patches, minor version updates, and configuration changes without cluster downtime. A rolling upgrade updates one node at a time, while the remaining nodes continue serving traffic and maintaining quorum.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Confirm a documented or automated rolling-upgrade procedure exists (one node at a time with cockroach node drain --shutdown, pre/post health checks, defined rollback plan, reference to Cockroach Labs upgrade docs). Run cockroach node status --all before upgrades: all nodes live, same version, no under-replicated ranges.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

1. Prepare for rolling upgrade: - Confirm cluster health and full replication: cockroach node status --certs-dir=/var/lib/cockroach/certs --host=<node> cockroach node status --certs-dir=/var/lib/cockroach/certs --all Backups are strongly recommended before upgrades. 2. Upgrade CockroachDB binary on each node (one at a time): - Use cockroach node drain with --shutdown to gracefully drain and then terminate the node's process.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: cockroachdbpatching
Référence: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.6 Establish a Process for Rolling Upgrades to Apply Security Patches Without Downtime