Establish a Process for Rolling Upgrades to Apply Security Patches Without Downtime

보통레벨 1수동 검토cockroachdb

설명

CockroachDB supports rolling upgrades, allowing administrators to apply security patches, minor version updates, and configuration changes without cluster downtime. A rolling upgrade updates one node at a time, while the remaining nodes continue serving traffic and maintaining quorum.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Confirm a documented or automated rolling-upgrade procedure exists (one node at a time with cockroach node drain --shutdown, pre/post health checks, defined rollback plan, reference to Cockroach Labs upgrade docs). Run cockroach node status --all before upgrades: all nodes live, same version, no under-replicated ranges.

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Prepare for rolling upgrade: - Confirm cluster health and full replication: cockroach node status --certs-dir=/var/lib/cockroach/certs --host=<node> cockroach node status --certs-dir=/var/lib/cockroach/certs --all Backups are strongly recommended before upgrades. 2. Upgrade CockroachDB binary on each node (one at a time): - Use cockroach node drain with --shutdown to gracefully drain and then terminate the node's process.

속성

운영 체제: 모두
태그: cockroachdbpatching
참고 자료: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.6 Establish a Process for Rolling Upgrades to Apply Security Patches Without Downtime