Establish a Process for Rolling Upgrades to Apply Security Patches Without Downtime

中级别 1人工审核cockroachdb

说明

CockroachDB supports rolling upgrades, allowing administrators to apply security patches, minor version updates, and configuration changes without cluster downtime. A rolling upgrade updates one node at a time, while the remaining nodes continue serving traffic and maintaining quorum.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Confirm a documented or automated rolling-upgrade procedure exists (one node at a time with cockroach node drain --shutdown, pre/post health checks, defined rollback plan, reference to Cockroach Labs upgrade docs). Run cockroach node status --all before upgrades: all nodes live, same version, no under-replicated ranges.

修复方式

修复方法: 操作指南或基础设施补丁

1. Prepare for rolling upgrade: - Confirm cluster health and full replication: cockroach node status --certs-dir=/var/lib/cockroach/certs --host=<node> cockroach node status --certs-dir=/var/lib/cockroach/certs --all Backups are strongly recommended before upgrades. 2. Upgrade CockroachDB binary on each node (one at a time): - Use cockroach node drain with --shutdown to gracefully drain and then terminate the node's process.

属性

操作系统: 任意
标签: cockroachdbpatching
参考: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.6 Establish a Process for Rolling Upgrades to Apply Security Patches Without Downtime