### Change Summary The Patroni `CI` cluster currently runs on Postgres 14, an outdated Postgres engine. During the maintenance, we will upgrade a new standby cluster to Postgres 16, and update the Consul service registration to point Gitlab.com applications to the corresponding new Patroni cluster running PG 16. The CR is executed through the following schedule * **Friday 27/09** 00:00 UTC: * start of the operational lock (block database migrations) * **Saturday 28/09** 00:00 UTC: * check there's no running migrations * perform database upgrade in the target cluster (convert to logical replication old v14 -\> new v16) * start [amcheck](https://www.postgresql.org/docs/16/amcheck.html) in the v16 database (check sample of tables and index consistency), which might take 12+ hours to run * **Sunday 29/09** 00:00 UTC: * **Workload switchover to v16** (v16 will become the active database) * Switchover should be unnoticeable for end-user customers, but there's a small risk of downtime if the automation fails; * Enable reverse replication (new v16 -\> old v14) * Start the rollback window (monitor workload for performance regression in the new engine version) * **Wednesday 02/10** 01:00 UTC: * End rollback window * End operational lock #### Key Benefits: * Up-to-date Postgresqsl engine will provide increased security and stability. * Performance improvements in Postgres 16 will significantly impact our ability to operate the primary database at our current scale #### Downtime Requirements: The **PG 16 upgrade process will be an online process with `near zero downtime` for end-users**, the workload should be enqueue during the switchover that should take a few seconds, but there's a risk of downtime of up to 5 mins if manual intervention is required for the Writer endpoint switchover. However, as the process uses logical replication, we can't allow database migrations (model changes) to be from Friday up to Wednesday (end of rollback window) in the Production environment, therefore **there's an operational lock to block deployments in the Production `CI` database during the period**. ### Postgres Upgrade Rollout Team | Role | Assigned To | |------|-------------| | :wolf: Coordinator | @rhenchen.gitlab | | :knife: Playbook-Runner | @daveyleach | | :telephone: Comms-Handler | @rmar1 | | :elephant: DBRE | @rhenchen.gitlab | | :dolphin: SRE | @daveyleach | | :trophy: Quality | Self-Serve with escalations via PD | | :tophat: IMOC | @thiagocsf | | :mega: CMOC | @alvin | | :ambulance: EOC | @swainaina | | :floppy_disk: DBRE Escalation | @rmar1 | ### Change Details 1. **Services Impacted** - ~"Service::PatroniCI" ~"Service::Postgres" ~Database 1. **Change Technician** - @rhenchen.gitlab @daveyleach 1. **Change Reviewer** - @vitabaks @bshah11 @alexander-sosna 1. **Time tracking** - 5 days 1. **Downtime Component** - Near Zero Customer Downtime (Database migrations need to be blocked) ### Set Maintenance Mode in GitLab If your change involves scheduled maintenance, add a step to set and [unset maintenance mode](https://gitlab.com/gitlab-com/runbooks/-/blob/master/docs/monitoring/set_maintenance_window.md) per our runbooks. This will make sure [SLA calculations adjust](https://gitlab.com/gitlab-com/runbooks/-/merge_requests/5887) for the maintenance period. ## Detailed steps for the change We will pretend that GitLab.com would be unavailable during the execution of the CR and we'll use ops.gitlab.net for the detailed instructions. We will use the following issue: https://ops.gitlab.net/gitlab-com/gl-infra/db-migration/-/issues/71 ## Change Reviewer checklist <!-- To be filled out by the reviewer. --> ~C4 ~C3 ~C2 ~C1: - [ ] Check if the following applies: - The **scheduled day and time** of execution of the change is appropriate. - The [change plan](#detailed-steps-for-the-change) is technically accurate. - The change plan includes **estimated timing values** based on previous testing. - The change plan includes a viable [rollback plan](#rollback). - The specified [metrics/monitoring dashboards](#key-metrics-to-observe) provide sufficient visibility for the change. ~C2 ~C1: - [ ] Check if the following applies: - The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details). - The change plan includes success measures for all steps/milestones during the execution. - The change adequately minimizes risk within the environment/service. - The performance implications of executing the change are well-understood and documented. - The specified metrics/monitoring dashboards provide sufficient visibility for the change. - If not, is it possible (or necessary) to make changes to observability platforms for added visibility? - The change has a primary and secondary SRE with knowledge of the details available during the change window. - The change window has been agreed with Release Managers in advance of the change. If the change is planned for APAC hours, this issue has an agreed pre-change approval. - The labels ~"blocks deployments" and/or ~"blocks feature-flags" are applied as necessary. ## Change Technician checklist <!-- To find out who is on-call, use the `@sre-oncall` handle in slack --> - [ ] Check if all items below are complete: - The [change plan](#detailed-steps-for-the-change) is technically accurate. - This Change Issue is linked to the appropriate Issue and/or Epic - Change has been tested in staging and results noted in a comment on this issue. - A dry-run has been conducted and results noted in a comment on this issue. - The change execution window respects the [Production Change Lock periods](https://about.gitlab.com/handbook/engineering/infrastructure/change-management/#production-change-lock-pcl). - For ~C1 and ~C2 change issues, the change event is added to the [GitLab Production](https://calendar.google.com/calendar/embed?src=gitlab.com_si2ach70eb1j65cnu040m3alq0%40group.calendar.google.com) calendar. - For ~C1 and ~C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention `@sre-oncall` and this issue and await their acknowledgement.) - For ~C1 and ~C2 change issues, the SRE on-call provided approval with the ~eoc_approved label on the issue. - For ~C1 and ~C2 change issues, the Infrastructure Manager provided approval with the ~manager_approved label on the issue. - Release managers have been informed prior to any C1, C2, or ~"blocks deployments" change being rolled out. (In #production channel, mention `@release-managers` and this issue and await their acknowledgment.) - There are currently no [active incidents](https://gitlab.com/gitlab-com/gl-infra/production/-/issues?scope=all&utf8=%E2%9C%93&state=opened&label_name[]=Incident%3A%3AActive) that are ~severity::1 or ~severity::2 - If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.