{"change_id":"CHG-2026-042","entity":{"name":"Acme Supplies SRL","registration":"BE0123456789"},"change_type":"normal","title":"Upgrade production PostgreSQL cluster from version 14 to 16","description":"In-place major upgrade of the Acme ERP production database cluster from PostgreSQL 14.11 to 16.2. Two-node streaming replication (primary in Brussels, replica in Antwerp DR). The approach is: (1) upgrade replica via pg_upgrade, (2) fail over ERP to the upgraded node, (3) upgrade the former primary, (4) re-establish replication in the new direction. Application connection strings do not change.","business_justification":"PostgreSQL 14 reaches end-of-life in November 2026; after that date there will be no upstream security patches. ERP depends on this cluster and must remain on a supported major version to preserve the 'state of the art' requirement under Art. 32 GDPR. Upgrade also unlocks JSON performance improvements that the finance team's new consolidated reporting needs.","requester":{"name":"Jeroen Van Hove","title":"IT junior admin — DBA delegate","contact":"jeroen.vanhove@acme-supplies.be"},"change_manager":{"name":"Thomas Janssens","title":"IT Operations Manager","contact":"thomas.janssens@acme-supplies.be"},"affected_owners":[{"name":"Rita Van Hove","title":"Finance controller (ERP business owner)"},{"name":"Sophie Martens","title":"Operations director (warehouse module)"},{"name":"Fabien Dupont","title":"Head of Sales (CRM integration owner)"}],"impact":{"systems_affected":["Acme ERP (Odoo 17) — primary and DR nodes","Warehouse management (WMS) integration","Nightly BI export job to Power BI","Salesforce CRM order sync"],"users_affected_count":85,"downtime_expected":"Approx. 45 minutes cumulative across two failover events; planned inside the Sunday 02:00–06:00 CET maintenance window."},"risk_assessment":{"likelihood":"unlikely","impact":"major","level":"medium","narrative":"pg_upgrade has been validated on a full production clone (2026-04-02 dress rehearsal, all application smoke tests green). Main residual risks: unexpected extension incompatibility (pg_partman, pgvector) and replication-lag spike after fail-back. Both have rollback procedures below."},"implementation_plan":{"steps":[{"step_no":1,"description":"Freeze non-essential ERP jobs and disable nightly cron at 01:00 CET.","owner":"Jeroen Van Hove","estimated_duration":"15 min"},{"step_no":2,"description":"Take logical dump + WAL archive snapshot of primary at 01:30 CET.","owner":"Jeroen Van Hove","estimated_duration":"25 min"},{"step_no":3,"description":"Stop replica, run pg_upgrade on replica (14 → 16), restart, analyse.","owner":"Jeroen Van Hove","estimated_duration":"35 min"},{"step_no":4,"description":"Run application smoke tests against upgraded replica (read-only).","owner":"Thomas Janssens","estimated_duration":"20 min"},{"step_no":5,"description":"Fail ERP traffic to replica (HAProxy flip). Validate writes.","owner":"Thomas Janssens","estimated_duration":"10 min"},{"step_no":6,"description":"Run pg_upgrade on former primary. Re-establish streaming replication in reverse direction.","owner":"Jeroen Van Hove","estimated_duration":"45 min"},{"step_no":7,"description":"Re-enable cron, run full WMS + CRM integration regression.","owner":"Thomas Janssens","estimated_duration":"30 min"},{"step_no":8,"description":"Monitor replication lag and error rate for 2h; confirm change closed.","owner":"Jeroen Van Hove","estimated_duration":"2 h"}]},"rollback_plan":"At any point before step 5 (HAProxy flip), abort and revert by restarting 14 binaries on the replica against the 14-era PGDATA backup (kept for 72h). If step 5 has already completed and critical defect is found, flip HAProxy back to the un-upgraded former primary (still running 14 at that moment — step 6 has not started) and restore replica from the pre-step-3 PGDATA snapshot. Data written during the 10–15 minutes on the upgraded node will be replayed from WAL (no loss). Rollback RTO: 30 minutes.","testing_plan":"Dress rehearsal already performed on 2026-04-02 against a point-in-time clone. Additional in-window testing: (a) ERP smoke suite (220 automated tests), (b) WMS → ERP order flow end-to-end (10 synthetic orders), (c) CRM opportunity-to-order sync (5 synthetic opportunities), (d) nightly BI export dry run on upgraded DB.","schedule":{"start":"2026-04-26 02:00 CET","end":"2026-04-26 06:00 CET","maintenance_window":"Sunday 02:00–06:00 CET — recurring ERP maintenance window"},"cab_decision":"approved","cab_conditions":"Approved subject to: (i) Finance sign-off before go-live on 2026-04-25 by 17:00 CET confirming no open month-end runs; (ii) Head of Sales confirming no active customer-facing promotion dependent on CRM-order sync during the window; (iii) IT on-call rota armed and post-implementation review scheduled for 2026-04-28.","cab_decided_on":"2026-04-14","post_implementation_review":{"outcome":"successful","reviewer":{"name":"Thomas Janssens","title":"IT Operations Manager"},"date":"2026-04-28","lessons_learned":"Overall 15 minutes faster than planned. One minor issue: pgvector extension required manual re-creation on the new binary; will be added to the runbook. No data loss, no user-visible incident."}}