Fencing a Postgres primary that might still be alive

ClickHouse describes how its managed Postgres, built on the open source Ubicloud control plane, fences a possibly live primary before promoting a standby. It runs several methods in parallel: stopping Postgres, locking pg_hba.conf, and cutting the network. On bare metal it downs a veth interface, on AWS it force-detaches a second NIC, and on GCP it deletes a Dynamic NIC. If every method fails, it promotes anyway, favoring availability. The GCP timings (0.7 to 2.5 seconds to last packet) are the authors' own measurements.