Fencing a Postgres Primary That Might Still Be Alive
ClickHouse, Tuesday, November 3rd, 2026
ClickHouse explains how ClickHouse Managed Postgres fences an old primary that may still accept writes before promoting a standby.
Based on Furkan Sahin's PGConf.EU 2026 talk, this ClickHouse engineering post explains why a managed Postgres service must fence the old primary before promoting a standby, to avoid lost writes or split brain.
Promoting a standby with pg_promote and refreshing DNS does not stop the old primary from accepting writes, since clients may stay connected or reach it until DNS TTLs expire.
The post walks through cases where stopping standby acknowledgements fails, including async replication, sessions that disable synchronous_commit, quorum commit and commits already written to the WAL.
It describes how ClickHouse Managed Postgres fences the primary on bare metal, AWS and GCP, and why the design is fail-open.