This is an outstanding writeup, but I wonder if it glosses over the real problem: >>The standby (secondary) is only used for failover purposes. >>One of the e

This is an outstanding writeup, but I wonder if it glosses over the real problem: >>The standby (secondary) is only used for failover purposes. >>One of the engineers went to the secondary and wiped the data directory, then ran pg_basebackup. IMO, secondaries should be treated exactly as their primaries. No operation should be done on a secondary unless you'd be OK doing that same operation on the primary. You can always create another instance for these operations.