The last failover we had was after the hardware failure detailed in T435354, ref this Puppet change . Since we will be demoting the active primary as opposed to replacing a failed primary entirely, I'll read through our docs and come up with a maintenance plan.

Change #1341330 had a related patch set uploaded (by Bking; author: Bking):

[operations/puppet@production] Kerberos: promote `krb1004` to Kerberos primary

https://gerrit.wikimedia.org/r/1341330

I've created a maintenance plan here . If you're a stakeholder, feel free to read it over and offer feedback.

Change #1341330 merged by Bking:

[operations/puppet@production] Kerberos: promote `krb1004` to Kerberos primary

https://gerrit.wikimedia.org/r/1341330

As promised, I've assigned the primary role to the krb1004 host. I've verified that changes are still syncing by changing my password and verified the change has propagated to other hosts. As we expected, assigning the primary role did not increase krb1004 's resource usage (the more-impactful client-side changes already took place in T435873).

The work here is complete, so I'll go ahead and close this one out.

Mentioned in SAL (#wikimedia-operations) [2026-09-30T14:00:40Z] <inflatador> bking@krb2002 disable wmf_auto_restart krb admin timers/services as this host is no longer primary T437937