---
id: w1/m22/t002
title: Failover / promote path (switchover → CNPG; report primary)
worker: worker1
status: todo
estimate: 60m
depends_on: [w1/m22/t001]
---

## Objective

Provide a failover/promote operation that triggers a CNPG switchover (promote a standby to primary) and reflects the new primary in status. Matches Render's `failover`/`promote`.

## Context

- CNPG exposes switchover/promotion (target primary annotation / plugin action); the operator drives it.
- The primary connection service must keep pointing at the current primary after switchover (CNPG `-rw` service already does this — verify).

## Steps

1. Add a failover/promote action on the Database (verb/annotation) that instructs CNPG to switch primary.
2. Surface the current primary + last-failover time in Database status.
3. Ensure the read-write URL continues to resolve to the new primary post-switchover.

## Files

- `lego/operator/internal/controller/…` (failover action + status)

## Acceptance criteria

- [ ] Triggering failover promotes a standby; status reports the new primary; the `-rw` endpoint follows.
- [ ] No data loss for committed writes under a clean switchover (envtest/integration as feasible).

## Out of scope

- Replica URLs (t003); API/UI (t004/t005).
