Passive Sync can zap a node after an upgrade if the active has some changes before its upgrade that the passive don't have

[mathieucarbou]

S == setting change
U == upgrade
A == activation

and we have:

A: A S1 S2 U S3 (online)
P: A S1 S2 U S3 (online)
P: A S1 (offline)

Then, we upgrade the kit of last passive and we restart it. It will do:

P: A S1 U => topology won't match active so it will zap

[mathieucarbou]

@mobasherul : FYI

[mathieucarbou]

It has been decided to document this problem and ask users to make sure they start all nodes that will be part of the cluster, make sure they are all alive, synced, all have a consistent and up to date configuration.
The upgrade process also is not possible if the configuration is partially prepared, committed or rolled back.