Set keep wal segments to something largish (1000 or so) well before the upgrade etc. Make sure the volume holding pg_xlog can hold 1000*16MB of data. This ensures the streaming replicant can catch up if some stuff happens before it's back up.
If we have both primary and standby down at the same time, would this really still be necessary? FWIW right now ours is set to keep 128.
Also, going back to my original question. Once both are down, is it best practice to perform patching/upgrades on the standby first (starting furthest downstream if cascading)? e.g. patch/upgrade the standby (via standard CentOS7 yum from the repo), then start the standby DB and verify nothing has broken, then do the same to the upstream or primary?
