A standard cluster deployment uses three nodes, which allows for no-downtime upgrades along with the ability to have a fully available cluster during maintenance.
Please note that with only two database cluster nodes, there is a window of vulnerability created by leaving zero failover candidates available when the lone slave is taken down for service.
The Best Practices: Staging Performing a No-Downtime Upgrade for a Staging Deployment
When upgrading a Staging-style deployment, all nodes are upgraded
at once in parallel via the
tools/tpm update command
run from inside the staging directory on the staging host.
No Master switch happens, and all layers are restarted to use the new code. …[Read more]