After a very bad experience with a customer, I would like to report this bug which could be solved either in documentation or in MCO itself.

Of course, setting a maxunavailable for mcp master of 3 or more will have the three masters at the same time trying to be drained.

Not sure if the customer has done more actions which has provoked the cluster completely unrecoverable. In any case, since some people are playing with this and doing tests that could drive to a non healthy cluster, I would request to give a warning in the docs or prevent it from the mco itself.