CloudNativePG Release Notes

The CloudNativePG community is releasing maintenance updates for both currently supported series: 1.30.1 and 1.29.3.

These are routine updates, and CloudNativePG remains as stable as ever. The main thread running through both releases is continued polish to failover and primary-election behavior, part of our ongoing investment in making replication, including asynchronous setups, more predictable under real-world conditions. A pending failover that could previously stall or get silently reverted is now handled correctly (#11336), and in 1.30.1, PostgreSQL startup is now gated on the instance manager actually holding the primary Lease introduced in 1.30, closing a small timing window during restarts (#11356).

Alongside that, both releases pick up a handful of smaller enhancements, such as a configurable auth_user for the connection pooler and a --dry-run option for cnpg backup, plus a number of correctness and robustness fixes. Full details, as always, are in the release notes linked below.

Both releases also bump google.golang.org/grpc to fix CVE-2026-84304 (GHSA-vp52-pcj8-j9qc), a heap-exhaustion issue in gRPC-Go’s HTTP/2 frame handling.

This kind of groundwork is also paving the way for 1.31.0, which will further solidify failover and High Availability.

Upgrade

Follow the upgrade instructions for a smooth transition.

For the complete list of changes, see the release notes:

• Release notes for 1.30.1
• Release notes for 1.29.3

Get involved with the community

Join us to help shape the future of cloud-native Postgres!

We’re also actively working with the CNCF TOC toward CloudNativePG’s acceptance into Incubation. As part of that effort, we’re pleased to share that we’ve been evolving our governance model to better reflect the project’s community. You can read the current governance model to learn more, as well as our new contributor ladder.

If you’re using CloudNativePG in production, consider adding your organization as an adopter to support the project’s growth and evolution.

We’d also like to thank everyone who contributed a pull request to this release. The number of community contributions keeps growing, and we couldn’t be happier about it.

Thank you for your continued support!

History of user-visible changes in the 1.30 minor release of CloudNativePG.

For a complete list of changes, please refer to the commits on the release branch in GitHub.

Version 1.30.1
Release date: Sep 23, 2026

Enhancements
• Added restoreAdditionalCommandArgs to .barmanObjectStore.data for in-tree Barman Cloud recoveries, so custom flags are forwarded to barman-cloud-restore during recovery. (#11278)
• Plugin authors no longer need to re-derive whether an empty WAL archive should be treated as an error: the operator now computes the check_empty_wal_archive decision once and passes it to CNPG-I plugins on both WAL archiving and restore hooks. (#11216)
• Allowed setting the ssl_ecdh_curve PostgreSQL parameter in .spec.postgresql.parameters. It was previously rejected by the validating webhook even though the operator does not manage it. Contributed by @Jamstah. (#11308)
• Added support for setting auth_user in spec.pgbouncer.parameters to override the user PgBouncer uses for its auth_query connection, instead of always deriving it from the authQuerySecret. Useful with a custom authQuerySecret where the role to authenticate as differs from the one implied by the Secret. Contributed by @jonasbadstuebner. (#10899)
• Fixed PgBouncer metrics silently reporting zero when PgBouncer adds or reorders columns: SHOW STATS and SHOW POOLS results are now matched by column name instead of by position. Contributed by @AdzerKI (SHOW STATS). (#11366, #11464)
• cnpg plugin:
◦ Added a --dry-run option to the backup command that prints the Backup resource that would be created, without creating it. (#11233)

Security and Supply Chain
• Fixed a webhook validation bypass where an absolute extension path with an embedded .. traversal (e.g. /a/../../../../etc) was accepted because only the raw path was checked; such paths still escaped the extension's mount point once resolved at runtime. Affected entries are now resolved and rejected/skipped consistently across admission, the major-upgrade job, and already-persisted Cluster specs. Contributed by @Anand-240. (#11210)
• Updated google.golang.org/grpc to v1.83.1, fixing CVE-2026-84304 / GHSA-vp52-pcj8-j9qc (gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation). (#11394)

Changes
• Updated the default PostgreSQL operand image to 18.6-system-trixie. (#11257)
• Moved the operator's own base image from Debian 12 (bookworm) to Debian 13 (trixie), now that Debian 12 has moved to LTS-only maintenance. (#11193)

Fixes
• Demoted an unreachable old primary immediately during failover, instead of waiting on checkpoint and fast-shutdown attempts that could never complete. Previously, an old primary whose PostgreSQL had become unresponsive was never shut down, so it could never rejoin the cluster as a replica of the new primary. The shutdown is now requested without blocking the reconciler, though demotion can still take up to a minute or more if PostgreSQL keeps ignoring shutdown signals. (#11347)
• Fixed failover and Pod recreation getting stuck while any instance in the cluster was fenced. A fenced instance kept reporting itself as healthy on its status endpoint even though its Pod was permanently not Ready, which blocked the readiness guard, the primary-election logic, and the Pod-reattachment gate from reacting to an unrelated failure elsewhere in the cluster, leaving it stalled until someone manually removed the fencing. All three now recognize and skip fenced instances. (#11274)
• Fixed a failover that could stall forever or get silently reverted. While a failover was pending, the reconciler could skip checking whether it was ready to complete, or mistake the pending state for a missing Pod and reset the target primary back to the unhealthy one. It now keeps progressing a pending failover and completes it once the WAL receivers are down, rechecking quorum safety right before promoting in case it changed while waiting. (#11336)
• Fixed the designated-primary sort in PostgresqlStatusList so a tie on LSN no longer sorts it out of order. If the designated primary's Pod later disappeared from the status list, this could have led the operator to promote the wrong standby. (#11494)
• Gated PostgreSQL startup on the instance manager actually holding the primary Lease, closing a window where a restarting or rescheduled primary could start accepting writes before acquiring the lease. Lease acquisition now happens during instance initialization, strictly before PostgreSQL is allowed to start, instead of only later in the reconciliation loop once the instance was already reported ready. (#11356)
• Bounded the primary lease take-over Get call to the lease's RenewDeadline, so a call against an unreachable API server now fails fast and retries instead of blocking indefinitely. Left unbounded, the same stalled call could also delay a primary's own lease renewal after a transient API server blip, risking an unwanted takeover by another instance once the lease appeared to expire. (#11350)
• Stopped abandoning a fast shutdown after 60 seconds. The request carried no explicit timeout, so pg_ctl fell back to its own implicit 60-second limit, and the instance manager, being PID 1 in the container, took PostgreSQL down mid-shutdown regardless of a larger configured stopDelay. The fast phase now waits for the full stopDelay instead. (#11263)
• Waited for certificate status before refreshing secrets during bootstrap. (#11450)
• Fixed in-tree Barman Cloud recovery ignoring wal.maxParallel and wal.restoreAdditionalCommandArgs, fetching WAL one segment at a time instead of using the configured parallelism. (#11105)
• Honored the unrecoverable annotation on pending and terminating instances. (#11241)
• Honored Backup.spec.online when finalizing VolumeSnapshot-based backups, so a cold backup is no longer reported as online in status. (#11276)
• Set --no-data-checksums explicitly when .spec.postgresql.dataChecksums is false on PostgreSQL 18+, which now enables checksums by default in initdb. Contributed by @evan314159. (#11488)
• Stopped discarding .spec.inheritedMetadata labels on PVC reconciliation; they were applied before, and then overwritten by, the operator's own labels. Contributed by @GellertBabel. (#11499)
• Stopped Pooler and DatabaseRole from recreating their owned resources after being marked for deletion, which could block an external finalizer (e.g. ArgoCD foreground deletion) waiting for those resources to disappear. Contributed by @mjlshen. (#11359)
• Handled a NULL stats_reset value in the pg_stat_wal metric, which could occasionally break Prometheus scraping on PostgreSQL 18 clusters. Contributed by @HoniSanders. (#11207)
• Recovered log streaming when a stale non-FIFO file blocked the log pipe. (#11246)
• Stopped sampling logs of the Pods' processes, so no log lines are silently dropped. (#11131)
• Stopped caching Helm release Secrets in the operator, which could spike memory usage and crashloop the operator on clusters with large Helm releases installed alongside it. (#11211)
• Re-ran owned-resource finalizer cleanup after an operator restart, so a namespace deleted while the operator was down doesn't hang in Terminating forever. (#11215)
• Fixed rejoining replicas taking a long time to complete pg_rewind when WAL prefetching (wal.maxParallel > 1) was enabled. (#11204)
• Treated a PostgreSQL instance rejecting connections as started up in probes. (#11152)
• Stopped issuing a redundant PATCH on every reconciliation when a cluster's pvcTemplate set volumeAttributesClass. Contributed by @andrew-farries. (#11196)
• Stopped halting replication slot reconciliation at the first failing slot. (#11119)
• During rollouts, compared the running configuration hash, rather than the on-disk one, avoiding unnecessary switchovers. (#11130)
• Retried VolumeSnapshot errors until the deadline, instead of giving up early. (#11132)
• Symlinked pg_wal to the WAL volume during plugin-based recovery, instead of replaying WAL onto the data volume, which could exhaust it on a large point-in-time recovery. (#11127)
• Corrected grammar in PhaseUpgradeDelayed status messages. Contributed by @Utkarsh-sharma47. (#11065)
• CloudNativePG Interface (CNPG-I):
◦ Reported the Postgres capabilities of a plugin correctly. (#11447)
◦ Prevented the plugin status field from flapping on Cluster reconciliation. Contributed by @sharifmshaker. (#11386)
◦ Replaced a finalizer with in-memory cleanup on Service deletion. This avoids namespaces hanging in Terminating state when the operator and its plugins run in the same namespace. Contributed by @maxlengdell. (#10940)
• cnpg plugin:
◦ Used UTC time zone for the default backup name. (#11329)
◦ Deleted PVCs before Pods in cnpg destroy, avoiding a race that could leave dangling PVCs needing a second invocation to clean up. Contributed by @daanvinken. (#10847)

Version 1.30.0
Release date: Jun 29, 2026

Important changes
• Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.31.0, rather than 1.30.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#11083)
• The cluster reference is now immutable on the Database, Pooler, Publication, Subscription, and ScheduledBackup resources. Pointing one of these objects at a different cluster has no well-defined semantics and previously left the controllers in an inconsistent state; the update is now rejected at the API server via a CEL validation rule. (#10743)

Features
• Primary Lease for safe primary election: introduced a Kubernetes Lease object (named after the cluster) that acts as a mutex serializing primary promotion: the instance manager must hold the lease before acting as primary and releases it on clean shutdown so replicas can promote without waiting for the full TTL. Timings are configurable via the new .spec.primaryLease stanza. The lease is a promotion gate, not a fence. Primary isolation remains responsible for fencing. (#10627)
• DatabaseRole CRD for declarative role management: introduced a DatabaseRole custom resource that manages a PostgreSQL role as a standalone Kubernetes object, instead of declaring it inline in the Cluster's .spec.managed.roles stanza. Each role gets its own lifecycle, status, and RBAC, which suits GitOps workflows and lets role definitions live next to the applications that own them. The spec reuses the same RoleConfiguration structure as the inline method, so migrating a role is a matter of moving the stanza into its own manifest. A databaseRoleReclaimPolicy field (retain, the default, or delete) controls what happens to the role when the resource is deleted, mirroring persistent volumes. (#6155)
• TLS client certificates for declarative roles: a DatabaseRole can now include a clientCertificate block to have the operator automatically generate and renew a TLS client certificate, signed by the cluster's client CA and stored in a -client-cert Secret. This enables password-free PostgreSQL cert authentication; the Secret is cleaned up when the feature is disabled or the DatabaseRole is deleted. (#10896)
• PgBouncer image management via image catalogs: the Pooler resource can now reference an entry in an ImageCatalog or ClusterImageCatalog through the new spec.pgbouncer.imageCatalogRef field, centralizing PgBouncer image management. When a catalog entry is updated, all referencing Poolers are automatically reconciled and roll out the new image without any change to their spec. The resolved image is reported in status.image, and a new status.phase (active, paused, inactive, or failed), also surfaced as a Phase column in kubectl get pooler, summarizes the lifecycle. (#10568)

Enhancements
• Enabled pg_upgrade in-place major upgrades to PostgreSQL 19 or later for clusters that use Image Volume extensions, building on the extension-path support added to pg_upgrade in PostgreSQL 19. During the upgrade Job, the source- and target-version extension images are mounted side by side, so the old server keeps its libraries and a failed upgrade reverts cleanly. (#10366)
• Added TLS support for the Pooler metrics endpoint via .spec.monitoring.tls.enabled. When enabled, the metrics server is served over HTTPS, reusing the certificate and key from .spec.pgbouncer.clientTLSSecret and reloading it on every handshake to support rotation without a restart; the generated PodMonitor scrapes over https accordingly. (#10466)
• Added a label selector to the Cluster scale subresource (status.selector), making a Cluster a valid targetRef for the Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map a Cluster to its instance pods. Contributed by @sebv004. (#8996)
• The operator now emits a Warning PrimaryStatusCheckFailed event on the Cluster when the primary pod is Ready from the kubelet perspective but the operator's /pg/status check fails and failover is deferred, giving users visibility into the deferral via kubectl describe cluster. (#10509)
• Added the ENABLE_WEBHOOK_NAMESPACE_SUFFIX flag, which suffixes the operator's webhook configuration names with - so that multiple operator instances can coexist on the same cluster. The operator only looks up these configurations; users must create and maintain them. Contributed by @maxlengdell. (#10420)
• The operator now reloads a CNPG-i plugin automatically when its pods are rolled: it watches the EndpointSlices backing plugin Services and re-enqueues every cluster using the plugin once the new pods become Ready, so an upgraded plugin is picked up without waiting for the next resync. (#10836)
• Instance serial numbers are now assigned by reusing the lowest free slot among existing instance names, instead of always incrementing a global counter. Pod and PVC names stay stable across instance recreation (for example, an instance recreated after a node drain comes back with the same name), and serials freed by deleted instances are reclaimed. A new Initialized cluster condition reports whether the cluster has completed its first bootstrap, and status.latestGeneratedNode is deprecated: it is no longer written, but is preserved on the CRD for backward compatibility. (#10548)
• Defaulting and validation now run during reconciliation as a fallback when admission webhooks are unavailable, or configured to ignore failures, so the operator no longer reconciles invalid or incomplete specs. Missing defaults are applied directly, and validation failures are surfaced in the resource status instead of failing silently later. (#10874)

Security
• CVE-2026-55769/GHSA-x8c2-3p4r-v9r6: search_path pinning on operator-issued connections: a database owner could plant overloaded built-in operators in the public schema and alter the search_path so that operator introspection probes, running as the cluster superuser, resolved those overloads before pg_catalog, a CWE-426 privilege-escalation chain (same class as CVE-2018-1058) that could lead to in-pod RCE via COPY ... FROM PROGRAM. The operator now pins search_path = pg_catalog, public, pg_temp on every pooled connection so it ships in the startup message and takes precedence over tenant-controlled defaults. (#10774, GHSA-x8c2-3p4r-v9r6)
• GHSA-7qwx-x8ff-3px9: authenticated operator-to-instance-manager calls: the instance manager's remote webserver relied on network isolation rather than authentication for its operator-only control endpoints, so any party able to reach the pod's status port could invoke them, disrupting backup orchestration and WAL archival and reading operational metadata. (The upgrade endpoint is SHA-256-pinned, so this did not permit arbitrary code execution.) The operator now generates an in-memory ECDSA P-256 client certificate at startup and reconciles its SHA-256 fingerprint into the cluster status; the instance manager rejects requests to sensitive endpoints that do not present a matching certificate. This hardening is not backported; earlier releases should continue to restrict the status port with a NetworkPolicy. (#10579, GHSA-7qwx-x8ff-3px9)
• CVE-2026-55765/GHSA-w3gf-xc94-wvmj: operator-side SCRAM-SHA-256 password encoding: the operator now SCRAM-SHA-256 encodes cleartext role passwords before issuing CREATE/ALTER ROLE ... PASSWORD, so the literal PostgreSQL parses (and that extensions such as pg_stat_statements or pgaudit may capture) is the SCRAM verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged, and the per-Secret annotation cnpg.io/passwordPassthrough: "enabled" opts out. (#10724, GHSA-w3gf-xc94-wvmj)

Changes
• Added support for Kubernetes 1.36. (#10900)
• Updated the default PostgreSQL version to 18.4. (#10719)
• Updated the Kubernetes versions used to test the operator on public cloud providers. (#10720, #10563, #11033)

Fixes
• Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever after their cluster was demoted to a replica; the controller now re-checks the replica condition and watches the Cluster so a demotion is detected promptly. (#10871)
• Fixed non-sequential pod names (for example -1, -3) caused by the instance serial counter being advanced before the corresponding Job and PVCs were created; the bump is now persisted only after those resources exist. (#10491)
• Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating on a replica cluster, where the replica gate ran before the finalizer reconciler and the finalizer was never released. On a replica the PostgreSQL object is left to the primary cluster. (#10853)
• Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR; the drop is now gated on a recorded reconciliation. (#10870)
• Fixed the postgres superuser being left locked out after superuser access was disabled and then re-enabled, because the cached secret version was not invalidated and the password was never re-applied. Diagnosed by @mhartmann-jaconi. (#10834)
• Fixed backups getting stuck in the started phase when the instance manager running them was restarted (for example by the in-place upgrade following an operator upgrade) before the backup reached running; the reconciliation is now rescheduled so the lost session is detected. (#10859)
• Fixed exec/attach streaming to negotiate WebSocket with a SPDY fallback, restoring compatibility both with Kubernetes versions that have removed SPDY and with platforms such as OpenShift that reject WebSocket exec upgrades. Contributed by @bartscheers. (#10876, #10933)
• Fixed resource leaks when concurrent Backup objects raced: backups now run in strict creation-time order, so an already-executing backup is never preempted by a newer one and its replication slot and PostgreSQL session are no longer orphaned on the primary. Contributed by @GabriFedi97. (#10747)
• Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched; the role is now left untouched until the Secret becomes available, and per-action errors are aggregated for better visibility. (#10053)
• Fixed a bootstrap failure where a metrics-exporter setup error (commonly a duplicate-key race with the controller) rolled back streaming_replica creation and wedged replica joins. The metrics-exporter step now runs in a separate transaction. Contributed by @BlaiseAntony. (#10749)
• Fixed a ScheduledBackup controller loop that occurred when a Backup was created but its status patch never landed; the controller now adopts an existing Backup for the next iteration instead of looping on AlreadyExists. (#10612)
• Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted. (#10667)
• Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers during WithActiveInstance, preventing regular files from being created in place of the named pipes. (#10043)
• Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets. Contributed by @Infinoid. (#10682)
• Fixed an external cluster plugin still being treated as active when its configuration set enabled: false. (#10932)
• Fixed a race during bootstrap recovery from an object store where the restore job could read a stale Cluster (primary not yet recorded and timeline still unset) and have its .history files rejected by the split-brain guard. When this happened, recovery stopped at the base backup's timeline and silently dropped transactions committed on later timelines. History files are now allowed while the cluster timeline is unset. Contributed by @dennispidun. (#10818)
• Fixed a race where deleting an instance's PVCs could leave the instance permanently stuck: if the data PVC was removed while a WAL PVC was still terminating, the operator recreated the instance bound to the terminating volume, leaving the Pod unschedulable and blocking all further reconciliation. The operator now waits for terminating PVCs to be fully removed before recreating or reattaching an instance, and surfaces the wait through a log line and the cluster phase. (#11017)
• Fixed a cache race during cluster creation when the server and client CA resolve to the same Secret (the default): a stale informer cache triggered a redundant Create that failed with AlreadyExists and could leave the cluster stuck in Unable to create required cluster objects. The operator now reuses the already-fetched CA Secret when the names match. (#10989)
• Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA (for example after a replica Pod restart) by enforcing the same pre-flight directory check already applied by the other bootstrap methods; this also protects statically provisioned PVCs from being silently overwritten. (#11006)
• Fixed the Cluster phase flapping between Healthy and a plugin-failure phase when a post-reconcile plugin hook returned an error; the Healthy phase is now registered as the last step of a successful reconciliation, so a loop that ends in a plugin error never reports Healthy. Contributed by @GabriFedi97. (#10421)
• Fixed stale certificate data and partial reads after an external server's Secret was rotated (for example a CA bundle shrinking from two certificates to one): the file is now written atomically, so libpq always reads either the old or the new value, never a mix. Contributed by @Anand-240. (#10975)
• Fixed plugin connectivity to use the plugin Service FQDN instead of its short name, avoiding failures when a cluster-level proxy is automatically injected into pods. Contributed by @kdautrey. (#10921)
• Fixed excessive operator log noise from the per-request Cluster create/update validation webhook messages, now logged at debug instead of info. (#10984)
• Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives into postgresql.conf; key names are now validated by the webhook. (#11029)
• Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster: with primaryUpdateMethod: switchover the primary could not be rolled out because a clean demotion needs the archiver sidecar that is still missing. The operator now recreates the primary Pod in place so the sidecar is injected and archiving resumes. The check also covers plugins that inject the archiver as a native sidecar (an init container with restartPolicy: Always), such as the Barman Cloud plugin. (#11032, #11059)
• Fixed a cluster staying in Setting up primary indefinitely when the instance-creation Job exhausted its backoff limit; the operator now detects the terminal Job failure and marks the cluster unrecoverable, naming the failed Job and pointing to its logs. (#11035)
• Fixed a first-primary bootstrap deadlock where a status-patch conflict after the data PVC was created but before the initialization Job was started left the orphan Pending PVC counted as an instance, blocking the bootstrap gate; the PVC-state reconciler now recreates the bootstrap Job reusing the assigned serial. (#11039)
• Fixed external cluster names and secret selector references being joined into filesystem paths without validation, letting a .. component or path separator escape the external secrets directory when the instance manager dumps connection material; these values are now rejected at the validating webhook and re-checked at the write site. Reported by @r0binak. (#11045)
• Fixed a backup getting stuck in pending forever: the concurrent-backup gate ran on every reconcile and could overwrite an already-completed phase written asynchronously by the instance manager. The gate now runs only while the backup phase is still unset or pending. (#11056)
• Fixed a declarative VolumeSnapshot backup being permanently marked as failed when a stale cache made the operator re-create a snapshot it had already provisioned, failing with AlreadyExists. The operator now tolerates the collision when the existing snapshot carries this backup's label and adopts it; a collision with a foreign snapshot still surfaces as an error. (#11071)
• Fixed a volume snapshot backup being discarded on a transient instance-manager connection error (for example a dial timeout from a brief pod-network disruption) during the finalize step, even when its snapshots were already provisioned; such network errors are now retried instead of treated as terminal. (#11069)
• Fixed a replica switchover losing its status.demotionToken when a reconcile was requeued between storing the token and cleaning up the transition metadata (for example a cleanup patch failing against a flaky webhook); the empty no-change token is no longer patched back over the stored value. (#11075)
• cnpg plugin:
◦ Fixed kubectl cnpg psql on Windows, where execution relied on a Unix-only system call and failed with "not supported by windows"; Windows now launches kubectl exec as a child process. Contributed by @Utkarsh-sharma47. (#10972)
◦ Fixed an unbounded memory leak in kubectl cnpg logs -f on busy clusters, where a per-log-group timer was never released; timers are now reused across iterations. Contributed by @Anand-240. (#10976)

Supported versions
• Kubernetes 1.36, 1.35, and 1.34
• PostgreSQL 18, 17, 16, 15, and 14
◦ PostgreSQL 18.4 is the default image
◦ PostgreSQL 14 support ends on November 12, 2026

History of user-visible changes in the 1.29 minor release of CloudNativePG.

For a complete list of changes, please refer to the commits on the release branch in GitHub.

Version 1.29.3
Release date: Sep 23, 2026

WARNING
This is the final release in the 1.29.x series. Users are strongly encouraged to upgrade to a newer minor version, as 1.29 is no longer supported.

Enhancements
• Added restoreAdditionalCommandArgs to .barmanObjectStore.data for in-tree Barman Cloud recoveries, so custom flags are forwarded to barman-cloud-restore during recovery. (#11278)
• Plugin authors no longer need to re-derive whether an empty WAL archive should be treated as an error: the operator now computes the check_empty_wal_archive decision once and passes it to CNPG-I plugins on both WAL archiving and restore hooks. (#11216)
• Allowed setting the ssl_ecdh_curve PostgreSQL parameter in .spec.postgresql.parameters. It was previously rejected by the validating webhook even though the operator does not manage it. Contributed by @Jamstah. (#11308)
• Added support for setting auth_user in spec.pgbouncer.parameters to override the user PgBouncer uses for its auth_query connection, instead of always deriving it from the authQuerySecret. Useful with a custom authQuerySecret where the role to authenticate as differs from the one implied by the Secret. Contributed by @jonasbadstuebner. (#10899)
• Fixed PgBouncer metrics silently reporting zero when PgBouncer adds or reorders columns: SHOW STATS and SHOW POOLS results are now matched by column name instead of by position. Contributed by @AdzerKI (SHOW STATS). (#11366, #11464)
• cnpg plugin:
◦ Added a --dry-run option to the backup command that prints the Backup resource that would be created, without creating it. (#11233)

Security and Supply Chain
• Fixed a webhook validation bypass where an absolute extension path with an embedded .. traversal (e.g. /a/../../../../etc) was accepted because only the raw path was checked; such paths still escaped the extension's mount point once resolved at runtime. Affected entries are now resolved and rejected/skipped consistently across admission, the major-upgrade job, and already-persisted Cluster specs. Contributed by @Anand-240. (#11210)
• Updated google.golang.org/grpc to v1.83.1, fixing CVE-2026-84304 / GHSA-vp52-pcj8-j9qc (gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation). (#11394)

Changes
• Updated the default PostgreSQL operand image to 18.6-system-trixie. (#11257)
• Moved the operator's own base image from Debian 12 (bookworm) to Debian 13 (trixie), now that Debian 12 has moved to LTS-only maintenance. (#11193)

Fixes
• Demoted an unreachable old primary immediately during failover, instead of waiting on checkpoint and fast-shutdown attempts that could never complete. Previously, an old primary whose PostgreSQL had become unresponsive was never shut down, so it could never rejoin the cluster as a replica of the new primary. The shutdown is now requested without blocking the reconciler, though demotion can still take up to a minute or more if PostgreSQL keeps ignoring shutdown signals. (#11347)
• Fixed failover and Pod recreation getting stuck while any instance in the cluster was fenced. A fenced instance kept reporting itself as healthy on its status endpoint even though its Pod was permanently not Ready, which blocked the readiness guard, the primary-election logic, and the Pod-reattachment gate from reacting to an unrelated failure elsewhere in the cluster, leaving it stalled until someone manually removed the fencing. All three now recognize and skip fenced instances. (#11274)
• Fixed a failover that could stall forever or get silently reverted. While a failover was pending, the reconciler could skip checking whether it was ready to complete, or mistake the pending state for a missing Pod and reset the target primary back to the unhealthy one. It now keeps progressing a pending failover and completes it once the WAL receivers are down, rechecking quorum safety right before promoting in case it changed while waiting. (#11336)
• Fixed the designated-primary sort in PostgresqlStatusList so a tie on LSN no longer sorts it out of order. If the designated primary's Pod later disappeared from the status list, this could have led the operator to promote the wrong standby. (#11494)
• Stopped abandoning a fast shutdown after 60 seconds. The request carried no explicit timeout, so pg_ctl fell back to its own implicit 60-second limit, and the instance manager, being PID 1 in the container, took PostgreSQL down mid-shutdown regardless of a larger configured stopDelay. The fast phase now waits for the full stopDelay instead. (#11263)
• Waited for certificate status before refreshing secrets during bootstrap. (#11450)
• Fixed in-tree Barman Cloud recovery ignoring wal.maxParallel and wal.restoreAdditionalCommandArgs, fetching WAL one segment at a time instead of using the configured parallelism. (#11105)
• Honored the unrecoverable annotation on pending and terminating instances. (#11241)
• Honored Backup.spec.online when finalizing VolumeSnapshot-based backups, so a cold backup is no longer reported as online in status. (#11276)
• Retried volume snapshot backups on transient instance-manager connection errors (e.g. a dial timeout from a brief pod-network disruption), instead of failing the backup outright. (#11069)
• Set --no-data-checksums explicitly when .spec.postgresql.dataChecksums is false on PostgreSQL 18+, which now enables checksums by default in initdb. Contributed by @evan314159. (#11488)
• Stopped discarding .spec.inheritedMetadata labels on PVC reconciliation; they were applied before, and then overwritten by, the operator's own labels. Contributed by @GellertBabel. (#11499)
• Stopped Pooler and DatabaseRole from recreating their owned resources after being marked for deletion, which could block an external finalizer (e.g. ArgoCD foreground deletion) waiting for those resources to disappear. Contributed by @mjlshen. (#11359)
• Handled a NULL stats_reset value in the pg_stat_wal metric, which could occasionally break Prometheus scraping on PostgreSQL 18 clusters. Contributed by @HoniSanders. (#11207)
• Recovered log streaming when a stale non-FIFO file blocked the log pipe. (#11246)
• Stopped sampling logs of the Pods' processes, so no log lines are silently dropped. (#11131)
• Stopped caching Helm release Secrets in the operator, which could spike memory usage and crashloop the operator on clusters with large Helm releases installed alongside it. (#11211)
• Re-ran owned-resource finalizer cleanup after an operator restart, so a namespace deleted while the operator was down doesn't hang in Terminating forever. (#11215)
• Fixed rejoining replicas taking a long time to complete pg_rewind when WAL prefetching (wal.maxParallel > 1) was enabled. (#11204)
• Treated a PostgreSQL instance rejecting connections as started up in probes. (#11152)
• Stopped issuing a redundant PATCH on every reconciliation when a cluster's pvcTemplate set volumeAttributesClass. Contributed by @andrew-farries. (#11196)
• Stopped halting replication slot reconciliation at the first failing slot. (#11119)
• During rollouts, compared the running configuration hash, rather than the on-disk one, avoiding unnecessary switchovers. (#11130)
• Retried VolumeSnapshot errors until the deadline, instead of giving up early. (#11132)
• Symlinked pg_wal to the WAL volume during plugin-based recovery, instead of replaying WAL onto the data volume, which could exhaust it on a large point-in-time recovery. (#11127)
• Corrected grammar in PhaseUpgradeDelayed status messages. Contributed by @Utkarsh-sharma47. (#11065)
• CloudNativePG Interface (CNPG-I):
◦ Reported the Postgres capabilities of a plugin correctly. (#11447)
◦ Prevented the plugin status field from flapping on Cluster reconciliation. Contributed by @sharifmshaker. (#11386)
◦ Replaced a finalizer with in-memory cleanup on Service deletion. This avoids namespaces hanging in Terminating state when the operator and its plugins run in the same namespace. Contributed by @maxlengdell. (#10940)
• cnpg plugin:
◦ Used UTC time zone for the default backup name. (#11329)
◦ Deleted PVCs before Pods in cnpg destroy, avoiding a race that could leave dangling PVCs needing a second invocation to clean up. Contributed by @daanvinken. (#10847)

Version 1.29.2
Release date: Jun 29, 2026

Important changes
• Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.31.0, rather than 1.30.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#11083)
• The cluster reference is now immutable on the Database, Pooler, Publication, Subscription, and ScheduledBackup resources. Pointing one of these objects at a different cluster has no well-defined semantics and previously left the controllers in an inconsistent state; the update is now rejected at the API server via a CEL validation rule. (#10743)

Enhancements
• Enabled pg_upgrade in-place major upgrades to PostgreSQL 19 or later for clusters that use Image Volume extensions, building on the extension-path support added to pg_upgrade in PostgreSQL 19. During the upgrade Job, the source- and target-version extension images are mounted side by side, so the old server keeps its libraries and a failed upgrade reverts cleanly. (#10366)
• Added a label selector to the Cluster scale subresource (status.selector), making a Cluster a valid targetRef for the Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map a Cluster to its instance pods. Contributed by @sebv004. (#8996)
• The operator now emits a Warning PrimaryStatusCheckFailed event on the Cluster when the primary pod is Ready from the kubelet perspective but the operator's /pg/status check fails and failover is deferred, giving users visibility into the deferral via kubectl describe cluster. (#10509)
• The operator now reloads a CNPG-i plugin automatically when its pods are rolled: it watches the EndpointSlices backing plugin Services and re-enqueues every cluster using the plugin once the new pods become Ready, so an upgraded plugin is picked up without waiting for the next resync. (#10836)

Security and Supply Chain
• CVE-2026-55769 / GHSA-x8c2-3p4r-v9r6: search_path pinning on operator-issued connections: a database owner could plant overloaded built-in operators in the public schema and alter the search_path so that operator introspection probes, running as the cluster superuser, resolved those overloads before pg_catalog, a CWE-426 privilege-escalation chain (same class as CVE-2018-1058) that could lead to in-pod RCE via COPY ... FROM PROGRAM. The operator now pins search_path = pg_catalog, public, pg_temp on every pooled connection so it ships in the startup message and takes precedence over tenant-controlled defaults. (#10774, GHSA-x8c2-3p4r-v9r6)
• CVE-2026-55765 / GHSA-w3gf-xc94-wvmj: operator-side SCRAM-SHA-256 password encoding: the operator now SCRAM-SHA-256 encodes cleartext role passwords before issuing CREATE / ALTER ROLE ... PASSWORD, so the literal PostgreSQL parses (and that extensions such as pg_stat_statements or pgaudit may capture) is the SCRAM verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged, and the per-Secret annotation cnpg.io/passwordPassthrough: "enabled" opts out. (#10724, GHSA-w3gf-xc94-wvmj)

Changes
• Added support for Kubernetes 1.36. (#10900)
• Updated the default PostgreSQL version to 18.4. (#10719)
• Updated the Kubernetes versions used to test the operator on public cloud providers. (#10720, #10563, #11033)

Fixes
• Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives into postgresql.conf; key names are now validated by the webhook. (#11029)
• Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever after their cluster was demoted to a replica; the controller now re-checks the replica condition and watches the Cluster so a demotion is detected promptly. (#10871)
• Fixed non-sequential pod names (for example -1, -3) caused by the instance serial counter being advanced before the corresponding Job and PVCs were created; the bump is now persisted only after those resources exist. (#10491)
• Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster: with primaryUpdateMethod: switchover the primary could not be rolled out because a clean demotion needs the archiver sidecar that is still missing. The operator now recreates the primary Pod in place so the sidecar is injected and archiving resumes. The check also covers plugins that inject the archiver as a native sidecar (an init container with restartPolicy: Always), such as the Barman Cloud plugin. (#11032, #11059)
• Fixed a cluster staying in Setting up primary indefinitely when the instance-creation Job exhausted its backoff limit; the operator now detects the terminal Job failure and marks the cluster unrecoverable, naming the failed Job and pointing to its logs. (#11035)
• Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating on a replica cluster, where the replica gate ran before the finalizer reconciler and the finalizer was never released. On a replica the PostgreSQL object is left to the primary cluster. (#10853)
• Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR; the drop is now gated on a recorded reconciliation. (#10870)
• Fixed the postgres superuser being left locked out after superuser access was disabled and then re-enabled, because the cached secret version was not invalidated and the password was never re-applied. Diagnosed by @mhartmann-jaconi. (#10834)
• Fixed backups getting stuck in the started phase when the instance manager running them was restarted (for example by the in-place upgrade following an operator upgrade) before the backup reached running; the reconciliation is now rescheduled so the lost session is detected. (#10859)
• Fixed exec/attach streaming to negotiate WebSocket with a SPDY fallback, restoring compatibility both with Kubernetes versions that have removed SPDY and with platforms such as OpenShift that reject WebSocket exec upgrades. Contributed by @bartscheers. (#10876, #10933)
• Fixed resource leaks when concurrent Backup objects raced: backups now run in strict creation-time order, so an already-executing backup is never preempted by a newer one and its replication slot and PostgreSQL session are no longer orphaned on the primary. Contributed by @GabriFedi97. (#10747)
• Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched; the role is now left untouched until the Secret becomes available, and per-action errors are aggregated for better visibility. (#10053)
• Fixed a bootstrap failure where a metrics-exporter setup error (commonly a duplicate-key race with the controller) rolled back streaming_replica creation and wedged replica joins. The metrics-exporter step now runs in a separate transaction. Contributed by @BlaiseAntony. (#10749)
• Fixed a ScheduledBackup controller loop that occurred when a Backup was created but its status patch never landed; the controller now adopts an existing Backup for the next iteration instead of looping on AlreadyExists. (#10612)
• Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted. (#10667)
• Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers during WithActiveInstance, preventing regular files from being created in place of the named pipes. (#10043)
• Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets. Contributed by @Infinoid. (#10682)
• Fixed an external cluster plugin still being treated as active when its configuration set enabled: false. (#10932)
• Fixed a race during bootstrap recovery from an object store where the restore job could read a stale Cluster (primary not yet recorded and timeline still unset) and have its .history files rejected by the split-brain guard. When this happened, recovery stopped at the base backup's timeline and silently dropped transactions committed on later timelines. History files are now allowed while the cluster timeline is unset. Contributed by @dennispidun. (#10818)
• Fixed a cache race during cluster creation when the server and client CA resolve to the same Secret (the default): a stale informer cache triggered a redundant Create that failed with AlreadyExists and could leave the cluster stuck in Unable to create required cluster objects. The operator now reuses the already-fetched CA Secret when the names match. (#10989)
• Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA (for example after a replica Pod restart) by enforcing the same pre-flight directory check already applied by the other bootstrap methods; this also protects statically provisioned PVCs from being silently overwritten. (#11006)
• Fixed the Cluster phase flapping between Healthy and a plugin-failure phase when a post-reconcile plugin hook returned an error; the Healthy phase is now registered as the last step of a successful reconciliation, so a loop that ends in a plugin error never reports Healthy. Contributed by @GabriFedi97. (#10421)
• Fixed stale certificate data and partial reads after an external server's Secret was rotated (for example a CA bundle shrinking from two certificates to one): the file is now written atomically, so libpq always reads either the old or the new value, never a mix. Contributed by @Anand-240. (#10975)
• Fixed plugin connectivity to use the plugin Service FQDN instead of its short name, avoiding failures when a cluster-level proxy is automatically injected into pods. Contributed by @kdautrey. (#10921)
• Fixed excessive operator log noise from the per-request Cluster create/update validation webhook messages, now logged at debug instead of info. (#10984)
• Fixed a first-primary bootstrap deadlock where a status-patch conflict after the data PVC was created but before the initialization Job was started left the orphan Pending PVC counted as an instance, blocking the bootstrap gate; the PVC-state reconciler now recreates the bootstrap Job reusing the assigned serial. (#11039)
• Fixed external cluster names and secret selector references being joined into filesystem paths without validation, letting a .. component or path separator escape the external secrets directory when the instance manager dumps connection material; these values are now rejected at the validating webhook and re-checked at the write site. Reported by @r0binak. (#11045)
• Fixed a backup getting stuck in pending forever: the concurrent-backup gate ran on every reconcile and could overwrite an already-completed phase written asynchronously by the instance manager. The gate now runs only while the backup phase is still unset or pending. (#11056)
• Fixed a declarative VolumeSnapshot backup being permanently marked as failed when a stale cache made the operator re-create a snapshot it had already provisioned, failing with AlreadyExists. The operator now tolerates the collision when the existing snapshot carries this backup's label and adopts it; a collision with a foreign snapshot still surfaces as an error. (#11071)
• Fixed a volume snapshot backup being discarded on a transient instance-manager connection error (for example a dial timeout from a brief pod-network disruption) during the finalize step, even when its snapshots were already provisioned; such network errors are now retried instead of treated as terminal. (#11069)
• Fixed a replica switchover losing its status.demotionToken when a reconcile was requeued between storing the token and cleaning up the transition metadata (for example a cleanup patch failing against a flaky webhook); the empty no-change token is no longer patched back over the stored value. (#11075)
• cnpg plugin:
◦ Fixed kubectl cnpg psql on Windows, where execution relied on a Unix-only system call and failed with "not supported by windows"; Windows now launches kubectl exec as a child process. Contributed by @Utkarsh-sharma47. (#10972)
◦ Fixed an unbounded memory leak in kubectl cnpg logs -f on busy clusters, where a per-log-group timer was never released; timers are now reused across iterations. Contributed by @Anand-240. (#10976)

Version 1.29.1
Release date: May 8, 2026

Security and Supply Chain
• CVE-2026-44477 / GHSA-423p-g724-fr39: metrics exporter privilege escalation: the metrics exporter no longer authenticates as the postgres superuser. It now uses a dedicated cnpg_metrics_exporter role with pg_monitor privileges only, closing a chain that let a low-privilege database user gain PostgreSQL superuser. (GHSA-423p-g724-fr39)
Upgrade impact: custom monitoring queries that read user-owned tables, or use target_databases: '*' against databases where PUBLIC CONNECT has been revoked, need explicit GRANT statements to cnpg_metrics_exporter. See "Custom query privileges and safety" and "Manually creating the metrics exporter role" in the monitoring documentation.
For replica clusters, upgrade the source primary cluster before any replica clusters that consume from it. The cnpg_metrics_exporter role is created on the source primary and replicates downstream; a replica cluster upgraded first will scrape against a missing role until the source primary upgrades. The manual-recovery section linked above also covers replica clusters.
• Schema-qualified catalog references in default monitoring queries: hardened the shipped monitoring configuration and documentation samples by qualifying every pg_catalog object explicitly. Unqualified references resolve through search_path, which a database user can manipulate to shadow built-in objects. (#10576)
• Discoverable SBOM and provenance attestations: SBOM and SLSA provenance attached to operator container images now follow the OCI 1.1 Referrers spec, so standard registry tooling and supply-chain scanners can discover them automatically. (#10601)
• CVE remediation in github.com/jackc/pgx/v5: bumped to v5.9.2 to pick up upstream fixes for CVE-2026-33816 (memory-safety in pgproto3) and GHSA-j88v-2chj-qfwx (SQL injection via simple-protocol dollar-quoted string handling). (#10437, #10499)
• CVE remediation in the Go runtime: built with Go 1.26.3 to pick up upstream fixes in crypto/x509, crypto/tls, net/http, and net (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814, CVE-2026-33811, CVE-2026-39825). (#10463, #10647)
• Build pipeline hardening: the Go 1.26.3 bump also addresses CVE-2026-42501 (cmd/go module-checksum validation), reducing supply-chain exposure during release builds. The affected code paths are not reachable from the running operator. (#10647)

Changes
• Switched TLS peer verification from VerifyPeerCertificate to VerifyConnection, which runs on every completed handshake (the former is skipped on resumed TLS 1.3 sessions). Session resumption is not enabled in CloudNativePG today, so this has no observable effect, but it future-proofs verification if session caching is introduced later. (#10478)

Fixes
• Fixed a failover window where the former primary kept its primary label. If it returned during failover (for example, after a transient network partition), the -rw service kept routing to it, replicas could reconnect, and committed writes were lost to pg_rewind. The old primary is now labeled unhealthy to isolate it from service traffic during failover. (#10409)
• Fixed failover not being triggered when the node hosting the primary becomes unreachable. The operator now reads the pod's Ready condition (flipped to False by the node controller when the kubelet stops reporting) instead of ContainersReady, which stays stale as True in that scenario. Combined with the spurious-failover guard (#10445), failover triggers only when Kubernetes itself marks the pod not Ready. (#10448)
• Fixed spurious failovers caused by transient failures on the primary's HTTP status endpoint. (#10445)
• Fixed escaping of backslashes and control characters in PostgreSQL configuration values. Previously, such characters in parameters like log_line_prefix could corrupt the configuration file or be silently stripped at runtime. (#10515)
• Fixed restore_command construction to shell-quote each argument. Values such as a destinationPath containing whitespace (for example, s3://my bucket/wal) were word-split by the POSIX shell and passed to the WAL restore tool as separate arguments. (#10518)
• Tightened recoveryTarget validation in the admission webhook: targetXID must now be a non-negative 32-bit integer, and targetName must be shorter than 64 bytes and free of ASCII control characters. Malformed values are rejected at admission instead of failing later during PostgreSQL recovery. (#10565)
• Fixed snapshot restores failing when leftover pgsql_tmp* directories were present in the data directory. (#10447)
• Fixed a deadlock occurring when PVC storage size and resource requests are changed simultaneously. (#10427)

Version 1.29.0
Release date: Mar 31, 2026

Important changes
• Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#10167)

Features
• PostgreSQL extensions in image catalogs: extended the ImageCatalog functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. (#9781)
• Dynamic network access control via pod selectors: introduced the declarative definition of podSelectorRefs to manage pg_hba.conf rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. (#10148)
• Shared ServiceAccount support: added an optional serviceAccountName field to both Cluster and Pooler specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by @bozkayasalihx. (#9287)

Enhancements
• Improved the Pooler CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by @alex1989hu. (#9571)
• Improved the reliability of major upgrades by setting BackoffLimit=0 on the upgrade job, preventing unnecessary retries of a failed pg_upgrade. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. (#10104, #10298)
• Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through kubectl get events. (#10040)
• Extended support for the cnpg.io/reconciliationDisabled annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by @GabriFedi97. (#10020)
• Added a bin_path field to the postgresql.extensions stanza, as well as in ImageCatalog and ClusterImageCatalog resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the PATH environment variable of the Postgres process. (#10250)
• Added an env field to the postgresql.extensions stanza, as well as in ImageCatalog and ClusterImageCatalog resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the ${image_root} placeholder to dynamically resolve to the extension's absolute mount path. (#10375)
• Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. (#9560)
• Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. (#9971)
• The operator now honors the primaryUpdateMethod when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. (#9720)
• Refined the alpha.cnpg.io/unrecoverable annotation logic to allow it to function even on pods that have not yet reached the Ready state, facilitating the recovery of stuck instances. (#9968)
• Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. (#9353)
• Improved monitoring of long-running backups by introducing reconciliationStartedAt and reconciliationTerminatedAt fields to the Backup status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (startedAt/stoppedAt), allowing users to track when the operator begins processing a request. (#9351)
• Added a Pending phase to the Backup status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. (#9364)

Security and Supply Chain
• Security best practices integration: integrated the OpenSSF baseline scanner and added a SECURITY-INSIGHTS.yaml file to the repository to align with industry-standard security reporting. (#10054, #10062)
• SLSA provenance and SBOMs: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. (#10048, #10074)
• Password leak prevention: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. (#9950)

Changes
• Updated the default PostgreSQL version to 18.3 (image 18.3-system-trixie). (#10090)

Fixes
• Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. (#10342)
• Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. (#10302)
• Fixed an issue where replicas would get stuck in a Pending state if the VolumeSnapshot used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to pg_basebackup. (#10192)
• Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by @ermakov-oleg. (#9977)
• Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. (#9952)
• Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by @sharifmshaker. (#9978)
• Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by @jmealo. (#9981)
• Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with ConnectionParameters (for pg_basebackup-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. (#10268)
• Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. (#9973)
• When hibernating a non-healthy cluster, the operator now reports a WaitingForHealthy condition, making the deferred hibernation state visible through cnpg status. (#10193)
• Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the cnpg fencing on command. (#10035)
• Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as loadBalancerClass) from being inadvertently removed. (#10190, #10311)
• Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. (#10285)
• Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in #9650 only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. (#9849)
• cnpg plugin:
◦ The cnpg plugin now correctly propagates ImagePullSecrets to the pgbench Job pod template. (#10174)

Supported versions
• Kubernetes 1.35, 1.34, and 1.33
• PostgreSQL 18, 17, 16, 15, and 14
◦ PostgreSQL 18.3 is the default image
◦ PostgreSQL 14 support ends on November 12, 2026

The CloudNativePG Community is excited to announce the immediate availability of CloudNativePG 1.30.0!

This minor release introduces the new DatabaseRole CRD for declarative, GitOps-friendly PostgreSQL role management and a Lease-based primary election primitive for safer failover, alongside notable security and operational improvements, further cementing CloudNativePG as the leading operator for running PostgreSQL workloads on Kubernetes.

We are also pleased to announce the release of maintenance versions 1.29.2 and 1.28.4, the latter of which is the final planned release in the 1.28.x series. We encourage users on 1.28 to plan their upgrade to 1.29 or 1.30.

With the release of CloudNativePG 1.30.0, the CloudNativePG 1.28.x series reaches its End-of-Life (EOL) date of June 30, 2026, and the EOL date for the CloudNativePG 1.29.x series is confirmed as September 29, 2026.

Highlights in 1.30.0

DatabaseRole CRD for declarative role management

The headline addition in 1.30 is the new DatabaseRole custom resource, which manages a PostgreSQL role as a standalone Kubernetes object rather than inline in the Cluster’s .spec.managed.roles stanza. Each role now has its own lifecycle, status and RBAC, which suits GitOps workflows and lets role definitions live next to the applications that own them. Migrating an existing role is a matter of moving its stanza into a dedicated manifest.

A DatabaseRole can also include a clientCertificate block, having the operator automatically generate and renew a TLS client certificate signed by the cluster’s client CA and stored in a -client-cert Secret. This enables password-free PostgreSQL cert authentication, with the Secret cleaned up automatically when the feature is disabled or the resource is deleted.

Primary Lease for safe primary election

CloudNativePG 1.30 introduces a Kubernetes Lease object, named after the cluster, that acts as a mutex serializing primary promotion. The instance manager must hold the lease before acting as primary and releases it on clean shutdown, so replicas can promote without waiting for the full TTL. Timings are configurable through the new .spec.primaryLease stanza.

To be precise about the architecture: the lease is a promotion gate, not a fence. Primary isolation remains responsible for fencing — the Lease closes the window for an uncoordinated promotion during transitions.

Enhanced Security and Resilience

This release includes significant improvements focused on stability, security, and supply-chain integrity:

• search_path pinning (CVE-2026-55769): Fixed a privilege-escalation vulnerability (CWE-426) where a database owner could plant overloaded operators in the public schema. The operator now pins search_path = pg_catalog, public, pg_temp on its pooled connections.
• SCRAM-SHA-256 password encoding (CVE-2026-55765): The operator now SCRAM-SHA-256 encodes cleartext passwords before issuing CREATE/ALTER ROLE commands, so the SCRAM verifier — rather than the cleartext secret — is what could ever appear in logs or extension captures.
• Authenticated instance communication (GHSA-7qwx-x8ff-3px9): Operator-to-instance-manager communication is now authenticated via ECDSA certificates. This hardening is new in 1.30.0 and is not backported; on earlier releases continue to restrict the instance status port with a NetworkPolicy.

Other Notable Enhancements

• In-place major upgrades with Image Volume extensions — pg_upgrade in-place upgrades are now supported for clusters using Image Volume extensions, mounting the source- and target-version extension images side by side so a failed upgrade reverts cleanly.
• PgBouncer image management via Image Catalogs — the Pooler can now reference an ImageCatalog or ClusterImageCatalog entry through spec.pgbouncer.imageCatalogRef, with referencing Poolers automatically reconciled and rolled out when a catalog entry changes.
• TLS for the Pooler metrics endpoint via .spec.monitoring.tls.enabled, with hot certificate reloading on every handshake.
• Cluster as a VPA/HPA target through a new status.selector on the scale subresource, mapping a Cluster to its instance pods.
• Primary status visibility — the operator now emits a PrimaryStatusCheckFailed warning event when a primary pod looks Ready to the kubelet but fails the operator’s /pg/status check, surfacing failover deferrals via kubectl describe cluster.

This release also adds support for Kubernetes 1.36 and updates the default PostgreSQL version to 18.4.

Heads-up on an API change: the cluster reference is now immutable on the Database, Pooler, Publication, Subscription and ScheduledBackup resources. Re-pointing one of these at a different cluster is now rejected by a CEL validation rule at the API server, as it had no well-defined semantics.

Dive into the full list of changes and fixes in the release notes for CloudNativePG 1.30.

Maintenance Releases: 1.29.2 & 1.28.4

In parallel with the 1.30 release, we have also shipped maintenance updates for the previous stable series. Both backport the security fixes above — including search_path pinning and SCRAM-SHA-256 password encoding — along with VPA/HPA support, primary status visibility, automatic CNPG-I plugin reloading, Kubernetes 1.36 support, the updated PostgreSQL 18.4 default, and dozens of bug fixes:

• CloudNativePG 1.29.2: see the release notes for 1.29.
• CloudNativePG 1.28.4: the final planned maintenance release for the 1.28.x series — see the release notes for 1.28. We strongly recommend planning an upgrade to a currently supported version.

We encourage all users to upgrade to the latest stable versions to benefit from the latest features, security enhancements, and bug fixes.

Follow the upgrade instructions for a smooth transition.

Get Involved with the Community

Join us to help shape the future of cloud-native Postgres!

If you’re using CloudNativePG in production, consider adding your organization as an adopter to support the project’s growth and evolution.

Thank you for your continued support! Upgrade today and discover how CloudNativePG can elevate your PostgreSQL experience to new heights.

History of user-visible changes in the 1.28 minor release of CloudNativePG.

For a complete list of changes, please refer to the commits on the release branch in GitHub.

Version 1.28.4

Release date: Jun 29, 2026

WARNING

This is the final release in the 1.28.x series. Users are strongly encouraged to upgrade to a newer minor version, as 1.28 is no longer supported.

Important changes

• Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.31.0, rather than 1.30.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#11083)
• The cluster reference is now immutable on the Database, Pooler, Publication, Subscription, and ScheduledBackup resources. Pointing one of these objects at a different cluster has no well-defined semantics and previously left the controllers in an inconsistent state; the update is now rejected at the API server via a CEL validation rule. (#10743)

Enhancements

• Added a label selector to the Cluster scale subresource (status.selector), making a Cluster a valid targetRef for the Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map a Cluster to its instance pods. Contributed by @sebv004. (#8996)
• The operator now emits a Warning PrimaryStatusCheckFailed event on the Cluster when the primary pod is Ready from the kubelet perspective but the operator's /pg/status check fails and failover is deferred, giving users visibility into the deferral via kubectl describe cluster. (#10509)
• The operator now reloads a CNPG-i plugin automatically when its pods are rolled: it watches the EndpointSlices backing plugin Services and re-enqueues every cluster using the plugin once the new pods become Ready, so an upgraded plugin is picked up without waiting for the next resync. (#10836)

Security and Supply Chain

• CVE-2026-55769/GHSA-x8c2-3p4r-v9r6: search_path pinning on operator-issued connections: a database owner could plant overloaded built-in operators in the public schema and alter the search_path so that operator introspection probes, running as the cluster superuser, resolved those overloads before pg_catalog, a CWE-426 privilege-escalation chain (same class as CVE-2018-1058) that could lead to in-pod RCE via COPY ... FROM PROGRAM. The operator now pins search_path = pg_catalog, public, pg_temp on every pooled connection so it ships in the startup message and takes precedence over tenant-controlled defaults. (#10774, GHSA-x8c2-3p4r-v9r6)
• CVE-2026-55765/GHSA-w3gf-xc94-wvmj: operator-side SCRAM-SHA-256 password encoding: the operator now SCRAM-SHA-256 encodes cleartext role passwords before issuing CREATE/ALTER ROLE ... PASSWORD, so the literal PostgreSQL parses (and that extensions such as pg_stat_statements or pgaudit may capture) is the SCRAM verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged, and the per-Secret annotation cnpg.io/passwordPassthrough: "enabled" opts out. (#10724, GHSA-w3gf-xc94-wvmj)

Changes

• Added support for Kubernetes 1.35 and enabled unit tests on Kubernetes 1.36. (#10900)
• Updated the default PostgreSQL version to 18.4. (#10719)
• Updated the Kubernetes versions used to test the operator on public cloud providers. (#10720, #10563, #11033)

Fixes

• Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives into postgresql.conf; key names are now validated by the webhook. (#11029)
• Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever after their cluster was demoted to a replica; the controller now re-checks the replica condition and watches the Cluster so a demotion is detected promptly. (#10871)
• Fixed non-sequential pod names (for example -1, -3) caused by the instance serial counter being advanced before the corresponding Job and PVCs were created; the bump is now persisted only after those resources exist. (#10491)
• Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster: with primaryUpdateMethod: switchover the primary could not be rolled out because a clean demotion needs the archiver sidecar that is still missing. The operator now recreates the primary Pod in place so the sidecar is injected and archiving resumes. The check also covers plugins that inject the archiver as a native sidecar (an init container with restartPolicy: Always), such as the Barman Cloud plugin. (#11032, #11059)
• Fixed a cluster staying in Setting up primary indefinitely when the instance-creation Job exhausted its backoff limit; the operator now detects the terminal Job failure and marks the cluster unrecoverable, naming the failed Job and pointing to its logs. (#11035)
• Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating on a replica cluster, where the replica gate ran before the finalizer reconciler and the finalizer was never released. On a replica the PostgreSQL object is left to the primary cluster. (#10853)
• Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR; the drop is now gated on a recorded reconciliation. (#10870)
• Fixed the postgres superuser being left locked out after superuser access was disabled and then re-enabled, because the cached secret version was not invalidated and the password was never re-applied. Diagnosed by @mhartmann-jaconi. (#10834)
• Fixed backups getting stuck in the started phase when the instance manager running them was restarted before the backup reached running; the reconciliation is now rescheduled so the lost session is detected. (#10859)
• Fixed resource leaks when concurrent Backup objects raced: backups now run in strict creation-time order, so an already-executing backup is never preempted by a newer one and its replication slot and PostgreSQL session are no longer orphaned on the primary. Contributed by @GabriFedi97. (#10747)
• Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched; the role is now left untouched until the Secret becomes available, and per-action errors are aggregated for better visibility. (#10053)
• Fixed a bootstrap failure where a metrics-exporter setup error rolled back streaming_replica creation and wedged replica joins. The metrics-exporter step now runs in a separate transaction. Contributed by @BlaiseAntony. (#10749)
• Fixed a ScheduledBackup controller loop that occurred when a Backup was created but its status patch never landed; the controller now adopts an existing Backup for the next iteration instead of looping on AlreadyExists. (#10612)
• Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted. (#10667)
• Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers during WithActiveInstance, preventing regular files from being created in place of the named pipes. (#10043)
• Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets. Contributed by @Infinoid. (#10682)
• Fixed an external cluster plugin still being treated as active when its configuration set enabled: false. (#10932)
• Fixed a race during bootstrap recovery from an object store where the restore job could read a stale Cluster and have its .history files rejected by the split-brain guard. History files are now allowed while the cluster timeline is unset. Contributed by @dennispidun. (#10818)
• Fixed a cache race during cluster creation when the server and client CA resolve to the same Secret: the operator now reuses the already-fetched CA Secret when the names match. (#10989)
• Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA by enforcing the same pre-flight directory check already applied by the other bootstrap methods; this also protects statically provisioned PVCs from being silently overwritten. (#11006)
• Fixed the Cluster phase flapping between Healthy and a plugin-failure phase when a post-reconcile plugin hook returned an error; the Healthy phase is now registered as the last step of a successful reconciliation. Contributed by @GabriFedi97. (#10421)
• Fixed stale certificate data and partial reads after an external server's Secret was rotated: the file is now written atomically. Contributed by @Anand-240. (#10975)
• Fixed plugin connectivity to use the plugin Service FQDN instead of its short name. Contributed by @kdautrey. (#10921)
• Fixed excessive operator log noise from per-request Cluster create/update validation webhook messages, now logged at debug instead of info. (#10984)
• Fixed a first-primary bootstrap deadlock where a status-patch conflict left an orphan Pending PVC counted as an instance; the PVC-state reconciler now recreates the bootstrap Job reusing the assigned serial. (#11039)
• Fixed external cluster names and secret selector references being joined into filesystem paths without validation; these values are now rejected at the validating webhook and re-checked at the write site. Reported by @r0binak. (#11045)
• Fixed a declarative VolumeSnapshot backup being permanently marked as failed when a stale cache made the operator re-create a snapshot it had already provisioned; the operator now tolerates the collision when the existing snapshot carries this backup's label and adopts it. (#11071)
• Fixed a volume snapshot backup being discarded on a transient instance-manager connection error during the finalize step; such network errors are now retried instead of treated as terminal. (#11069)
• Fixed a replica switchover losing its status.demotionToken; the empty no-change token is no longer patched back over the stored value. (#11075)
• cnpg plugin:
  • Fixed kubectl cnpg psql on Windows; Windows now launches kubectl exec as a child process. Contributed by @Utkarsh-sharma47. (#10972)
  • Fixed an unbounded memory leak in kubectl cnpg logs -f on busy clusters; timers are now reused across iterations. Contributed by @Anand-240. (#10976)

Version 1.28.3

Release date: May 8, 2026

Security and Supply Chain

• CVE-2026-44477/GHSA-423p-g724-fr39: metrics exporter privilege escalation: the metrics exporter no longer authenticates as the postgres superuser. It now uses a dedicated cnpg_metrics_exporter role with pg_monitor privileges only, closing a chain that let a low-privilege database user gain PostgreSQL superuser. (GHSA-423p-g724-fr39)

  Upgrade impact: custom monitoring queries that read user-owned tables, or use target_databases: '*' against databases where PUBLIC CONNECT has been revoked, need explicit GRANT statements to cnpg_metrics_exporter. See "Custom query privileges and safety" and "Manually creating the metrics exporter role" in the monitoring documentation.

  For replica clusters, upgrade the source primary cluster before any replica clusters that consume from it. The cnpg_metrics_exporter role is created on the source primary and replicates downstream; a replica cluster upgraded first will scrape against a missing role until the source primary upgrades. The manual-recovery section linked above also covers replica clusters.

• Schema-qualified catalog references in default monitoring queries: hardened the shipped monitoring configuration and documentation samples by qualifying every pg_catalog object explicitly. (#10576)

• Discoverable SBOM and provenance attestations: SBOM and SLSA provenance attached to operator container images now follow the OCI 1.1 Referrers spec. (#10601)

• CVE remediation in github.com/jackc/pgx/v5: bumped to v5.9.2 to pick up upstream fixes for CVE-2026-33816 and GHSA-j88v-2chj-qfwx. (#10436, #10498)

• CVE remediation in the Go runtime: built with Go 1.26.3 to pick up upstream fixes. (#10462, #10647)

• Build pipeline hardening: the Go 1.26.3 bump also addresses CVE-2026-42501. (#10647)

Changes

• Switched TLS peer verification from VerifyPeerCertificate to VerifyConnection. (#10478)

Fixes

• Fixed a failover window where the former primary kept its primary label; the old primary is now labeled unhealthy to isolate it from service traffic during failover. (#10409)
• Fixed failover not being triggered when the node hosting the primary becomes unreachable; the operator now reads the pod's Ready condition instead of ContainersReady. (#10448)
• Fixed spurious failovers caused by transient failures on the primary's HTTP status endpoint. (#10445)
• Fixed escaping of backslashes and control characters in PostgreSQL configuration values. (#10515)
• Fixed restore_command construction to shell-quote each argument. (#10518)
• Tightened recoveryTarget validation in the admission webhook. (#10565)
• Fixed snapshot restores failing when leftover pgsql_tmp* directories were present in the data directory. (#10447)
• Fixed a deadlock occurring when PVC storage size and resource requests are changed simultaneously. (#10427)

Version 1.28.2

Release date: Mar 31, 2026

Important changes

• Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#10167)

Enhancements

• Improved the Pooler CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. (#9571)
• Improved the reliability of major upgrades by setting BackoffLimit=0 on the upgrade job. (#10104, #10298)
• Improved role management by verifying the instance is the primary before each reconciliation cycle. (#9971)
• Extended the CRD schemas for Cluster, ImageCatalog, and ClusterImageCatalog to accept the extensions, bin_path, and env fields introduced in 1.29. (#10131, #10387)
• The operator now honors primaryUpdateMethod when adding new PVCs to a cluster. (#9720)
• Refined the alpha.cnpg.io/unrecoverable annotation logic to allow it to function even on pods that have not yet reached the Ready state. (#9968)

Security and Supply Chain

• Security best practices integration: integrated the OpenSSF baseline scanner and added a SECURITY-INSIGHTS.yaml file. (#10054, #10062)
• SLSA provenance and SBOMs: added SLSA provenance to release binaries and container images and enabled SBOM generation. (#10048, #10074)
• Password leak prevention: fixed a potential security risk where PostgreSQL could leak role passwords in the logs. (#9950)

Changes

• Updated the default PostgreSQL version to 18.3 (image 18.3-system-trixie). (#10090)

Fixes

• Fixed a deadlock during operator upgrades affecting clusters using synchronous replication. (#10342)
• Fixed an issue where fencing annotations could not be processed when the WAL disk was full. (#10302)
• Fixed replicas getting stuck in Pending when the VolumeSnapshot used for initial bootstrap had been deleted. (#10192)
• Prevented the supervised primary rollout strategy from consuming all available rollout slots. (#9977)
• Fixed hot-standby parameter changes not being correctly applied to replica clusters. (#9952)
• Fixed a bug in the CNPG-I reconciler hook that could skip subsequent plugins. (#9978)
• Fixed a deadlock when resizing a filesystem on a PVC not attached to a Pod. (#9981)
• Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with ConnectionParameters. (#10268)
• Volume names for extensions and tablespaces are now prefixed to avoid naming collisions. (#9973)
• When hibernating a non-healthy cluster, the operator now reports a WaitingForHealthy condition. (#10193)
• Fixed fencing when the target pod does not exist. (#10035)
• Fixed cluster and pooler service reconcilers handling changes to all spec fields with the patch update strategy. (#10190, #10311)
• Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore. (#10285)
• Fixed timeline history file validation for plugin-based WAL restore. (#9849)
• cnpg plugin: The cnpg plugin now correctly propagates ImagePullSecrets to the pgbench Job pod template. (#10174)

Version 1.28.1

Release date: Feb 5, 2026

Enhancements

• Added support for Azure's DefaultAzureCredential authentication mechanism for backup and recovery operations. (#9468)

Fixes

• Fixed validation of PostgreSQL extension names containing underscores, such as pg_partman and pg_ivm. (#9386)
• Fixed a critical issue where the TimelineID in cluster status was not reset to 1 after a major version upgrade. (#9830)
• Fixed stale TLS status fields in the Pooler after being removed from the specification. (#9397)
• Fixed replicas entering a crash-loop by attempting to download timeline history files from future timelines. (#9650)
• Fixed a race condition in replica_cluster setups during designated primary transitions. (#9601)
• The backup controller now uses the unique instance session ID to detect instance manager restarts. (#9370)
• Fixed validation gaps in Azure object store configurations. (#9604)
• Optimized the deletion path so cleanup begins immediately when a cluster is marked for deletion. (#9555)
• Fixed replication slots not being properly dropped from replicas. (#9381)
• Fixed imagePullSecrets not being added to the Pooler ServiceAccount. (#9427)
• Added an ownership check before deleting a PodMonitor. (#9340)
• Fixed stale pg_stat_archiver metrics on standby instances after a switchover. (#9411)
• Timestamps for recovery targetTime without an explicit timezone are now interpreted as UTC. (#8937)
• Fixed backup status updates during concurrent updates. (#9551)
• Fixed event reporting to use the correct pod name when a backup pod is not found. (#9552)
• Improved performance of scheduled backup operations for clusters with many historical backups. (#9489)
• Fixed error handling when removing finalizers on Database objects. (#9431)
• cnpg plugin: Updated status to display "Disabled" when skipWalArchiving is present; fixed logs --follow polling. (#9709, #9599)

Version 1.28.0

Release date: Dec 9, 2025

Features

• Quorum-Based Failover Promoted to Stable: Promoted quorum-based failover to a stable API via spec.postgresql.synchronous.failoverQuorum. (#8589)
• Declarative Foreign Data Management: Introduced declarative management for Foreign Data Wrappers through the Database CRD's .spec.fdws and .spec.servers fields. (#7942, #8401)

Changes

• Updated the default PostgreSQL version to 18.1-system-trixie. (#9178)
• Updated the default PgBouncer version to 1.25.1 for new Pooler deployments. (#9367)

Enhancements

• Enabled simultaneous image and configuration changes with primaryUpdateMethod: restart. (#8241)
• Improved network failure detection for replica instances by setting tcp_user_timeout to 5 seconds. (#9317)
• Adopted standard Kubernetes recommended labels for all generated resources. (#8087)
• Introduced pod-level securityContext and containerSecurityContext settings. (#6614)
• Introduced the alpha.cnpg.io/unrecoverable=true annotation for replica pods. (#8178)
• Introduced a caching layer for user-defined monitoring queries. (#8003)
• Enhanced PgBouncer integration by automatically setting auth_dbname to pgbouncer. (#8671)
• Allowed stage-specific pg_restore options during database import. (#7690)
• Added PostgreSQL majorVersion to Backup status. (#8464)
• Enhanced cluster restore to wait for init containers to complete. (#9026)
• Added the PGBOUNCER_IMAGE_NAME operator configuration parameter. (#9232)
• cnpg plugin: Added a --timeout flag to kubectl cnpg status and improved cnpg report file names. (#9201, #8984)

Security

• Allowed fine-grained custom TLS configurations for PgBouncer through clientTLSSecret, clientCASecret, serverTLSSecret, and serverCASecret. (#8692)
• Added optional TLS support for the operator metrics server via METRICS_CERT_DIR. (#8997)
• Enabled cnpg report operator to work with minimal permissions. (#8982)

Fixes

• Improved resilience of liveness, readiness, and startup probes to transient Kubernetes API server connectivity issues. (#9148)
• Fixed the CheckEmptyWalArchive safeguard for volume snapshot restores using CNPG-I plugins. (#9306)
• Improved error reporting when ImageCatalog retrieval fails. (#9266)
• Fixed TLS certificate verification issues when connecting to CNPG-I plugins. (#9222)
• Fixed instance manager controller restart failures. (#9123)
• Fixed incorrect WAL restore path handling in plugins when the destination path is absolute. (#9093)
• Fixed CREATE PUBLICATION SQL generation for multi-table publications to support PostgreSQL 13+. (#8888)
• Fixed backup failures in complex pod definitions by selecting the postgres container by name. (#8964)
• cnpg plugin: Fixed cnpg report log collection, including previous and current logs. (#8992)

Supported versions

• Kubernetes 1.34, 1.33, and 1.32
• PostgreSQL 18, 17, 16, 15, and 14
  • PostgreSQL 18.1 is the default image

The CloudNativePG Community is thrilled to announce the first release candidate of CloudNativePG 1.30! This preview release provides an opportunity to explore new features and enhancements before the final version is officially launched. While refinements may still occur, here’s a look at what’s new.

Key Features

DatabaseRole CRD for declarative role management

The headline addition in 1.30 is the new DatabaseRole custom resource, which manages a PostgreSQL role as a standalone Kubernetes object rather than inline in the Cluster’s .spec.managed.roles stanza. Each role now has its own lifecycle, status and RBAC, which suits GitOps workflows and lets role definitions live next to the applications that own them. Migrating an existing role is simply a matter of moving its stanza into a dedicated manifest.

A DatabaseRole can also include a clientCertificate block, having the operator automatically generate and renew a TLS client certificate signed by the cluster’s client CA and stored in a -client-cert Secret. This enables password-free PostgreSQL cert authentication, with the Secret cleaned up automatically when the feature is disabled or the resource is deleted.

Primary Lease for safe primary election

CloudNativePG 1.30 introduces a Kubernetes Lease object, named after the cluster, that acts as a mutex serializing primary promotion. The instance manager must hold the lease before acting as primary and releases it on clean shutdown, so replicas can promote without waiting for the full TTL. Timings are configurable through the new .spec.primaryLease stanza.

To be precise about the architecture: the lease is a promotion gate, not a fence. Primary isolation remains responsible for fencing — the Lease simply closes the window for an uncoordinated promotion during transitions.

There’s More…

Explore other improvements in this release, including:

• In-place major upgrades with Image Volume extensions — pg_upgrade in-place upgrades are now supported for clusters using Image Volume extensions, mounting the source- and target-version extension images side by side so a failed upgrade reverts cleanly.
• PgBouncer image management via Image Catalogs — the Pooler can now reference an ImageCatalog or ClusterImageCatalog entry through spec.pgbouncer.imageCatalogRef, with referencing Poolers automatically reconciled and rolled out when a catalog entry changes.
• TLS for the Pooler metrics endpoint via .spec.monitoring.tls.enabled, with hot certificate reloading on every handshake.
• Cluster as a VPA/HPA target through a new status.selector on the scale subresource, mapping a Cluster to its instance pods.

This release also adds support for Kubernetes 1.36 and updates the default PostgreSQL version to 18.4.

Heads-up on an API change: the cluster reference is now immutable on the Database, Pooler, Publication, Subscription and ScheduledBackup resources. Re-pointing one of these at a different cluster is now rejected by a CEL validation rule at the API server, as it had no well-defined semantics.

Dive into the full details in the release notes for 1.30 RC1.

Testing

The stability of each CloudNativePG release relies on the community’s engagement. Testing your workloads with this release candidate helps identify bugs and regressions early.

• View the open issues for the 1.30 release.
• Report bugs directly on GitHub.

Release Timeline

This is the first release candidate for CloudNativePG 1.30. Further candidates will be released only as necessary before the final launch, currently planned before the end of June.

Join the Community

Connect with our community on your preferred platform!

Thank you for your continued support of CloudNativePG. Your contributions help us advance the Kubernetes-native PostgreSQL experience.

The CloudNativePG community is releasing maintenance updates for all currently supported series: 1.29.1 and 1.28.3.

This is a high-priority release. It addresses CVE-2026-44477 (the first CVE officially assigned against CloudNativePG, rated Critical with a CVSS v4 score of 9.4), alongside additional CVE remediations in dependencies and the Go runtime.

On the reliability side, three independent bugs in the HA failover path are resolved, including a label retention issue that could route writes to a former primary during a network partition (#10409), a condition that prevented failover from triggering when a node became unreachable (#10448), and a guard against spurious failovers from transient HTTP endpoint failures (#10445). Both releases also include a number of correctness and robustness fixes. See the release notes for the full list.

All users should upgrade immediately.

Security

CVE-2026-44477: metrics exporter privilege escalation and OS RCE

The metrics exporter previously opened its PostgreSQL connection as the postgres superuser and demoted the session with SET ROLE pg_monitor. That demotion is insufficient: session_user remains postgres, and any SQL evaluated inside the scrape session can call RESET ROLE to recover full superuser privileges, then use COPY ... TO PROGRAM to spawn an arbitrary OS process inside the primary pod.

Two independent paths exploit this root cause. The first requires a custom metric query with an unqualified relation or function reference; the attack completes within one scrape interval (≤ 30 s). The second requires no custom metrics at all: the shipped pg_extensions metric was sufficient to let the default app role (created automatically by bootstrap.initdb) trigger the full escalation chain on a completely stock deployment. The combined impact is superuser privilege escalation plus arbitrary OS command execution inside the primary pod from a low-privileged database role.

The fix introduces a dedicated cnpg_metrics_exporter PostgreSQL role with pg_monitor privileges only, mapped via pg_ident.conf peer authentication (the same pattern used for cnpg_pooler_pgbouncer). The exporter now connects as this role, so RESET ROLE has no escalation effect. All shipped monitoring queries have also been hardened with explicit pg_catalog. qualification (#10576).

For the full technical analysis, exploitation paths, workarounds and upgrade impact, refer to the security advisory.

Additional CVE remediations

These releases also pick up:

• github.com/jackc/pgx/v5 v5.9.2: fixes CVE-2026-33816 (memory-safety in pgproto3) and GHSA-j88v-2chj-qfwx (SQL injection via dollar-quoted string handling in the simple protocol).
• Go 1.26.3 runtime: fixes across crypto/x509, crypto/tls, net/http, and net (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39825), plus CVE-2026-42501 in cmd/go module-checksum validation during release builds.
• Discoverable SBOM and provenance attestations (#10601): attestations attached to operator images now follow the OCI 1.1 Referrers spec, making them automatically discoverable by standard registry tooling and supply-chain scanners.

Acknowledgement

We thank Mehmet Ince (@mdisec) for responsibly disclosing CVE-2026-44477, providing a thorough analysis of both exploitation paths and a working proof of concept.

Upgrade

Follow the upgrade instructions specific to your series:

• 1.29.x → 1.29.1: upgrade guide
• 1.28.x → 1.28.3: upgrade guide

For deployments with replica clusters, upgrade the source primary cluster first. See the security advisory for sequencing details.

For the complete list of changes, see the release notes:

• Release notes for 1.29.1
• Release notes for 1.28.3

Get Involved with the Community

Join us to help shape the future of cloud-native Postgres!

If you’re using CloudNativePG in production, consider adding your organization as an adopter to support the project’s growth and evolution.

Thank you for your continued support!

The CloudNativePG Community is excited to announce the immediate availability of CloudNativePG 1.29.0!

This minor release introduces a paradigm shift in how PostgreSQL extensions are managed on Kubernetes and brings powerful new capabilities for enterprise identity and network security, further establishing CloudNativePG as the standard for cloud-native PostgreSQL.

We are also pleased to announce the release of maintenance versions 1.28.2 and 1.27.4, the latter of which is the final planned release in the 1.27.x series. We encourage users on 1.27 to plan their upgrade to 1.28 or 1.29.

With the release of CloudNativePG 1.29.0, the End-of-Life (EOL) date for the CloudNativePG 1.28.x series is confirmed as June 30, 2026.

Highlights in 1.29.0

PostgreSQL Extensions Ecosystem and Image Catalogs

The headline feature of 1.29 is the integration of Image Catalogs with a new, dedicated ecosystem for PostgreSQL extensions. By leveraging the postgres-extensions-containers project, CloudNativePG now provides a structured, automated way to distribute and manage extension-specific images.

This approach ensures that the database engine and its modules are version-aligned, secure, and treated as a single cohesive unit. It centralizes the image supply chain, effectively removing the need for users to manually build and maintain complex custom PostgreSQL images just to add required functionality.

Dynamic Network Access Control via Pod Selectors

We have introduced a major enhancement to PostgreSQL network security. Using the new podSelectorRefs field, you can now define pg_hba.conf rules that dynamically resolve the ephemeral IP addresses of client pods based on label selectors. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the friction of manual IP management or static CIDR ranges.

Shared ServiceAccount Support

CloudNativePG 1.29 now supports referencing a pre-existing ServiceAccount in Cluster and Pooler resources. This enables a much smoother integration with cloud provider IAM services. Platform engineers can now manage identity and permissions once at the infrastructure level and share them across multiple clusters. This work was contributed by Salih Bozkaya (@bozkayasalihx).

Notable Enhancements

• Supply Chain Security & Artifact Signing: We have significantly strengthened the project’s security posture by signing all release artifacts and container images. This release also includes:
  • SLSA Provenance: Added Supply-chain Levels for Software Artifacts provenance to release binaries and images.
  • SBOM Generation: Enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency.
  • OpenSSF Integration: Integrated the OpenSSF baseline scanner and added a SECURITY-INSIGHTS.yaml file to the repository to align with industry-standard security reporting.
• Advanced TLS for PgBouncer: Added support for granular configuration of TLS cipher suites and minimum/maximum TLS versions for both client-to-pooler and pooler-to-server connections. Contributed by @alex1989hu.

Dive into the full list of changes and fixes in the Release notes for CloudNativePG 1.29.

Maintenance Releases: 1.28.2 & 1.27.4

In parallel with the 1.29 release, we have also shipped maintenance updates for previous stable series:

• CloudNativePG 1.28.2: Includes various fixes and improvements backported from 1.29, including improved resilience for volume resizes and stability fixes for the cnpg plugin.
• CloudNativePG 1.27.4: The final planned maintenance release for the 1.27.x series. We strongly recommend planning an upgrade to 1.28 or 1.29.

We encourage all users to upgrade to the latest stable versions to benefit from the latest features, security enhancements, and bug fixes.

Follow the upgrade instructions for a smooth transition.

Get Involved with the Community

Join us to help shape the future of cloud-native Postgres!

If you’re using CloudNativePG in production, consider adding your organization as an adopter to support the project’s growth and evolution.

Thank you for your continued support! Upgrade today and discover how CloudNativePG can elevate your PostgreSQL experience to new heights.

History of user-visible changes in the 1.27 minor release of CloudNativePG.

For a complete list of changes, please refer to the commits on the release branch in GitHub.

Version 1.27.4

Release date: Mar 31, 2026

WARNING

This is the final release in the 1.27.x series. Users are strongly encouraged to upgrade to a newer minor version, as 1.27 is no longer supported.

Important changes

• Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. (#10167)

Enhancements

• Improved the Pooler CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by @alex1989hu. (#9571)
• Improved the reliability of major upgrades by setting BackoffLimit=0 on the upgrade job, preventing unnecessary retries of a failed pg_upgrade. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. (#10104, #10298)
• Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. (#9971)
• Extended the CRD schemas for Cluster, ImageCatalog, and ClusterImageCatalog to accept the extensions, bin_path, and env fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. (#10131, #10387)
• The operator now honors the primaryUpdateMethod when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. (#9720)

Security and Supply Chain

• Security best practices integration: integrated the OpenSSF baseline scanner and added a SECURITY-INSIGHTS.yaml file to the repository to align with industry-standard security reporting. (#10054, #10062)
• SLSA provenance and SBOMs: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. (#10048, #10074)
• Password leak prevention: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. (#9950)

Changes

• Updated the default PostgreSQL version to 18.3 (image 18.3-system-trixie). (#10090)

Fixes

• Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. (#10302)
• Fixed an issue where replicas would get stuck in a Pending state if the VolumeSnapshot used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to pg_basebackup. (#10192)
• Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by @ermakov-oleg. (#9977)
• Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. (#9952)
• Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by @sharifmshaker. (#9978)
• Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by @jmealo. (#9981)
• Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with ConnectionParameters (for pg_basebackup-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. (#10268)
• Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. (#9973)
• When hibernating a non-healthy cluster, the operator now reports a WaitingForHealthy condition, making the deferred hibernation state visible through cnpg status. (#10193)
• Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the cnpg fencing on command. (#10035)
• Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as loadBalancerClass) from being inadvertently removed. (#10190, #10311)
• Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. (#10285)
• Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in #9650 only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. (#9849)
• cnpg plugin: The cnpg plugin now correctly propagates ImagePullSecrets to the pgbench Job pod template. (#10174)

Version 1.27.3

Release date: Feb 5, 2026

Enhancements

• Added support for Azure's DefaultAzureCredential authentication mechanism for backup and recovery operations. This can be enabled by setting azureCredentials.useDefaultAzureCredentials: true in the backup configuration, simplifying authentication in Azure environments without requiring explicit storage account keys or SAS tokens. (#9468)

Fixes

• Fixed validation of PostgreSQL extension names containing underscores (e.g., pg_partman, pg_ivm). Extension names with underscores are automatically sanitized to use hyphens for Kubernetes volume names while preserving the original name in mount paths. Webhook validation prevents naming conflicts after sanitization. Contributed by @shusaan. (#9386)
• Fixed a critical issue where the TimelineID in the cluster status was not reset to 1 after a major version upgrade. Because pg_upgrade initializes a new timeline, keeping the old ID (e.g., timeline 2) caused replicas to attempt to restore incompatible history files from object storage, leading to fatal "requested timeline is not a child of this server's history" errors. (#9830)
• Fixed a bug where replicas could enter a crash-loop by attempting to download timeline history files from future timelines. This occurred when stale files remained in the WAL archive from a previous cluster life, and replicas would incorrectly try to fetch them during recovery. (#9650)
• Fixed a race condition in replica_cluster setups during designated primary transitions, preventing transient "no primary" states in the replica cluster. (#9601)
• The backup controller now uses the unique instance session ID to detect instance manager restarts. This prevents the operator from incorrectly assuming a backup is still progressing if the underlying container has crashed and restarted, which previously led to orphaned backup objects. (#9370)
• Fixed a validation gap in Azure object store configurations where the storageAccount was not required when using explicit credentials (such as a storage key or SAS token). The operator now enforces that a storage account name is provided in these cases and that connectionString is mutually exclusive with other authentication parameters. (#9604)
• Optimized the deletion path so the operator begins cleaning up resources immediately when a cluster is marked for deletion. This significantly reduces the time a cluster remains in Terminating status while waiting for internal reconciliation loops. (#9555)
• Fixed an issue where replication slots were not properly dropped from replicas when the feature was disabled or the cluster was reconfigured. This ensures that unused slots do not cause WAL build-up on the primary. (#9381)
• Fixed an issue where imagePullSecrets were not added to the ServiceAccount created for the Pooler. Previously, these secrets were applied to the Deployment but not the SA, which caused image pull failures in restricted environments using certain security policies. (#9427)
• Added a check to verify ownership before the operator deletes a PodMonitor. This prevents the operator from accidentally deleting manually managed monitoring resources that happen to share a name with expected CNPG resources. Contributed by @juliamertz. (#9340)
• Fixed a bug where pg_stat_archiver metrics would continue to report stale data on standby instances after a switchover. The exporter now skips these metrics on standbys, as PostgreSQL only provides valid archiver stats on the primary. (#9411)
• Clarified the interpretation of timestamp formats for recovery targetTime. Timestamps provided without an explicit timezone are now consistently interpreted as UTC. Contributed by @pchovelon. (#8937)
• Fixed backup status updates to prevent "resource has been modified" errors during concurrent updates. (#9551)
• Fixed event reporting to use the correct pod name when a backup pod is not found. (#9552)
• Improved performance of scheduled backup operations for clusters with a very high number of historical backups. (#9489)
• Fixed error handling when removing finalizers on Database objects. (#9431)
• cnpg plugin: Updated the status command to display "Disabled" when the skipWalArchiving annotation is present on a cluster. This replaces confusing "starting up" or "unknown" states when WAL archiving is intentionally bypassed. (#9709)
• cnpg plugin: Fixed the logs --follow command to continue polling for new pods instead of exiting prematurely when all current log streams complete. (#9599)

Version 1.27.2

Release date: Dec 9, 2025

WARNING

Version 1.27 will be supported until 9 March 2026.

Changes

• Updated the default PostgreSQL version to 18.1-system-trixie. (#9178)
• Updated the default PgBouncer version to 1.25.1 for new Pooler deployments. (#9367)

Enhancements

• Added the PostgreSQL majorVersion to the Backup object's status for easier identification and management. (#8464)
• Added the PGBOUNCER_IMAGE_NAME operator configuration parameter to allow overriding the default PgBouncer image. This is useful for air-gapped environments or when using internal registries. (#9232)
• cnpg plugin: Added a --timeout flag to the kubectl cnpg status command for configuring the timeout for filesystem operations such as calculating cluster size. The default remains 10 seconds but can be adjusted for large clusters where operations may take longer. (#9201)
• cnpg plugin: Improved cnpg report to generate more shell-friendly file names. (#8984)

Fixes

• Improved resilience of all probe types (liveness, readiness, and startup) to transient Kubernetes API server connectivity issues. Probes now use a caching mechanism that falls back to cached cluster definitions during brief network interruptions, preventing unnecessary pod restarts and probe failures. (#9148)
• Fixed the CheckEmptyWalArchive safeguard to run correctly when restoring from a volume snapshot using CNPG-I backup/WAL plugins (e.g., plugin-barman-cloud). Previously, this check was skipped for plugin-based implementations. (#9306)
• Improved error reporting when ImageCatalog retrieval fails. The operator now emits a Warning event and logs errors for all failure types, not just NotFound errors, improving visibility into configuration issues. (#9266)
• Fixed TLS certificate verification issues when connecting to CNPG-I plugins by adding the cnpg.io/pluginServerName annotation. This allows customizing the DNS name used for certificate verification in environments where the plugin's certificate uses a different DNS name than the Service name. (#9222)
• Fixed an issue where the instance manager controller could fail to restart after an error, reporting a "controller already exists" message. The controller now uses SkipNameValidation for subsequent initialization attempts. Contributed by @mateusoliveira43. (#9123)
• Fixed incorrect WAL restore path handling in plugins when the destination path is absolute, preventing path duplication issues. Contributed by @Endevir. (#9093)
• Fixed the CREATE PUBLICATION SQL generation for multi-table publications to be backward-compatible with PostgreSQL 13+. The previously generated syntax was only valid for PostgreSQL 15+ and caused syntax errors on older versions. (#8888)
• Fixed backup failures in complex pod definitions by reliably selecting the postgres container by name instead of by index. Contributed by @Joda89. (#8964)
• cnpg plugin: Fixed bugs in cnpg report log collection, especially when fetching previous logs. The collector now correctly fetches previous and current logs in separate requests and gracefully handles missing previous logs (e.g., on containers with no restart history), ensuring current logs are always collected. (#8992)

Version 1.27.1

Release date: Oct 23, 2025

Changes

• Delayed the decommissioning of native in-core support for Barman Cloud to at least version 1.29. (#8670)
• Adopted the new format of postgres-containers and postgis-containers images and image catalog artifacts, and updated the default PostgreSQL version to 18.0-system-trixie (PostgreSQL 18 is now supported). (#8578, #8760, #8558)
• Deprecated the monitoring.enablePodMonitor field in the Cluster and Pooler resources. This field will be removed in a future release. Users who rely on PodMonitor resources should create them manually instead. (#8753)

Enhancements

• Added support for overriding the PgBouncer auth_type, server_tls_sslmode, and client_tls_sslmode settings, which were previously hardcoded. Default values remain consistent with the former behavior but can now be customized when required. (#8674)
• Added a CHECKPOINT step before PostgreSQL smart and fast shutdowns to reduce shutdown duration and replica promotion time, especially on systems with a high checkpoint_timeout. (#8867)
• Added a warning in the instance manager for deprecated or unsupported OS versions, based on the official postgres-containers project. (#8601)
• Improved certificate parsing error reporting. Failures now log specific errors instead of a generic message, aiding troubleshooting. This is particularly relevant after the CVE-2025-58187 fix in Go 1.25.2 and 1.24.8, which may trigger parsing failures for invalid DNS SANs. (#8801)
• Added a check to ensure the destination WAL archive path is empty when bootstrapping a cluster using the pg_basebackup method, consistent with other bootstrap methods. (#8895)
• Added validation to prevent backups from running on hibernated clusters. Backups attempted on such clusters now fail with reason ClusterIsHibernated, following the standard prerequisite check pattern. (#8870)
• Added support for pprof profiling. Instances can now enable the pprof tool by adding the alpha.cnpg.io/enableInstancePprof annotation to the Cluster resource for advanced debugging. (#7876)
• cnpg plugin: Updated the Flexible I/O Tester (FIO) image to wallnerryan/fiotools-aio:v2, as provided by Ryan Wallner. (#8847)
• cnpg plugin: Enhanced the cnpg status backup command to provide more detailed status information when using a barman-cloud-based backup plugin. (#8780, #8690)

Fixes

• Fixed backup restoration failures when using custom WAL segment sizes with parallel WAL recovery. The operator no longer manages the end-of-WAL file marker during restoration, preventing errors when backups span multiple WAL segments. (#8873)
• Fixed a bug in major upgrades where a volume snapshot from a previous minor version could be incorrectly used to optimize replica creation. (#8475)
• Fixed initdb to wait for the application user secret before bootstrapping a new cluster, preventing potential race conditions. (#8663)
• Fixed quorum-based failover to work correctly in clusters with only two instances using synchronous replication. (#8680)
• Fixed configuration hash calculation to ignore internal configuration fields, preventing unnecessary reconciliations. (#8868)
• Fixed the connection retry logic in the cnpgi plugin. The reconciliation loop now detects connection pool changes correctly and uses exponential backoff to reduce "closed pool" errors. (#8554)
• Fixed volume snapshot usage during replica scaling to work with backup plugins. Previously, this optimization was only available with the in-tree backup implementation, but now clusters using backup plugins can also leverage volume snapshots when creating new replicas. (#8506)
• Fixed the Pooler templating to correctly inherit settings for the bootstrap controller init container. (#8394)
• Fixed webhook errors to use the correct API group (postgresql.cnpg.io) in Pooler and backup webhooks, ensuring consistent API error reporting. (#8485)
• Fixed a potential nil pointer dereference in the hibernation reconciler when handling errors. Contributed by @PascalBourdier. (#8756)
• Fixed an issue in the environment cache where callers could inadvertently modify shared data. The LoadEnv function now returns a copy of cached environment slices to prevent mutations from affecting the cache. (#8880)

Version 1.27.0

Release date: Aug 12, 2025

Important changes

• The default behavior of the liveness probe has been updated. An isolated primary is now forcibly shut down within the configured livenessProbeTimeout (default: 30 seconds).

Features

• Dynamic loading of PostgreSQL extensions: Introduced the .spec.postgresql.extensions stanza for mounting PostgreSQL extensions, packaged as OCI-compliant container images, as read-only and immutable volumes inside instance pods. This allows dynamic extension management without rebuilding base images. (#7991).
• Logical decoding slot synchronization in HA clusters: Added the synchronizeLogicalDecoding field under spec.replicationSlots.highAvailability to enable automatic synchronization of logical decoding slots across high-availability clusters, ensuring logical replication subscribers continue seamlessly after a publisher failover (#7931).
• Primary Isolation Check: Promoted to stable the liveness pinger experimental feature introduced in 1.26, adding the .spec.probes.liveness.isolationCheck section to enable primary isolation checks in the liveness probe by default. This improves the detection and handling of primary connectivity issues in Kubernetes environments (#7845).

Enhancements

• Introduced an opt-in experimental feature that enables quorum-based failover to improve safety and data durability during failover events. This feature, also called failover quorum, can be activated via the alpha.cnpg.io/failoverQuorum annotation. (#7572).
• Added support for user maps for predefined users such as streaming_replica, allowing the use of self-managed client certificates with different Common Names in environments with strict policies or shared CAs, while still enabling replicas to join clusters using the streaming_replica role (#7725).
• Added a new PhaseFailurePlugin phase in the Cluster status to improve observability of plugin-related failures (#7988).
• Made the Backup.spec field immutable after creation, ensuring consistency and predictability in backup operations (#7904).
• Added fqdn-uri and fqdn-jdbc-uri fields in the user secret to simplify the retrieval of fully qualified domain name-based connection strings (#7852).
• CNPG-I: Added Postgres interface support to the CNPG-I operator, continuing the transition toward a plugin-based architecture (#7179).
• CNPG-I: Added metrics capabilities to the CNPG-I instance webserver, enabling metrics exposure directly from the instance for better observability (#8033).

Fixes

• Unblocked rollouts when migrating to the barman-cloud plugin using the switchover strategy. Former primary Pods now restart correctly after WAL archiving fails due to missing plugin support. (#8236).

Supported versions

• Kubernetes 1.33, 1.32, and 1.31
• PostgreSQL 17, 16, 15, 14, and 13
  • PostgreSQL 17.5 is the default image
  • PostgreSQL 13 support ends on November 12, 2025

The CloudNativePG Community is thrilled to announce the first release candidate of CloudNativePG 1.29! This preview release provides an opportunity to explore new features and enhancements before the final version is officially launched. While refinements may still occur, here’s a look at what’s new.

Key Features

PostgreSQL Extensions Ecosystem and Image Catalogs

The most significant architectural advancement in 1.29 is the integration of Image Catalogs with a new dedicated ecosystem for PostgreSQL extensions. By leveraging the postgres-extensions-containers project and its official extension images and catalogs, CloudNativePG now provides a structured way to distribute and manage extension-specific images.

This feature allows you to define these extensions within a catalog, ensuring that the database engine and its modules are version-aligned, secure, and treated as a single cohesive unit. This approach centralizes your image supply chain and removes the need for users to manually build and maintain complex custom PostgreSQL images.

Dynamic Network Access Control via Pod Selectors

We’ve introduced a major enhancement to how PostgreSQL network security is handled in Kubernetes. By using the new podSelectorRefs field, you can now define pg_hba.conf rules that dynamically resolve the IP addresses of client pods based on label selectors. This ensures that only authorized workloads in the same namespace can connect to your database, eliminating the need for manual IP management or static CIDR ranges.

Shared ServiceAccount Support

CloudNativePG now supports referencing a pre-existing ServiceAccount in Cluster and Pooler resources. This enables a more streamlined integration with cloud provider IAM services, such as AWS IRSA, GCP Workload Identity, and Azure Workload Identity.

There’s More…

Explore other improvements in this release, including:

• Added granular configuration for TLS cipher suites and versions for PgBouncer.
• Improved reliability by automatically cleaning up failed pg_upgrade jobs when an image is reverted.

Dive into the full details in the release notes for 1.29 RC1.

Testing

The stability of each CloudNativePG release relies on the community’s engagement. Testing your workloads with this release candidate helps identify bugs and regressions early.

• View the open issues for the 1.29 release.
• Report bugs directly on GitHub.

Release Timeline

This is the first release candidate for CloudNativePG 1.29. Further candidates will be released only as necessary before the final launch, currently planned before the end of March.

Join the Community

Connect with our community on your preferred platform!

Thank you for your continued support of CloudNativePG. Your contributions help us advance the Kubernetes-native PostgreSQL experience.

The CloudNativePG Community is pleased to announce the release of CloudNativePG Operator versions 1.28.1 and 1.27.3.

These releases deliver important bug fixes and stability improvements, ensuring your PostgreSQL clusters continue to run reliably in production environments. We recommend all users upgrade at their earliest convenience, particularly those using PgBouncer or managing replica clusters.

Specifically, these updates address several critical scenarios that directly impact production reliability:

• Critical fix for PgBouncer upgrades: We resolved an issue where stale TLS status fields in the Pooler were not correctly cleared. This was particularly disruptive for users upgrading to version 1.28, as it could cause PgBouncer to use incorrect certificates, resulting in “unsupported certificate” errors and blocking all application connectivity.
• Timeline protection during WAL restore: Improved the WAL restore logic to prevent replicas from downloading timeline history files with IDs greater than the cluster’s current timeline. This prevents recovery failures caused by incomplete promotion attempts, where PostgreSQL creates history files for timelines that the cluster never officially adopts.
• Timeline reset after major upgrades: We addressed a critical issue in the major version upgrade path. After a pg_upgrade, the operator now correctly resets the TimelineID to 1. This prevents replicas from attempting to follow an incompatible timeline from the previous major version, which formerly led to fatal recovery errors.

Read the full release notes for details:

• Release notes for 1.28.1
• Release notes for 1.27.3

Upgrade guidance

We recommend upgrading to 1.28.1 to benefit from the latest features, enhancements, and long-term stability.

If you’re on 1.27.x, please be reminded that version 1.27 will be supported until 9 March 2026. Upgrade to 1.27.3 to get the latest fixes in that series and begin planning your transition to the 1.28 minor release series.

Follow the upgrade instructions for a smooth transition.

Get involved with the community

Join us to help shape the future of cloud-native Postgres!

If you’re using CloudNativePG in production, consider adding your organisation as an adopter to support the project’s growth and evolution.

Thank you for your continued support and for being part of the CloudNativePG community!

The CloudNativePG Community is excited to announce the immediate availability of CloudNativePG 1.28.0!

This minor release graduates a key high-availability feature to stable and introduces powerful new capabilities for managing external data sources, further cementing CloudNativePG as the leading operator for running PostgreSQL workloads on Kubernetes.

We are also pleased to announce the release of maintenance versions 1.27.2 and 1.26.3, the latter of which is the final planned release in the 1.26.x series. We encourage users on 1.26 to plan their upgrade to 1.27 or 1.28.

With the release of CloudNativePG 1.28.0, the End-of-Life (EOL) date for the CloudNativePG 1.27.x series is confirmed as March 9, 2026.

Highlights in 1.28.0

Quorum-Based Failover Promoted to Stable

The quorum-based failover mechanism, introduced experimentally in 1.27, is now a stable feature.

This data-driven approach enhances failover safety and data durability for high-availability clusters by ensuring that a replacement primary is only promoted when a majority of synchronous replicas are ready, preventing data loss.

• New Configuration: This feature is now configured via the stable field: spec.postgresql.synchronous.failoverQuorum

Declarative Foreign Data Management

CloudNativePG 1.28 introduces comprehensive declarative management for Foreign Data Wrappers (FDW) and their corresponding foreign servers.

By extending the Database Custom Resource Definition (CRD) with .spec.fdws and .spec.servers fields, users can now define external data connections directly within their cluster manifest, treating them as first-class Kubernetes objects.

• This work was contributed by Ying Zhu (@EdwinaZhu) as part of the LFX Mentorship Program.

Enhanced Security and Resilience

This release includes significant improvements focused on stability, security, and network resilience:

• Granular Security Contexts: Introduced fine-grained security contexts, allowing securityContext at the Pod level and containerSecurityContext for individual containers (postgres, init, sidecars).
• Custom PgBouncer TLS: Allowed providing fine-grained custom TLS certificates for PgBouncer (client-to-pooler and pooler-to-server connections), overriding operator-generated certificates for better security control.
• Faster Network Failure Detection: Improved network resilience for replicas by setting the default tcp_user_timeout to 5 seconds. Replicas can now detect and recover from silent network drops much quicker than the previous default of 127 seconds.
• Least-Privileged Reporting: The cnpg report operator command now works with minimal, least-privileged access, gracefully handling permission errors and continuing to generate the report with available data.
• TLS for Operator Metrics: Added optional TLS support for the operator’s metrics server (via METRICS_CERT_DIR).

Other Notable Enhancements

• Simultaneous Image and Config Changes: The operator can now safely handle simultaneous updates to the container image (e.g., PostgreSQL version) and PostgreSQL configuration in a single operation.
• Replica Auto-Recreation: Introduced the alpha.cnpg.io/unrecoverable=true annotation to automatically delete and recreate an unrecoverable replica Pod and its PVCs.
• Standard Kubernetes Labels: Adopted standard Kubernetes recommended labels (e.g., app.kubernetes.io/name) for all generated resources, improving integration with ecosystem tools.
• Improved Cluster Restore: Enhanced cluster restore to wait for all init containers to complete, ensuring data is fully prepared before the restore process begins.

Dive into the full list of changes and fixes in the Release notes for CloudNativePG 1.28.

Maintenance Releases: 1.27.2 & 1.26.3

In parallel with the 1.28 release, we have also shipped maintenance updates for previous stable series:

• CloudNativePG 1.27.2: Includes various fixes and improvements backported from 1.28, such as resilience to transient Kubernetes API connectivity issues and improved PgBouncer image configuration.
• CloudNativePG 1.26.3: The final planned maintenance release for the 1.26.x series. We strongly recommend planning an upgrade to a currently supported version.

We encourage all users to upgrade to the latest stable versions to benefit from the latest features, security enhancements, and bug fixes.

Follow the upgrade instructions for a smooth transition.

Get Involved with the Community

Join us to help shape the future of cloud-native Postgres!

If you’re using CloudNativePG in production, consider adding your organization as an adopter to support the project’s growth and evolution.

Thank you for your continued support! Upgrade today and discover how CloudNativePG can elevate your PostgreSQL experience to new heights.

History of user-visible changes in the 1.26 minor release of CloudNativePG.

For a complete list of changes, please refer to the commits on the release branch in GitHub.

Version 1.26.3

Release date: Dec 9, 2025

WARNING

This is the final release in the 1.26.x series. Users are strongly encouraged to upgrade to a newer minor version, as 1.26 is no longer supported.

Changes

• Updated the default PostgreSQL version to 18.1-system-trixie. (#9178)
• Updated the default PgBouncer version to 1.25.1 for new Pooler deployments. (#9367)

Enhancements

• Added the PostgreSQL majorVersion to the Backup object's status for easier identification and management. (#8464)
• Added the PGBOUNCER_IMAGE_NAME operator configuration parameter to allow overriding the default PgBouncer image. This is useful for air-gapped environments or when using internal registries. (#9232)
• cnpg plugin:
  • Improved cnpg report to generate more shell-friendly file names. (#8984)

Fixes

• Fixed the CheckEmptyWalArchive safeguard to run correctly when restoring from a volume snapshot using CNPG-I backup/WAL plugins (e.g., plugin-barman-cloud). Previously, this check was skipped for plugin-based implementations. (#9306)
• Fixed TLS certificate verification issues when connecting to CNPG-I plugins by adding the cnpg.io/pluginServerName annotation. This allows customizing the DNS name used for certificate verification in environments where the plugin's certificate uses a different DNS name than the Service name. (#9222)
• Fixed an issue where the instance manager controller could fail to restart after an error, reporting a "controller already exists" message. The controller now uses SkipNameValidation for subsequent initialization attempts. Contributed by @mateusoliveira43. (#9123)
• Fixed incorrect WAL restore path handling in plugins when the destination path is absolute, preventing path duplication issues. Contributed by @Endevir. (#9093)
• Fixed the CREATE PUBLICATION SQL generation for multi-table publications to be backward-compatible with PostgreSQL 13+. The previously generated syntax was only valid for PostgreSQL 15+ and caused syntax errors on older versions. (#8888)
• Fixed backup failures in complex pod definitions by reliably selecting the postgres container by name instead of by index. Contributed by @Joda89. (#8964)
• cnpg plugin:
  • Fixed bugs in cnpg report log collection, especially when fetching previous logs. The collector now correctly fetches previous and current logs in separate requests and gracefully handles missing previous logs (e.g., on containers with no restart history), ensuring current logs are always collected. (#8992)

Version 1.26.2

Release date: Oct 23, 2025

Changes

• Delayed the decommissioning of native in-core support for Barman Cloud to at least version 1.29. (#8670)
• Adopted the new format of postgres-containers and postgis-containers images and image catalog artifacts, and updated the default PostgreSQL version to 18.0-system-trixie (PostgreSQL 18 is now supported). (#8578, #8760, #8558)
• Deprecated the monitoring.enablePodMonitor field in the Cluster and Pooler resources. This field will be removed in a future release. Users who rely on PodMonitor resources should create them manually instead. (#8753)

Enhancements

• Added support for overriding the PgBouncer auth_type, server_tls_sslmode, and client_tls_sslmode settings, which were previously hardcoded. Default values remain consistent with the former behavior but can now be customized when required. (#8674)
• Added a CHECKPOINT step before PostgreSQL smart and fast shutdowns to reduce shutdown duration and replica promotion time, especially on systems with a high checkpoint_timeout. (#8867)
• Added a warning in the instance manager for deprecated or unsupported OS versions, based on the official postgres-containers project. (#8601)
• Improved certificate parsing error reporting. Failures now log specific errors instead of a generic message, aiding troubleshooting. This is particularly relevant after the CVE-2025-58187 fix in Go 1.25.2 and 1.24.8, which may trigger parsing failures for invalid DNS SANs. (#8801)
• Added a check to ensure the destination WAL archive path is empty when bootstrapping a cluster using the pg_basebackup method, consistent with other bootstrap methods. (#8895)
• Added validation to prevent backups from running on hibernated clusters. Backups attempted on such clusters now fail with reason ClusterIsHibernated, following the standard prerequisite check pattern. (#8870)
• Added support for pprof profiling. Instances can now enable the pprof tool by adding the alpha.cnpg.io/enableInstancePprof annotation to the Cluster resource for advanced debugging. (#7876)
• cnpg plugin:
  • Updated the Flexible I/O Tester (FIO) image to wallnerryan/fiotools-aio:v2, as provided by Ryan Wallner. (#8847)
  • Enhanced the cnpg status backup command to provide more detailed status information when using a barman-cloud-based backup plugin. (#8780, #8690)

Fixes

• Fixed backup restoration failures when using custom WAL segment sizes with parallel WAL recovery. The operator no longer manages the end-of-WAL file marker during restoration, preventing errors when backups span multiple WAL segments. (#8873)
• Fixed a bug in major upgrades where a volume snapshot from a previous minor version could be incorrectly used to optimize replica creation. (#8475)
• Fixed initdb to wait for the application user secret before bootstrapping a new cluster, preventing potential race conditions. (#8663)
• Fixed the connection retry logic in the cnpgi plugin. The reconciliation loop now detects connection pool changes correctly and uses exponential backoff to reduce "closed pool" errors. (#8554)
• Fixed volume snapshot usage during replica scaling to work with backup plugins. Previously, this optimization was only available with the in-tree backup implementation, but now clusters using backup plugins can also leverage volume snapshots when creating new replicas. (#8506)
• Fixed the Pooler templating to correctly inherit settings for the bootstrap controller init container. (#8394)
• Fixed webhook errors to use the correct API group (postgresql.cnpg.io) in Pooler and backup webhooks, ensuring consistent API error reporting. (#8485)
• Fixed a potential nil pointer dereference in the hibernation reconciler when handling errors. Contributed by @PascalBourdier. (#8756)
• Fixed an issue in the environment cache where callers could inadvertently modify shared data. The LoadEnv function now returns a copy of cached environment slices to prevent mutations from affecting the cache. (#8880)

Version 1.26.1

Release date: Jul 25, 2025

In memory of DJ Walker-Morgan.

Important Changes

CloudNativePG is moving toward a plugin-based, backup and recovery agnostic architecture (initiated in 1.26.0 with Barman Cloud). As part of this transition, the following fields in the .status section of the Cluster resource are now deprecated:

• firstRecoverabilityPoint
• firstRecoverabilityPointByMethod
• lastSuccessfulBackup
• lastSuccessfulBackupByMethod
• lastFailedBackup

Additionally, the following Prometheus metrics are deprecated:

• cnpg_collector_first_recoverability_point
• cnpg_collector_last_available_backup_timestamp
• cnpg_collector_last_failed_backup_timestamp

These fields and metrics will no longer update when using plugin-based backups (e.g., Barman Cloud via CNPG-I). They remain functional for users still using in-core Barman Cloud and volume snapshot backups.

Note: We, as maintainers, are sorry for any inconvenience caused by not highlighting this change during the 1.26.0 release. As we transition to a plugin-based backup and recovery architecture, we encourage you to test your chosen plugin thoroughly in a staging environment before moving to production to ensure your workflows and observability integration continue to meet your needs. Thank you for your understanding and for working with us as CloudNativePG evolves to provide a more modular and robust experience.

Changes

• Removed 386 and ARM (v5/v6/v7) architectures from the cnpg plugin build matrix, reducing the number of published binaries (#7648).

Enhancements

• Improved validation of shared_buffers by correctly considering HugePages settings, ensuring accurate memory configuration checks (#7864).
• Set oom_score_adj for PostgreSQL worker processes to improve prioritization during out-of-memory situations (#7891).
• Added fqdn-uri and fqdn-jdbc-uri fields in user secrets to simplify application connection string management and align with DNS-based connection best practices (#7852).
• Added the systemID field and related condition in the Cluster status to track the PostgreSQL system identifier. (#7717)

Fixes

• Added a mutex in the connection pooler to protect concurrent access to the connections map, improving stability in high-concurrency environments (#7804).
• Fixed replica cluster instance ordering by correctly detecting the designated primary, improving replica cluster stability and switchover operations (#8108).
• Added support for reconciling VolumeAttributesClass for PVCs, enhancing storage compatibility and lifecycle management (#7885).
• Made the internal webserver routines non-blocking to improve responsiveness under load (#8071).
• Fixed an issue where the ensureReplicationClientLeafCertificate error did not display the correct secretName in the not found message (#8086).
• Prevented invalid ALTER SUBSCRIPTION statements by updating only PostgreSQL-supported parameters; unsupported options like copy_data are ignored to avoid reconciliation failures (7844).
• Fixed an issue where the bootstrap-controller in the connection pooler did not apply resources settings correctly (#7922).
• Ensured online backups fail cleanly if the targetPod becomes unhealthy during backup, preventing partial or misleading backups (#7944).
• Ensured the Backup resource status is set properly after a failure, improving observability and scripting reliability (#7898).
• Improved liveness probe handling to avoid unnecessary timeouts when they are not required (#7902).

Version 1.26.0

Release date: May 23, 2025

Important Changes

• CloudNativePG is now officially a CNCF project: CloudNativePG has been accepted into the Cloud Native Computing Foundation (CNCF), marking a significant milestone in its evolution. As part of this transition, the project is now governed under CloudNativePG, a Series of LF Projects, LLC, ensuring long-term sustainability and community-driven innovation. (#7203)
• Deprecation of Native Barman Cloud Support: Native support for Barman Cloud backups and recovery is now deprecated and will be fully removed in CloudNativePG version 1.28.0. Although still available in the current release, users are strongly encouraged to begin migrating their existing clusters to the new Barman Cloud Plugin to ensure a smooth and seamless transition. The plugin should also be used for all new deployments. This change marks the first step toward making CloudNativePG a backup-agnostic solution, a goal that will be fully realized when volume snapshot support is also moved to a plugin-based architecture. (#6876)
• End of Support for Barman 3.4 and Earlier: CloudNativePG no longer supports Barman versions 3.4 and earlier, including the capability detection framework. Users running older operand versions (from before April 2023) must update their operand before upgrading the operator to avoid compatibility issues. (#7220)
• Hibernation Command Changes: The hibernate on and hibernate off commands in the cnpg plugin for kubectl now serve as shortcuts for declarative hibernation. The previous imperative approach has been removed in favor of this method. Additionally, the hibernate status command has been removed, as its functionality is now covered by the standard status command. Warning: Do not upgrade to version 1.26 of both the plugin and the operator unless you are prepared to migrate to the declarative hibernation method. (#7155)

Features

• Declarative Offline In-Place Major Upgrades of PostgreSQL: Introduced support for offline in-place major upgrades when a new operand container image with a higher PostgreSQL major version is applied to a cluster. During the upgrade, all cluster pods are shut down to ensure data consistency. A new job is created to validate upgrade conditions, run pg_upgrade, and set up new directories for PGDATA, WAL files, and tablespaces as needed. Once the upgrade is complete, replicas are re-created. Failed upgrades can be rolled back declaratively. (#6664)
• Improved Startup and Readiness Probes for Replicas: Enhanced support for Kubernetes startup and readiness probes in PostgreSQL instances, providing greater control over replicas based on the streaming lag. (#6623)
• Declarative management of extensions and schemas: Introduced the extensions and schemas stanzas in the Database resource to declaratively create, modify, and drop PostgreSQL extensions and schemas within a database. (#7062)

Enhancements

• Introduced an opt-in experimental feature to enhance the liveness probe with network isolation detection for primary instances. This feature can be activated via the alpha.cnpg.io/livenessPinger annotation (#7466).
• Introduced the STANDBY_TCP_USER_TIMEOUT operator configuration setting, allowing users to specify the tcp_user_timeout parameter on all standby instances managed by the operator. (#7036)
• Introduced the DRAIN_TAINTS operator configuration option, enabling users to customize which node taints indicate a node is being drained. This replaces the previous fixed behavior of only recognizing node.kubernetes.io/unschedulable as a drain signal. (#6928)
• Added a new field in the status of the Cluster resource to track the latest known Pod IP (#7546).
• Added the pg_extensions metric, providing information about installed PostgreSQL extensions and their latest available versions. (#7195)
• Added the KUBERNETES_CLUSTER_DOMAIN configuration option to the operator, allowing users to specify the domain suffix for fully qualified domain names (FQDNs) generated within the Kubernetes cluster. If not set, it defaults to cluster.local. (#6989)
• Implemented the cnpg.io/validation annotation, enabling users to disable the validation webhook on CloudNativePG-managed resources. Use with caution, as this allows unrestricted changes. (#7196)
• Added support for patching PostgreSQL instance pods using the cnpg.io/podPatch annotation with a JSON Patch. This may introduce discrepancies between the operator’s expectations and Kubernetes behavior, so it should be used with caution. (#6323)
• Added support for collecting pg_stat_wal metrics in PostgreSQL 18. (#7005)
• Removed the ENABLE_AZURE_PVC_UPDATES configuration, as it is no longer required to resize Azure volumes correctly. The Azure CSI driver includes the necessary fix as of version 1.11.0. (#7297)
• The .spec.backup.barmanObjectStore and .spec.backup.retentionPolicy fields are now deprecated in favor of the external Barman Cloud Plugin, and a warning is now emitted by the admission webhook when these fields are used in the Cluster specification (#7500).
• Added support for LZ4, XZ, and Zstandard compression methods when archiving WAL files via Barman Cloud (deprecated). (#7151)
• CloudNativePG Interface (CNPG-I):
  • A plugin can now trigger instance rollouts by implementing the EVALUATE verb, ensuring that plugin-induced changes are properly reconciled. (#7126)
  • Introduced support for WAL recovery via CNPG-I plugins during snapshot restore. (#7284)

Security

• Set imagePullPolicy to Always for the operator deployment to ensure that images are always pulled from the registry, reducing the risk of using outdated or potentially unsafe local images. (#7250)

Fixes

• Fixed native replication slot synchronization and logical replication failover for PostgreSQL 17 by appending the dbname parameter to primary_conninfo in replica configurations (#7298).
• Fixed a regression in WAL restore operations that prevented fallback to the in-tree barmanObjectStore configuration defined in the externalCluster source when a plugin failed to locate a WAL file (#7507).
• Improved backup efficiency by introducing a fail-fast mechanism in WAL archiving, allowing quicker detection of unexpected primary demotion and avoiding unnecessary retries (#7483).
• Fixed an off-by-one error in parallel WAL archiving that could cause one extra worker process to be spawned beyond the requested number (#7389).
• Resolved a race condition that caused the operator to perform two switchovers when updating the PostgreSQL configuration. (#6991)
• Corrected the PodMonitor configuration by adjusting the matchLabels scope for the targeted pooler and cluster pods. Previously, the matchLabels were too broad, inadvertently inheriting labels from the cluster and leading to data collection from unintended targets. (#7063)
• Added a webhook warning for clusters with a missing unit (e.g., MB, GB) in the shared_buffers configuration. This will become an error in future releases. Users should update their configurations to include explicit units (e.g., 512MB instead of 512). (#7160)
• Treated timeout errors during volume snapshot creation as retryable to prevent unnecessary backup failures. (#7010)
• Moved the defaulting logic for .spec.postgresql.synchronous.dataDurability from the CRD to the webhook to avoid UI issues with OLM. (#7600)
• CloudNativePG Interface (CNPG-I):
  • Implemented automatic reloading of TLS certificates for plugins when they change. (#7029)
  • Ensured the operator properly closes the plugin connection when performing a backup using the plugin. (#7095, #7096)
  • Fixed an issue that prevented WALs from being archived on a former primary node when using a plugin. (#6964)
  • Improved performance and resilience of CNPG-I by removing timeouts for local plugin operations, avoiding failures during longer backup or WAL archiving executions (#7496)
• cnpg plugin:
  • Increased the buffer size in the logs pretty command to better handle larger log output (#7281).
  • Ensured the plugin-name parameter is required for plugin-based backups and disallowed for non-plugin backup methods (#7506).
  • Ensured that the primary Pod is recreated during an imperative restart when primaryUpdateMethod is set to restart, aligning its definition with the replicas. (#7122)

Changes

• Updated the default PostgreSQL version to 17.5 for new cluster definitions. (#7556)
• Updated the default PgBouncer version to 1.24.1 for new Pooler deployments (#7399).

Supported versions

• Kubernetes 1.33, 1.32, 1.31, and 1.30
• PostgreSQL 17, 16, 15, 14, and 13
  • PostgreSQL 17.5 is the default image
  • PostgreSQL 13 support ends on November 12, 2025

The CloudNativePG Community is delighted to announce the availability of CloudNativePG 1.28.0 Release Candidate 2!

This RC builds on the first round of large-scale testing by addressing several issues and introducing targeted improvements. For full details, please refer to the 1.28.0 RC2 release notes.

A heartfelt thank you to everyone who participated in the preview programme so far. Your insights, reports, and suggestions are directly shaping the quality and stability of this release.

We encourage you to continue testing 1.28.0 RC2 in your non-production environments. Your feedback is essential to delivering a robust, reliable final release and ensuring that CloudNativePG 1.28 maintains its position as the leading Kubernetes-native Postgres operator.

Learn how to test and contribute.

Testing

Each CloudNativePG release depends on thorough validation by our community. By testing this release candidate against your real workloads, you help us detect regressions and improve behaviour before the final release.

• Review the open issues for the 1.28 milestone.
• Report bugs or share feedback directly on GitHub.

Release Timeline

RC2 is the latest step in the 1.28 release cycle. Additional release candidates may follow if needed. The final release is currently planned for early December 2025.

Join the Community

CloudNativePG thrives thanks to a welcoming, vendor-neutral community of contributors and practitioners. Join the conversation and help shape the future of PostgreSQL on Kubernetes.

Thank you once again for your trust, enthusiasm, and contributions. Together, we’re building the future of Postgres on Kubernetes.

The CloudNativePG Community is thrilled to announce the first release candidate of CloudNativePG 1.28! This preview release provides an opportunity to explore new features and enhancements before the final version is officially launched. While refinements may still occur, here’s a look at what’s new.

Key Features

Quorum-Based Failover Promoted to Stable

The quorum-based failover feature, introduced experimentally in 1.27, has been promoted to a stable API. This data-driven failover mechanism is now configured via the spec.postgresql.synchronous.failoverQuorum field, graduating from the previous alpha.cnpg.io/failoverQuorum annotation. This enhances failover safety and data durability for high-availability clusters.

Declarative Foreign Data Management

We introduced comprehensive declarative management for Foreign Data Wrappers (FDW) by extending the Database CRD. This feature adds the .spec.fdws and .spec.servers fields, allowing you to manage FDW extensions and foreign servers directly from the Database resource. This work was implemented by Ying Zhu (@EdwinaZhu) as part of the LFX Mentorship Program 2025 Term 2.

There’s More…

Explore other improvements in this release, including:

• Introduced granular control over fine-grained security contexts, allowing securityContext at the pod level and containerSecurityContext for individual containers.
• Allowed providing custom TLS for PgBouncer for both client-to-pooler and pooler-to-server connections, taking precedence over operator-generated certificates.
• Added optional TLS support for the operator’s metrics server, enabled via the METRICS_CERT_DIR environment variable.
• Enabled the cnpg report operator command to work with minimal, least-privileged access, gracefully handling permission errors.
• Introduced the alpha.cnpg.io/unrecoverable=true annotation to automatically delete and recreate a replica pod and its PVCs.

Dive into the full details in the release notes for 1.28 RC1.

Testing

The stability of each CloudNativePG release relies on the community’s engagement. Testing your workloads with this release candidate helps identify bugs and regressions early.

• View the open issues for the 1.28 release.
• Report bugs directly on GitHub.

Release Timeline

CloudNativePG 1.28 RC1 is the first in a series of release candidates. Additional release candidates may follow as needed before the final release, currently planned for the second half of November.

Join the Community

Connect with our community on your preferred platform!

Thank you for your continued support of CloudNativePG. Your contributions help us advance the Kubernetes-native PostgreSQL experience.