RATATOSKRATATOSK
Sign in

CloudNativePG

v1.28.4Storage & Data
Jun 29, 2026

CHECK 4PLAN 2OTHER 35

A maintenance release with security fixes, stricter API validation, support and default-version updates, and correctness fixes across cluster operations and the cnpg plugin. It also updates Kubernetes support, autoscaler integration, and cluster status visibility.

Check if affected (4)

  • securitycriticalsearch_path pinning on pooled connections

    Applies if you use pooled connections.

    The operator now pins search_path = pg_catalog, public, pg_temp on every pooled connection, so the value is included in the startup message and takes precedence over tenant-controlled defaults. The change is associated with CVE-2026-55769 and GHSA-x8c2-3p4r-v9r6.

  • securityhighSCRAM-SHA-256 encoding for cleartext role passwords

    Applies if you use cleartext role passwords.

    The operator now encodes cleartext role passwords with SCRAM-SHA-256 before issuing CREATE or ALTER ROLE ... PASSWORD. The change concerns cnpg.io/passwordPassthrough and is associated with CVE-2026-55765 and GHSA-w3gf-xc94-wvmj.

  • breakingcluster reference immutability

    Applies if you use the cluster reference on Database, Pooler, Publication, Subscription, or ScheduledBackup resources.

    The cluster reference is now immutable on Database, Pooler, Publication, Subscription, and ScheduledBackup resources.

  • breakingValidating webhook and write-site rejection

    Applies if you use values checked by the validating webhook.

    The validating webhook now rejects these values, and the write site checks them again.

Plan ahead (2)

  • deprecated1.28 support ending

    Applies if you run 1.28.

    This is the final release in the 1.28.x series, and 1.28 is no longer supported. The notice encourages users to move to a newer minor version.

  • deprecatedNative (in-tree) Barman Cloud support deprecationremoval planned in 1.31.0

    Applies if you use native (in-tree) Barman Cloud support.

    The deprecation notice now says that native (in-tree) Barman Cloud support will be removed in 1.31.0 instead of 1.30.0. It encourages migration to the Barman Cloud Plugin.

All 35 other recorded changesfixes 30 · additions 2 · value changes 2 · constraints 1

fixes (30)

  • Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives into postgresql.conf; key names are now validated by the webhook.
  • Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever after their cluster was demoted to a replica
  • Fixed non-sequential pod names (for example -1, -3) caused by the instance serial counter being advanced before the corresponding Job and PVCs were created
  • Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster
  • Fixed a cluster staying in Setting up primary indefinitely when the instance-creation Job exhausted its backoff limit
  • Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating on a replica cluster
  • Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR
  • Fixed the postgres superuser being left locked out after superuser access was disabled and then re-enabled
  • Fixed backups getting stuck in the started phase when the instance manager running them was restarted
  • Fixed resource leaks when concurrent Backup objects raced
  • Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched
  • Fixed a bootstrap failure where a metrics-exporter setup error (commonly a duplicate-key race with the controller) rolled back streaming_replica creation and wedged replica joins.
  • Fixed a ScheduledBackup controller loop that occurred when a Backup was created but its status patch never landed
  • Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted.
  • Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers during WithActiveInstance
  • Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets.
  • Fixed an external cluster plugin still being treated as active when its configuration set enabled: false.
  • Fixed a race during bootstrap recovery from an object store where the restore job could read a stale Cluster
  • Fixed a cache race during cluster creation when the server and client CA resolve to the same Secret (the default)
  • Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA
  • Fixed the Cluster phase flapping between Healthy and a plugin-failure phase when a post-reconcile plugin hook returned an error
  • Fixed stale certificate data and partial reads after an external server's Secret was rotated
  • Fixed plugin connectivity to use the plugin Service FQDN instead of its short name
  • Fixed excessive operator log noise from the per-request Cluster create/update validation webhook messages, now logged at debug instead of info.
  • Fixed a first-primary bootstrap deadlock where a status-patch conflict after the data PVC was created but before the initialization Job was started left the orphan Pending PVC counted as an instance
  • Fixed a declarative VolumeSnapshot backup being permanently marked as failed when a stale cache made the operator re-create a snapshot it had already provisioned
  • Fixed a volume snapshot backup being discarded on a transient instance-manager connection error
  • Fixed a replica switchover losing its status.demotionToken
  • Fixed kubectl cnpg psql on Windows, where execution relied on a Unix-only system call and failed with "not supported by windows"
  • Fixed an unbounded memory leak in kubectl cnpg logs -f on busy clusters

additions (2)

  • Added a label selector to the Cluster scale subresource (status.selector), making a Cluster a valid targetRef for the Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map a Cluster to its instance pods.
  • The operator now emits a Warning PrimaryStatusCheckFailed event on the Cluster when the primary pod is Ready from the kubelet perspective but the operator's /pg/status check fails and failover is deferred, giving users visibility into the deferral via kubectl describe cluster.

value changes (2)

  • The operator now reloads a CNPG-i plugin automatically when its pods are rolled
  • Updated the default PostgreSQL version to 18.4.

constraints (1)

  • Added support for Kubernetes 1.35 and enabled unit tests on Kubernetes 1.36.
Add CloudNativePG to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All CloudNativePG releases →