CloudNativePG

v1.29.0Storage & Data

2026年4月1日

設定と可観測性の機能が拡充され、デフォルトの PostgreSQL イメージが変更されています。アップグレードとリカバリの信頼性が向上し、ログへのパスワード漏えいを修正するセキュリティ対応も含まれています。

要対応 (1)

breakingデフォルトの PostgreSQL イメージを更新
デフォルトの PostgreSQL バージョンを使用している場合に該当します。
デフォルトの PostgreSQL バージョンを 18.3に更新し、イメージに 18.3-system-trixieを使用します。

deprecatednative (in-tree) Barman Cloud support の廃止予定を更新1.30.0で削除予定
native (in-tree) Barman Cloud support を使用している場合に該当します。
native (in-tree) Barman Cloud support の廃止予定を、1.29.0ではなく CloudNativePG 1.30.0で削除される内容に更新しました。

その他の記録済み変更 34 件すべてfixes 14 · additions 13 · constraints 4 · value changes 3

Fixed a deadlock during operator upgrades affecting clusters using synchronous replication
Fixed an issue where fencing annotations could not be processed when the WAL disk was full
Fixed an issue where replicas would get stuck in a Pending state if the VolumeSnapshot used for the initial bootstrap had been deleted.
Prevented the "supervised primary" rollout strategy from consuming all available rollout slots
Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters.
Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins
Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod.
Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with ConnectionParameters
Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes.
Fixed fencing to work correctly even when the target pod does not exist.
Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy.
Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore
Fixed the timeline history file validation to also apply to plugin-based WAL restore.
The cnpg plugin now correctly propagates ImagePullSecrets to the pgbench Job pod template.

extended the ImageCatalog functionality to support PostgreSQL extensions.
introduced the declarative definition of podSelectorRefs to manage pg_hba.conf rules dynamically.
added an optional serviceAccountName field to both Cluster and Pooler specifications.
Improved the Pooler CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions.
emitting native Kubernetes events during key phases of the reconciliation loop
Added a bin_path field to the postgresql.extensions stanza, as well as in ImageCatalog and ClusterImageCatalog resources.
Added an env field to the postgresql.extensions stanza, as well as in ImageCatalog and ClusterImageCatalog resources.
Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted.
Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues
introducing reconciliationStartedAt and reconciliationTerminatedAt fields to the Backup status.
Added a Pending phase to the Backup status
added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation
the operator now reports a WaitingForHealthy condition

Extended support for the cnpg.io/reconciliationDisabled annotation on Backup resources.
allow it to function even on pods that have not yet reached the Ready state
Kubernetes 1.35, 1.34, and 1.33
PostgreSQL 18, 17, 16, 15, and 14

Improved the reliability of major upgrades by setting BackoffLimit=0 on the upgrade job, preventing unnecessary retries of a failed pg_upgrade.
Improved role management by verifying the instance is the primary before each reconciliation cycle
The operator now honors the primaryUpdateMethod when adding new PVCs to a cluster

CloudNativePGをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回のセキュリティパッチと破壊的変更も、その一例です。