RATATOSKRATATOSK
ログイン

CloudNativePG

v1.29.3Storage & Data
2026年9月23日

ACTION 2CHECK 1OTHER 38

フェイルオーバー、リカバリ、可観測性、クリーンアップに関する修正を含むメンテナンスリリースです。Webhook の検証修正と依存関係の更新も含まれており、`1.29` 系列を利用している場合はサポート対象の新しいマイナーバージョンへのアップグレードが必要です。

要対応 (2)

  • securityhighgoogle.golang.org/grpc を v1.83.1 に更新

    google.golang.org/grpc を v1.83.1 に更新しました。HTTP/2 DATA フレームの断片化による gRPC-Go のヒープメモリ枯渇に関する CVE-2026-84304 と GHSA-vp52-pcj8-j9qc に対応しています。

    CVE-2026-84304

  • securityWebhook の拡張パス検証を修正

    絶対パスに埋め込まれた .. によるパス・トラバーサルを含む拡張パスが、検証時に受け入れられる問題を修正しました。/a/../../../../etc のようなパスが解決後に拡張機能のマウントポイント外へ抜けないよう、Webhook の検証を修正しています。

影響確認 (1)

  • breaking1.29.x 系列のサポート終了

    1.29 系列を利用している場合に適用されます。

    1.29.x 系列の最終リリースです。1.29 はサポート対象外となるため、より新しいマイナーバージョンへのアップグレードが推奨されています。

その他の記録済み変更 38 件すべてfixes 29 · additions 3 · defaults 2 · value changes 2 · constraints 1 · renames 1

fixes (29)

  • Fixed PgBouncer metrics silently reporting zero when PgBouncer adds or reorders columns: SHOW STATS and SHOW POOLS results are now matched by column name instead of by position.
  • Demoted an unreachable old primary immediately during failover, instead of waiting on checkpoint and fast-shutdown attempts that could never complete.
  • Fixed failover and Pod recreation getting stuck while any instance in the cluster was fenced.
  • Fixed a failover that could stall forever or get silently reverted.
  • Fixed the designated-primary sort in PostgresqlStatusList so a tie on LSN no longer sorts it out of order.
  • Stopped abandoning a fast shutdown after 60 seconds.
  • Waited for certificate status before refreshing secrets during bootstrap.
  • Fixed in-tree Barman Cloud recovery ignoring wal.maxParallel and wal.restoreAdditionalCommandArgs, fetching WAL one segment at a time instead of using the configured parallelism.
  • Honored the unrecoverable annotation on pending and terminating instances.
  • Honored Backup.spec.online when finalizing VolumeSnapshot-based backups, so a cold backup is no longer reported as online in status.
  • Retried volume snapshot backups on transient instance-manager connection errors (e.g. a dial timeout from a brief pod-network disruption), instead of failing the backup outright.
  • Set --no-data-checksums explicitly when .spec.postgresql.dataChecksums is false on PostgreSQL 18+, which now enables checksums by default in initdb.
  • Stopped discarding .spec.inheritedMetadata labels on PVC reconciliation; they were applied before, and then overwritten by, the operator's own labels.
  • Stopped Pooler and DatabaseRole from recreating their owned resources after being marked for deletion, which could block an external finalizer (e.g. ArgoCD foreground deletion) waiting for those resources to disappear.
  • Handled a NULL stats_reset value in the pg_stat_wal metric, which could occasionally break Prometheus scraping on PostgreSQL 18 clusters.
  • Recovered log streaming when a stale non-FIFO file blocked the log pipe.
  • Stopped sampling logs of the Pods' processes, so no log lines are silently dropped.
  • Stopped caching Helm release Secrets in the operator, which could spike memory usage and crashloop the operator on clusters with large Helm releases installed alongside it.
  • Re-ran owned-resource finalizer cleanup after an operator restart, so a namespace deleted while the operator was down doesn't hang in Terminating forever.
  • Fixed rejoining replicas taking a long time to complete pg_rewind when WAL prefetching (wal.maxParallel > 1) was enabled.
  • Treated a PostgreSQL instance rejecting connections as started up in probes.
  • Stopped issuing a redundant PATCH on every reconciliation when a cluster's pvcTemplate set volumeAttributesClass.
  • Stopped halting replication slot reconciliation at the first failing slot.
  • During rollouts, compared the running configuration hash, rather than the on-disk one, avoiding unnecessary switchovers.
  • Retried VolumeSnapshot errors until the deadline, instead of giving up early.
  • Symlinked pg_wal to the WAL volume during plugin-based recovery, instead of replaying WAL onto the data volume, which could exhaust it on a large point-in-time recovery.
  • Reported the Postgres capabilities of a plugin correctly.
  • Prevented the plugin status field from flapping on Cluster reconciliation.
  • Deleted PVCs before Pods in cnpg destroy, avoiding a race that could leave dangling PVCs needing a second invocation to clean up.

additions (3)

  • Added restoreAdditionalCommandArgs to .barmanObjectStore.data for in-tree Barman Cloud recoveries, so custom flags are forwarded to barman-cloud-restore during recovery.
  • Added support for setting auth_user in spec.pgbouncer.parameters to override the user PgBouncer uses for its auth_query connection, instead of always deriving it from the authQuerySecret.
  • Added a --dry-run option to the backup command that prints the Backup resource that would be created, without creating it.

defaults (2)

  • Updated the default PostgreSQL operand image to 18.6-system-trixie.
  • Used UTC time zone for the default backup name.

value changes (2)

  • the operator now computes the check_empty_wal_archive decision once and passes it to CNPG-I plugins on both WAL archiving and restore hooks.
  • Moved the operator's own base image from Debian 12 (bookworm) to Debian 13 (trixie), now that Debian 12 has moved to LTS-only maintenance.

constraints (1)

  • Allowed setting the ssl_ecdh_curve PostgreSQL parameter in .spec.postgresql.parameters. It was previously rejected by the validating webhook even though the operator does not manage it.

renames (1)

  • Replaced a finalizer with in-memory cleanup on Service deletion.
CloudNativePGをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗CloudNativePGのリリース一覧 →