RATATOSKRATATOSK
ログイン

CloudNativePG

v1.30.0Storage & Data
2026年6月29日

ACTION 3CHECK 1PLAN 2OTHER 48

KubernetesとPostgreSQLの機能拡張に加え、検証と互換性の見直し、既定値の変更、正確性に関わる修正を含む大規模なリリースです。複数のセキュリティ修正も含まれます。

要対応 (3)

  • securitycriticalプール接続のsearch_path固定

    オペレーターは、すべてのプール接続でsearch_path = pg_catalog, public, pg_tempを固定するようになりました。関連する識別子はCVE-2026-55769とGHSA-x8c2-3p4r-v9r6です。

  • securityhighロールパスワードのSCRAM-SHA-256エンコード

    オペレーターは、平文のロールパスワードをSCRAM-SHA-256形式でエンコードするようになりました。関連する識別子はCVE-2026-55765とGHSA-w3gf-xc94-wvmjです。

  • security機密エンドポイントの証明書検証

    インスタンスマネージャーは、一致する証明書を提示しないリクエストを機密エンドポイントで拒否するようになりました。関連する識別子はGHSA-7qwx-x8ff-3px9です。

影響確認 (1)

  • breakingcluster参照の不変化

    clusterを設定している場合に該当します。

    Database、Pooler、Publication、Subscription、ScheduledBackupリソースでは、cluster参照が変更できない値になりました。

事前準備 (2)

  • deprecatednative (in-tree) Barman Cloud supportの削除時期変更1.31.0で削除予定

    native (in-tree) Barman Cloud supportを使用している場合に該当します。

    native (in-tree) Barman Cloud supportは、1.30.0ではなく1.31.0で削除されます。

  • deprecatedstatus.latestGeneratedNodeの非推奨化

    status.latestGeneratedNodeを使用している場合に該当します。

    status.latestGeneratedNodeは非推奨になりました。

その他の記録済み変更 48 件すべてfixes 33 · additions 9 · value changes 4 · constraints 2

fixes (33)

  • validation failures are surfaced in the resource status instead of failing silently later
  • Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever
  • Fixed non-sequential pod names
  • Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating
  • Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR
  • Fixed the postgres superuser being left locked out
  • Fixed backups getting stuck in the started phase
  • Fixed exec/attach streaming to negotiate WebSocket with a SPDY fallback
  • Fixed resource leaks when concurrent Backup objects raced
  • Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched
  • Fixed a ScheduledBackup controller loop
  • Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted.
  • Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers
  • Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets.
  • Fixed an external cluster plugin still being treated as active when its configuration set enabled: false.
  • Fixed a race during bootstrap recovery from an object store
  • Fixed a race where deleting an instance's PVCs could leave the instance permanently stuck
  • Fixed a cache race during cluster creation
  • Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA
  • Fixed the Cluster phase flapping between Healthy and a plugin-failure phase
  • Fixed stale certificate data and partial reads after an external server's Secret was rotated
  • Fixed plugin connectivity to use the plugin Service FQDN instead of its short name
  • Fixed excessive operator log noise
  • Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names
  • Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster
  • Fixed a cluster staying in Setting up primary indefinitely
  • Fixed a first-primary bootstrap deadlock
  • these values are now rejected at the validating webhook and re-checked at the write site
  • Fixed a backup getting stuck in pending forever
  • Fixed a declarative VolumeSnapshot backup being permanently marked as failed
  • Fixed a volume snapshot backup being discarded on a transient instance-manager connection error
  • Fixed a replica switchover losing its status.demotionToken
  • The metrics-exporter step now runs in a separate transaction.

additions (9)

  • introduced a Kubernetes Lease object (named after the cluster) that acts as a mutex serializing primary promotion
  • introduced a DatabaseRole custom resource that manages a PostgreSQL role as a standalone Kubernetes object
  • a DatabaseRole can now include a clientCertificate block
  • through the new spec.pgbouncer.imageCatalogRef field
  • Added TLS support for the Pooler metrics endpoint via .spec.monitoring.tls.enabled.
  • Added a label selector to the Cluster scale subresource (status.selector)
  • now emits a Warning PrimaryStatusCheckFailed event on the Cluster
  • Added the ENABLE_WEBHOOK_NAMESPACE_SUFFIX flag
  • A new Initialized cluster condition reports whether the cluster has completed its first bootstrap

value changes (4)

  • The operator now reloads a CNPG-i plugin automatically when its pods are rolled
  • Pod and PVC names stay stable across instance recreation
  • Updated the default PostgreSQL version to 18.4.
  • PostgreSQL 18.4 is the default image - PostgreSQL 14 support ends on November 12, 2026

constraints (2)

  • Enabled pg_upgrade in-place major upgrades to PostgreSQL 19 or later
  • Added support for Kubernetes 1.36.
CloudNativePGをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗CloudNativePGのリリース一覧 →