RATATOSKRATATOSK
ログイン

CloudNativePG

v1.30.1Storage & Data
2026年9月23日

ACTION 1CHECK 2OTHER 38

正確性とフェイルオーバーの信頼性に重点を置いたメンテナンスリリースです。リカバリやライフサイクルに関する修正に加え、PostgreSQLイメージの更新とセキュリティ関連の変更が含まれます。

要対応 (1)

  • securityhighgRPC依存関係をv1.83.1に更新

    google.golang.org/grpcをv1.83.1に更新し、HTTP/2 DATAフレームの分割によるgRPC-Goのヒープメモリ枯渇に関するCVE-2026-84304とGHSA-vp52-pcj8-j9qcを修正しました。

    CVE-2026-84304

影響確認 (2)

  • security拡張パスのトラバーサル検証を修正

    拡張パスを設定している場合に適用されます。

    絶対パスに含まれる..のトラバーサルを実行時の解決後にも検証するようにし、拡張機能のマウントポイントから外れるパスをWebhookが受け入れないよう修正しました。

  • breakingPostgreSQLのデフォルトoperand imageを更新

    PostgreSQLのoperand imageを設定していない場合に適用されます。

    PostgreSQLのデフォルトoperand imageを18.6-system-trixieに更新しました。

その他の記録済み変更 38 件すべてfixes 31 · additions 3 · value changes 3 · constraints 1

fixes (31)

  • Fixed PgBouncer metrics silently reporting zero when PgBouncer adds or reorders columns: SHOW STATS and SHOW POOLS results are now matched by column name instead of by position.
  • Demoted an unreachable old primary immediately during failover, instead of waiting on checkpoint and fast-shutdown attempts that could never complete.
  • Fixed failover and Pod recreation getting stuck while any instance in the cluster was fenced.
  • Fixed a failover that could stall forever or get silently reverted.
  • Fixed the designated-primary sort in PostgresqlStatusList so a tie on LSN no longer sorts it out of order.
  • Gated PostgreSQL startup on the instance manager actually holding the primary Lease, closing a window where a restarting or rescheduled primary could start accepting writes before acquiring the lease.
  • Bounded the primary lease take-over Get call to the lease's RenewDeadline, so a call against an unreachable API server now fails fast and retries instead of blocking indefinitely.
  • Stopped abandoning a fast shutdown after 60 seconds.
  • Waited for certificate status before refreshing secrets during bootstrap.
  • Fixed in-tree Barman Cloud recovery ignoring wal.maxParallel and wal.restoreAdditionalCommandArgs, fetching WAL one segment at a time instead of using the configured parallelism.
  • Honored the unrecoverable annotation on pending and terminating instances.
  • Honored Backup.spec.online when finalizing VolumeSnapshot-based backups, so a cold backup is no longer reported as online in status.
  • Set --no-data-checksums explicitly when .spec.postgresql.dataChecksums is false on PostgreSQL 18+, which now enables checksums by default in initdb.
  • Stopped discarding .spec.inheritedMetadata labels on PVC reconciliation; they were applied before, and then overwritten by, the operator's own labels.
  • Stopped Pooler and DatabaseRole from recreating their owned resources after being marked for deletion
  • Handled a NULL stats_reset value in the pg_stat_wal metric, which could occasionally break Prometheus scraping on PostgreSQL 18 clusters.
  • Recovered log streaming when a stale non-FIFO file blocked the log pipe.
  • Stopped sampling logs of the Pods' processes, so no log lines are silently dropped.
  • Stopped caching Helm release Secrets in the operator, which could spike memory usage and crashloop the operator on clusters with large Helm releases installed alongside it.
  • Re-ran owned-resource finalizer cleanup after an operator restart, so a namespace deleted while the operator was down doesn't hang in Terminating forever.
  • Fixed rejoining replicas taking a long time to complete pg_rewind when WAL prefetching (wal.maxParallel > 1) was enabled.
  • Treated a PostgreSQL instance rejecting connections as started up in probes.
  • Stopped issuing a redundant PATCH on every reconciliation when a cluster's pvcTemplate set volumeAttributesClass.
  • Stopped halting replication slot reconciliation at the first failing slot.
  • During rollouts, compared the running configuration hash, rather than the on-disk one, avoiding unnecessary switchovers.
  • Retried VolumeSnapshot errors until the deadline, instead of giving up early.
  • Symlinked pg_wal to the WAL volume during plugin-based recovery, instead of replaying WAL onto the data volume, which could exhaust it on a large point-in-time recovery.
  • Reported the Postgres capabilities of a plugin correctly.
  • Prevented the plugin status field from flapping on Cluster reconciliation.
  • Replaced a finalizer with in-memory cleanup on Service deletion.
  • Deleted PVCs before Pods in cnpg destroy, avoiding a race that could leave dangling PVCs needing a second invocation to clean up.

additions (3)

  • Added restoreAdditionalCommandArgs to .barmanObjectStore.data for in-tree Barman Cloud recoveries, so custom flags are forwarded to barman-cloud-restore during recovery.
  • Added support for setting auth_user in spec.pgbouncer.parameters to override the user PgBouncer uses for its auth_query connection
  • Added a --dry-run option to the backup command that prints the Backup resource that would be created, without creating it.

value changes (3)

  • the operator now computes the check_empty_wal_archive decision once and passes it to CNPG-I plugins on both WAL archiving and restore hooks.
  • Moved the operator's own base image from Debian 12 (bookworm) to Debian 13 (trixie), now that Debian 12 has moved to LTS-only maintenance.
  • Used UTC time zone for the default backup name.

constraints (1)

  • Allowed setting the ssl_ecdh_curve PostgreSQL parameter in .spec.postgresql.parameters. It was previously rejected by the validating webhook even though the operator does not manage it.
CloudNativePGをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗CloudNativePGのリリース一覧 →