RATATOSKRATATOSK
로그인

CloudNativePG

v1.28.2Storage & Data
2026년 4월 1일

CHECK 1PLAN 1OTHER 23

정확성 문제를 바로잡고 공급망 정보 제공을 보완한 유지보수 릴리스입니다. 운영자에게 보이는 동작 변경으로 PostgreSQL 기본 버전 상향과 암호 로그 노출 방지 수정이 포함됩니다.

영향 확인 (1)

  • securityPostgreSQL 역할 암호의 로그 노출 방지

    특정 조정 단계에서 적용됩니다.

    특정 조정 단계에서 PostgreSQL이 역할 암호를 로그에 노출할 수 있던 잠재적인 보안 위험을 수정했습니다.

    \#9950

미리 준비 (1)

  • deprecatednative (in-tree) Barman Cloud support 제거 시점 변경1.30.0에서 제거 예정

    native (in-tree) Barman Cloud support를 사용하는 경우에 적용됩니다.

    native (in-tree) Barman Cloud support의 사용 중단 안내가 갱신되어, 제거 시점이 CloudNativePG 1.29.0에서 CloudNativePG 1.30.0으로 변경되었습니다. Barman Cloud Plugin으로의 이전이 계속 권장됩니다.

    \#10167

그 외 기록된 변경 23건 전체fixes 14 · value changes 5 · additions 3 · constraints 1

fixes (14)

  • - Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([\#10342](https://github.com/cloudnative-pg/cloudnative-pg/pull/10342)) <!-- 1.28 -->
  • - Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([\#10302](https://github.com/cloudnative-pg/cloudnative-pg/pull/10302)) <!-- 1.28 1.27 -->
  • - Fixed an issue where replicas would get stuck in a Pending state if the VolumeSnapshot used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to pg_basebackup. ([\#10192](https://github.com/cloudnative-pg/cloudnative-pg/pull/10192)) <!-- 1.28 1.27 1.25 -->
  • - Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by @ermakov-oleg. ([\#9977](https://github.com/cloudnative-pg/cloudnative-pg/pull/9977)) <!-- 1.28 1.27 1.25 -->
  • - Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([\#9952](https://github.com/cloudnative-pg/cloudnative-pg/pull/9952)) <!-- 1.28 1.27 1.25 -->
  • - Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by @sharifmshaker. ([\#9978](https://github.com/cloudnative-pg/cloudnative-pg/pull/9978)) <!-- 1.28 1.27 -->
  • - Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by @jmealo. ([\#9981](https://github.com/cloudnative-pg/cloudnative-pg/pull/9981)) <!-- 1.28 1.27 -->
  • - Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with ConnectionParameters (for pg_basebackup-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([\#10268](https://github.com/cloudnative-pg/cloudnative-pg/pull/10268)) <!-- 1.28 1.27 1.25 -->
  • - Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([\#9973](https://github.com/cloudnative-pg/cloudnative-pg/pull/9973)) <!-- 1.28 1.27 -->
  • - Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the cnpg fencing on command. ([\#10035](https://github.com/cloudnative-pg/cloudnative-pg/pull/10035)) <!-- 1.28 1.27 1.25 -->
  • - Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as loadBalancerClass) from being inadvertently removed. ([\#10190](https://github.com/cloudnative-pg/cloudnative-pg/pull/10190), [\#10311](https://github.com/cloudnative-pg/cloudnative-pg/pull/10311)) <!-- 1.28 1.27 1.25 -->
  • - Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([\#10285](https://github.com/cloudnative-pg/cloudnative-pg/pull/10285)) <!-- 1.28 1.27 1.25 -->
  • - Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [\#9650](https://github.com/cloudnative-pg/cloudnative-pg/pull/9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([\#9849](https://github.com/cloudnative-pg/cloudnative-pg/pull/9849)) <!-- 1.28 1.27 1.25 -->
  • - The cnpg plugin now correctly propagates ImagePullSecrets to the pgbench Job pod template. ([\#10174](https://github.com/cloudnative-pg/cloudnative-pg/pull/10174)) <!-- 1.28 1.27 1.25 -->

value changes (5)

  • - Improved the reliability of major upgrades by setting BackoffLimit=0 on the upgrade job, preventing unnecessary retries of a failed pg_upgrade. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([\#10104](https://github.com/cloudnative-pg/cloudnative-pg/pull/10104), [\#10298](https://github.com/cloudnative-pg/cloudnative-pg/pull/10298)) <!-- 1.28 1.27 -->
  • - Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([\#9971](https://github.com/cloudnative-pg/cloudnative-pg/pull/9971)) <!-- 1.28 1.27 1.25 -->
  • - The operator now honors the primaryUpdateMethod when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([\#9720](https://github.com/cloudnative-pg/cloudnative-pg/pull/9720)) <!-- 1.28 1.27 -->
  • - Refined the alpha.cnpg.io/unrecoverable annotation logic to allow it to function even on pods that have not yet reached the Ready state, facilitating the recovery of stuck instances. ([\#9968](https://github.com/cloudnative-pg/cloudnative-pg/pull/9968)) <!-- 1.28 -->
  • - Updated the default PostgreSQL version to 18.3 (image 18.3-system-trixie). ([\#10090](https://github.com/cloudnative-pg/cloudnative-pg/pull/10090)) <!-- 1.28 1.27 1.25 -->

additions (3)

  • - Extended the CRD schemas for Cluster, ImageCatalog, and ClusterImageCatalog to accept the extensions, bin_path, and env fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. ([\#10131](https://github.com/cloudnative-pg/cloudnative-pg/pull/10131), [\#10387](https://github.com/cloudnative-pg/cloudnative-pg/pull/10387)) <!-- 1.28 1.27 -->
  • - **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([\#10048](https://github.com/cloudnative-pg/cloudnative-pg/pull/10048), <!-- 1.28 1.27 1.25 --> [\#10074](https://github.com/cloudnative-pg/cloudnative-pg/pull/10074)) <!-- 1.28 1.27 1.25 -->
  • - When hibernating a non-healthy cluster, the operator now reports a WaitingForHealthy condition, making the deferred hibernation state visible through cnpg status. ([\#10193](https://github.com/cloudnative-pg/cloudnative-pg/pull/10193)) <!-- 1.28 1.27 1.25 -->

constraints (1)

  • - Improved the Pooler CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by @alex1989hu. ([\#9571](https://github.com/cloudnative-pg/cloudnative-pg/pull/9571)) <!-- 1.28 1.27 1.25 -->
CloudNativePG 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗CloudNativePG 릴리스 전체 →