RATATOSKRATATOSK
로그인

CloudNativePG

v1.29.2Storage & Data
2026년 6월 29일

CHECK 4PLAN 1OTHER 38

보안 수정과 검증 강화, 호환성 개선 및 여러 정확성 수정이 포함된 유지보수 릴리스입니다. PostgreSQL 기본값 변경과 최신 Kubernetes 버전 지원도 포함합니다.

영향 확인 (4)

  • securitycritical풀링된 연결의 search_path 고정

    풀링된 연결을 사용한다면 해당됩니다.

    모든 풀링된 연결에서 search_path = pg_catalog, public, pg_temp가 고정됩니다.

  • securityhigh역할 비밀번호의 SCRAM-SHA-256 인코딩

    cnpg.io/passwordPassthrough를 설정한다면 해당됩니다.

    cnpg.io/passwordPassthrough 설정을 사용할 때, 역할의 평문 비밀번호를 CREATE 또는 ALTER ROLE ... PASSWORD 실행 전에 SCRAM-SHA-256 형식으로 인코딩합니다.

  • security검증 웹훅의 값 거부 및 재검사

    검증 웹훅이 거부하는 값을 사용한다면 해당됩니다.

    검증 웹훅에서 해당 값을 거부하고, 쓰기 시점에도 값을 다시 검사합니다.

  • breaking리소스의 cluster 참조 변경 제한

    Database, Pooler, Publication, Subscription, ScheduledBackup 리소스에서 cluster 참조를 사용한다면 해당됩니다.

    Database, Pooler, Publication, Subscription, ScheduledBackup 리소스에서 cluster 참조를 변경할 수 없게 되었습니다.

미리 준비 (1)

  • deprecatedBarman Cloud 네이티브 지원 중단 시점 변경1.31.0에서 제거 예정

    네이티브(인 트리) Barman Cloud 지원을 사용한다면 해당됩니다.

    네이티브(인 트리) Barman Cloud 지원 중단 안내가 갱신되어, 지원 제거 시점이 1.30.0에서 1.31.0으로 변경되었습니다.

그 외 기록된 변경 38건 전체fixes 31 · additions 3 · value changes 3 · constraints 1

fixes (31)

  • Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names
  • Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever after their cluster was demoted to a replica
  • Fixed non-sequential pod names (for example -1, -3) caused by the instance serial counter being advanced before the corresponding Job and PVCs were created
  • Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster
  • Fixed a cluster staying in Setting up primary indefinitely when the instance-creation Job exhausted its backoff limit
  • Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating on a replica cluster
  • Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR
  • Fixed the postgres superuser being left locked out after superuser access was disabled and then re-enabled
  • Fixed backups getting stuck in the started phase when the instance manager running them was restarted
  • Fixed exec/attach streaming to negotiate WebSocket with a SPDY fallback
  • Fixed resource leaks when concurrent Backup objects raced
  • Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched
  • Fixed a bootstrap failure where a metrics-exporter setup error
  • Fixed a ScheduledBackup controller loop that occurred when a Backup was created but its status patch never landed
  • Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted.
  • Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers
  • Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets.
  • Fixed an external cluster plugin still being treated as active when its configuration set enabled: false.
  • Fixed a race during bootstrap recovery from an object store where the restore job could read a stale Cluster
  • Fixed a cache race during cluster creation when the server and client CA resolve to the same Secret
  • Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA
  • Fixed the Cluster phase flapping between Healthy and a plugin-failure phase
  • Fixed stale certificate data and partial reads after an external server's Secret was rotated
  • Fixed plugin connectivity to use the plugin Service FQDN instead of its short name
  • Fixed a first-primary bootstrap deadlock where a status-patch conflict after the data PVC was created but before the initialization Job was started
  • Fixed a backup getting stuck in pending forever
  • Fixed a declarative VolumeSnapshot backup being permanently marked as failed
  • Fixed a volume snapshot backup being discarded on a transient instance-manager connection error
  • Fixed a replica switchover losing its status.demotionToken
  • Fixed kubectl cnpg psql on Windows
  • Fixed an unbounded memory leak in kubectl cnpg logs -f on busy clusters

additions (3)

  • Enabled pg_upgrade in-place major upgrades to PostgreSQL 19 or later for clusters that use Image Volume extensions
  • Added a label selector to the Cluster scale subresource (status.selector)
  • The operator now emits a Warning PrimaryStatusCheckFailed event on the Cluster

value changes (3)

  • The operator now reloads a CNPG-i plugin automatically when its pods are rolled
  • Updated the default PostgreSQL version to 18.4.
  • Fixed excessive operator log noise from the per-request Cluster create/update validation webhook messages, now logged at debug instead of info.

constraints (1)

  • Added support for Kubernetes 1.36.
CloudNativePG 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗CloudNativePG 릴리스 전체 →