RATATOSKRATATOSK
로그인

CloudNativePG

v1.30.0Storage & Data
2026년 6월 29일

ACTION 3CHECK 1PLAN 2OTHER 48

쿠버네티스와 PostgreSQL 기능을 확장하고 검증 및 호환성 동작을 조정한 릴리스입니다. 기본값 변경과 보안 및 정확성 수정도 포함되어 관련 기능을 사용하는 환경에 영향을 줄 수 있습니다.

조치 필요 (3)

  • securitycritical풀링 연결의 search_path 고정

    운영자가 모든 풀링 연결에서 search_path = pg_catalog, public, pg_temp를 고정합니다. 이 수정은 CVE-2026-55769 및 GHSA-x8c2-3p4r-v9r6와 관련됩니다.

  • securityhigh역할 비밀번호의 SCRAM-SHA-256 인코딩

    운영자가 평문 역할 비밀번호를 SCRAM-SHA-256으로 인코딩합니다. 이 수정은 CVE-2026-55765, GHSA-w3gf-xc94-wvmj 및 cnpg.io/passwordPassthrough와 관련됩니다.

  • security인증서 없는 민감한 엔드포인트 요청 거부

    인스턴스 관리자가 일치하는 인증서를 제시하지 않은 요청을 민감한 엔드포인트에 전달하지 않고 거부합니다. 관련 보안 권고 식별자는 GHSA-7qwx-x8ff-3px9입니다.

영향 확인 (1)

  • breaking리소스의 cluster 참조 변경 불가

    cluster를 구성하는 경우에 적용됩니다.

    cluster 참조가 Database, Pooler, Publication, Subscription, ScheduledBackup 리소스에서 변경되지 않도록 고정됩니다.

미리 준비 (2)

  • deprecatednative (in-tree) Barman Cloud support 제거 시점 연기1.31.0에서 제거 예정

    native (in-tree) Barman Cloud support를 사용하는 경우에 적용됩니다.

    native (in-tree) Barman Cloud support의 제거 시점이 CloudNativePG 1.30.0에서 1.31.0으로 연기됩니다. Barman Cloud Plugin으로 전환할 수 있는 기간이 한 버전 더 유지됩니다.

  • deprecatedstatus.latestGeneratedNode 사용 중단

    status.latestGeneratedNode를 사용하는 경우에 적용됩니다.

    status.latestGeneratedNode가 사용 중단 필드로 지정되었습니다.

그 외 기록된 변경 48건 전체fixes 33 · additions 9 · value changes 4 · constraints 2

fixes (33)

  • validation failures are surfaced in the resource status instead of failing silently later
  • Fixed declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever
  • Fixed non-sequential pod names
  • Fixed deletion of a Database, Publication, or Subscription getting stuck in Terminating
  • Fixed a conflicting duplicate Database or Subscription with a delete reclaim policy dropping the PostgreSQL object owned by the surviving CR
  • Fixed the postgres superuser being left locked out
  • Fixed backups getting stuck in the started phase
  • Fixed exec/attach streaming to negotiate WebSocket with a SPDY fallback
  • Fixed resource leaks when concurrent Backup objects raced
  • Fixed role reconciliation clearing the password on a PostgreSQL role when the referenced Secret could not be fetched
  • Fixed a ScheduledBackup controller loop
  • Fixed a nil-pointer panic when reconciling a Pooler whose Cluster has been deleted.
  • Fixed bootstrap log handling so that all named log pipes (postgres, postgres.csv, and postgres.json) get consumers
  • Fixed generation of invalid IPv6 URLs by wrapping the address in square brackets.
  • Fixed an external cluster plugin still being treated as active when its configuration set enabled: false.
  • Fixed a race during bootstrap recovery from an object store
  • Fixed a race where deleting an instance's PVCs could leave the instance permanently stuck
  • Fixed a cache race during cluster creation
  • Fixed the pg_basebackup bootstrap path overwriting or failing on a pre-existing PGDATA
  • Fixed the Cluster phase flapping between Healthy and a plugin-failure phase
  • Fixed stale certificate data and partial reads after an external server's Secret was rotated
  • Fixed plugin connectivity to use the plugin Service FQDN instead of its short name
  • Fixed excessive operator log noise
  • Fixed spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names
  • Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster
  • Fixed a cluster staying in Setting up primary indefinitely
  • Fixed a first-primary bootstrap deadlock
  • these values are now rejected at the validating webhook and re-checked at the write site
  • Fixed a backup getting stuck in pending forever
  • Fixed a declarative VolumeSnapshot backup being permanently marked as failed
  • Fixed a volume snapshot backup being discarded on a transient instance-manager connection error
  • Fixed a replica switchover losing its status.demotionToken
  • The metrics-exporter step now runs in a separate transaction.

additions (9)

  • introduced a Kubernetes Lease object (named after the cluster) that acts as a mutex serializing primary promotion
  • introduced a DatabaseRole custom resource that manages a PostgreSQL role as a standalone Kubernetes object
  • a DatabaseRole can now include a clientCertificate block
  • through the new spec.pgbouncer.imageCatalogRef field
  • Added TLS support for the Pooler metrics endpoint via .spec.monitoring.tls.enabled.
  • Added a label selector to the Cluster scale subresource (status.selector)
  • now emits a Warning PrimaryStatusCheckFailed event on the Cluster
  • Added the ENABLE_WEBHOOK_NAMESPACE_SUFFIX flag
  • A new Initialized cluster condition reports whether the cluster has completed its first bootstrap

value changes (4)

  • The operator now reloads a CNPG-i plugin automatically when its pods are rolled
  • Pod and PVC names stay stable across instance recreation
  • Updated the default PostgreSQL version to 18.4.
  • PostgreSQL 18.4 is the default image - PostgreSQL 14 support ends on November 12, 2026

constraints (2)

  • Enabled pg_upgrade in-place major upgrades to PostgreSQL 19 or later
  • Added support for Kubernetes 1.36.
CloudNativePG 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗CloudNativePG 릴리스 전체 →