[Bug]: spec.postgresql.parameters keys are not validated and can inject arbitrary postgresql.conf directives #11028

Is there an existing issue already for this bug?

• I have searched for an existing issue, and could not find anything. I believe this is a new bug.

I have read the troubleshooting guide

• I have read the troubleshooting guide and I think this is a new bug.

I am running a supported version of CloudNativePG

• I have read the troubleshooting guide and I think this is a new bug.

What happened?

spec.postgresql.parameters keys are rendered verbatim into postgresql.conf. The renderer interpolates the key with %s (pkg/configfile/configfile.go:97,112, reached through RenderPostgresConfiguration at pkg/configfile/configfile.go:127) and escapes only the value, not the key.

The admission webhook does not validate the shape of a parameter name. The only key-level check (internal/webhook/v1/cluster_webhook.go:1068) rejects a key when it matches FixedConfigurationParameters exactly; anything else passes.

A key containing a newline therefore renders as two physical lines. For example, a parameter named "#\narchive_command" with value /bin/something produces:

#
archive_command = "/bin/something"

The first line is a comment and the second is a live directive that the fixed-parameter filter never inspected.

This is a correctness gap, not a privilege-escalation boundary: anyone who can write a Cluster already controls the workload through imageName, bootstrap.initdb.postInitSQL, sidecar containers and so on. It still matters for deployments that gate specific Cluster fields through OPA/Gatekeeper, where the parameter map is assumed to be inert key/value data.

Surfaced while reviewing #10464.

Cluster resource

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: injection-demo
spec:
  instances: 1
  storage:
    size: 1Gi
  postgresql:
    parameters:
      "#\narchive_command": "/bin/something"

Relevant log output

n/a (the malformed key is accepted at admission and written into the rendered configuration)