feat: add `podSelectorRefs` for dynamic `pg_hba` address resolution by armru · Pull Request #10148 · cloudnative-pg/cloudnative-pg

armru · 2026-03-05T12:35:59Z

Introduces a declarative way to manage pg_hba rules by resolving pod label selectors into IP addresses, eliminating the need for static CIDR ranges or manual updates when client pods restart.

Users define named label selectors in .spec.podSelectorRefs and reference them with ${podselector:NAME} in pg_hba address fields. The operator resolves matching pod IPs and the instance manager expands each reference into individual /32 or /128 entries at render time, with automatic reload on pod lifecycle changes.

Closes #10087

armru · 2026-03-05T12:36:08Z

/test

github-actions · 2026-03-05T12:36:18Z

❗ By default, the pull request is configured to backport to all release branches.

To stop backporting this pr, remove the label: backport-requested ◀️ or add the label 'do not backport'
To stop backporting this pr to a certain release branch, remove the specific branch label: release-x.y

github-actions · 2026-03-05T12:36:18Z

@armru, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/22718198409

sxd · 2026-03-05T15:44:12Z

@mnencia probably this should be tested with a pg_hba config like the one here https://github.com/cloudnative-pg/postgres-keycloak-oauth-validator?tab=readme-ov-file#example-cloudnativepg-configuration
Also I don't see a case of dual-stack in the testing, for order probably that case should be only one line?
On the other hand, instead of using a hard coded string for the mask is better to use something like this https://pkg.go.dev/net#IPMask.String but just an idea,
That was a quick check but the dual-stack thing is something that needs to be tested for sure

gbartolini · 2026-03-06T03:44:12Z

There is a problem with the markdown code for docs/src/cloudnative-pg.v1.md.

gbartolini · 2026-03-06T08:00:33Z

I created the angus cluster with a pgbouncer pooler (marshall):

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: angus
spec:
  instances: 3

  podSelectorRefs:
    - name: marshall-pooler
      selector:
        matchLabels:
          cnpg.io/podRole: pooler
          cnpg.io/cluster: angus
          cnpg.io/poolerName: marshall

  postgresql:
    pg_hba:
      - "hostssl all all ${podselector:marshall-pooler} scram-sha-256"
      - "host all all all reject"

  storage:
    size: 1Gi
---
apiVersion: postgresql.cnpg.io/v1
kind: Pooler
metadata:
  name: marshall
spec:
  cluster:
    name: angus

  instances: 3
  type: rw
  pgbouncer:
    poolMode: session
    parameters:
      max_client_conn: "1000"
      default_pool_size: "10"

The cluster defines the pooler podSelectorRef that points to the pooler's pods via three labels. Then it enables access to the database via the pooler and then adds a fallback rule to reject any access.

I then create these two simple jobs with pgbench, one going through the pooler (PGHOST=marshall) and one going directly to the angus-rw service.

apiVersion: batch/v1
kind: Job
metadata:
  name: marshall-pgbench
spec:
  template:
    spec:
      containers:
      - args:
        - -i
        command:
        - pgbench
        env:
        - name: PGHOST
          value: marshall
        - name: PGDATABASE
          value: app
        - name: PGPORT
          value: "5432"
        - name: PGUSER
          valueFrom:
            secretKeyRef:
              key: username
              name: angus-app
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: angus-app
        image: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
        name: pgbench
      restartPolicy: Never
---
apiVersion: batch/v1
kind: Job
metadata:
  name: angus-pgbench
spec:
  template:
    spec:
      containers:
      - args:
        - -i
        command:
        - pgbench
        env:
        - name: PGHOST
          value: angus-rw
        - name: PGDATABASE
          value: app
        - name: PGPORT
          value: "5432"
        - name: PGUSER
          valueFrom:
            secretKeyRef:
              key: username
              name: angus-app
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: angus-app
        image: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
        name: pgbench
      restartPolicy: Never

This is the result:

$ kubectl get pods
NAME                        READY   STATUS      RESTARTS   AGE
angus-1                     1/1     Running     0          17m
angus-2                     1/1     Running     0          17m
angus-3                     1/1     Running     0          14m
angus-pgbench-7q56c         0/1     Error       0          7s
csi-hostpathplugin-0        8/8     Running     0          6h21m
marshall-6796d674ff-czmkj   1/1     Running     0          17m
marshall-6796d674ff-gzmf9   1/1     Running     0          17m
marshall-6796d674ff-wmlwk   1/1     Running     0          17m
marshall-pgbench-blm7c      0/1     Completed   0          7s

$ kubectl logs jobs/angus-pgbench
Found 2 pods, using pod/angus-pgbench-7q56c
pgbench: error: connection to server at "angus-rw" (10.96.155.110), port 5432 failed: FATAL:  pg_hba.conf rejects connection for host "10.244.1.20", user "app", database "app", SSL encryption
connection to server at "angus-rw" (10.96.155.110), port 5432 failed: FATAL:  pg_hba.conf rejects connection for host "10.244.1.20", user "app", database "app", no encryption
pgbench: error: could not create connection for initialization

$ kubectl logs jobs/marshall-pgbench
dropping old tables...
creating tables...
generating data (client-side)...
100000 of 100000 tuples (100%) of pgbench_accounts done (elapsed 0.01 s, remaining 0.00 s)
vacuuming...
creating primary keys...
done in 0.10 s (drop tables 0.03 s, create tables 0.00 s, client-side generate 0.03 s, vacuum 0.02 s, primary keys 0.01 s).

The pg_hba rule we created using the pod selector is able to allow access through the pooler. The job that tries to connect directly through the angus-rw primary service is prevented from accessing the database.

gbartolini · 2026-03-06T08:03:21Z

Moreover, the status of the cluster contains:

  podSelectorRefs:
  - ips:
    - 10.244.1.16
    - 10.244.2.16
    - 10.244.3.24
    name: pooler

If I delete a pgbouncer pod, a new one is recreated with a different IP and the status is immediately updated:

  podSelectorRefs:
  - ips:
    - 10.244.1.16
    - 10.244.2.20
    - 10.244.3.24
    name: pooler

gbartolini · 2026-03-06T10:15:16Z

@mnencia probably this should be tested with a pg_hba config like the one here https://github.com/cloudnative-pg/postgres-keycloak-oauth-validator?tab=readme-ov-file#example-cloudnativepg-configuration

Although I have not tested the validator, I have introduced the row in the pg_hba.conf, and it was parsed correctly, which to me was enough.

Also I don't see a case of dual-stack in the testing, for order probably that case should be only one line? On the other hand, instead of using a hard coded string for the mask is better to use something like this https://pkg.go.dev/net#IPMask.String but just an idea, That was a quick check but the dual-stack thing is something that needs to be tested for sure

The dual-stack issue should be addressed globally, as it is not tied to this specific feature (as far as I understand). There is an ongoing discussion about this (#7116), but my response aligns with what I’ve been saying: considering everything, I believe there are more critical areas for the project to focus on at this stage, particularly regarding technical debt.

I believe the feature, as it stands, provides significant value and should be considered a major feature for version 1.29. However, it would be great to get your review if you have time.

mnencia · 2026-03-09T15:43:25Z

/test

github-actions · 2026-03-09T15:43:39Z

@mnencia, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/22861590448

Enable dynamic pod IP resolution in pg_hba rules via named label selectors. Users can define podSelectorRefs with label selectors that match application pods, then reference them in pg_hba rules using ${podselector:<name>} syntax. The operator resolves matching pod IPs and the instance manager expands ${podselector:<name>} tokens into one pg_hba line per IP with /32 (IPv4) or /128 (IPv6) masks. Signed-off-by: Armando Ruocco <[email protected]> Co-authored-by: Leonardo Cecchi <[email protected]>

Signed-off-by: Gabriele Bartolini <[email protected]>

Signed-off-by: Marco Nenciarini <[email protected]>

Add list-type markers to status field for consistent SSA behavior, detect duplicate selector names in the webhook, fix documentation inaccuracies and clarify code comments. Signed-off-by: Marco Nenciarini <[email protected]>

Signed-off-by: Marco Nenciarini <[email protected]>

Add tests for dual-stack pods, multiple selectors, pending pods without IPs, label and deletion timestamp predicate transitions, mixed IPv4/IPv6 HBA expansion, duplicate names, invalid label selectors, and multiple podselector references per line. Assisted-by: Claude Opus 4.6 Signed-off-by: Marco Nenciarini <[email protected]>

Replace ensureCIDR with hostCIDR using net.IPNet for proper CIDR formatting and IPv6 address normalization. Signed-off-by: Marco Nenciarini <[email protected]>

Signed-off-by: Marco Nenciarini <[email protected]>

mnencia · 2026-03-09T20:40:02Z

/test

github-actions · 2026-03-09T20:40:18Z

@mnencia, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/22873766938

Clarify actor attribution between operator and instance manager, remove duplicate zero-matches bullet already covered by the warning admonition, tone down "real-time" wording, drop unrelated max_worker_processes from the sample, and remove dead slices.Sort call from the e2e test. Signed-off-by: Marco Nenciarini <[email protected]>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cloudnative-pg](https://cloudnative-pg.io) ([source](https://github.com/cloudnative-pg/charts)) | minor | `0.27.1` → `0.28.0` | | [cloudnative-pg/cloudnative-pg](https://github.com/cloudnative-pg/cloudnative-pg) | minor | `1.28.1` → `1.29.0` | --- ### Release Notes <details> <summary>cloudnative-pg/charts (cloudnative-pg)</summary> ### [`v0.28.0`](https://github.com/cloudnative-pg/charts/releases/tag/cloudnative-pg-v0.28.0) [Compare Source](cloudnative-pg/charts@cloudnative-pg-v0.27.1...cloudnative-pg-v0.28.0) CloudNativePG Operator Helm Chart #### What's Changed - fix(security): harden GitHub Actions workflows against expression injection by [@mnencia](https://github.com/mnencia) in [#823](cloudnative-pg/charts#823) - feat(monitoring): add support for custom PodMonitor by [@Dashing-Nelson](https://github.com/Dashing-Nelson) in [#724](cloudnative-pg/charts#724) - Release cloudnative-pg-v0.28.0 by [@cnpg-bot](https://github.com/cnpg-bot) in [#845](cloudnative-pg/charts#845) #### New Contributors - [@Dashing-Nelson](https://github.com/Dashing-Nelson) made their first contribution in [#724](cloudnative-pg/charts#724) **Full Changelog**: <cloudnative-pg/charts@cluster-v0.6.0...cloudnative-pg-v0.28.0> </details> <details> <summary>cloudnative-pg/cloudnative-pg (cloudnative-pg/cloudnative-pg)</summary> ### [`v1.29.0`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0) [Compare Source](cloudnative-pg/cloudnative-pg@v1.28.2...v1.29.0-rc1) **Release date:** Mar 31, 2026 ##### Important changes - Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167))  ##### Features - **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#9781](cloudnative-pg/cloudnative-pg#9781)) - **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#10148](cloudnative-pg/cloudnative-pg#10148)) - **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@bozkayasalihx](https://github.com/bozkayasalihx). ([#9287](cloudnative-pg/cloudnative-pg#9287)) ##### Enhancements - Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571))  - Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298))  - Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#10040](cloudnative-pg/cloudnative-pg#10040)) - Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@GabriFedi97](https://github.com/GabriFedi97). ([#10020](cloudnative-pg/cloudnative-pg#10020)) - Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#10250](cloudnative-pg/cloudnative-pg#10250)) - Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#10375](cloudnative-pg/cloudnative-pg#10375)) - Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#9560](cloudnative-pg/cloudnative-pg#9560)) - Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971))  - The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720))  - Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968))  - Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#9353](cloudnative-pg/cloudnative-pg#9353)) - Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#9351](cloudnative-pg/cloudnative-pg#9351)) - Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#9364](cloudnative-pg/cloudnative-pg#9364)) ##### Security and Supply Chain - **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054),  [#10062](cloudnative-pg/cloudnative-pg#10062))  - **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048),  [#10074](cloudnative-pg/cloudnative-pg#10074))  - **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950))  ##### Changes - Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090))  ##### Fixes - Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342))  - Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302))  - Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192))  - Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977))  - Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952))  - Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978))  - Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981))  - Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268))  - Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973))  - When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193))  - Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035))  - Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311))  - Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285))  - Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849))  - `cnpg` plugin: - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174))  ##### Supported versions - Kubernetes 1.35, 1.34, and 1.33 - PostgreSQL 18, 17, 16, 15, and 14 - PostgreSQL 18.3 is the default image - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/) ### [`v1.28.2`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.2) [Compare Source](cloudnative-pg/cloudnative-pg@v1.28.1...v1.28.2) **Release date:** Mar 31, 2026 ##### Important changes - Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167))  ##### Enhancements - Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571))  - Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298))  - Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971))  - Extended the CRD schemas for `Cluster`, `ImageCatalog`, and `ClusterImageCatalog` to accept the `extensions`, `bin_path`, and `env` fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. ([#10131](cloudnative-pg/cloudnative-pg#10131), [#10387](cloudnative-pg/cloudnative-pg#10387))  - The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720))  - Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968))  ##### Security and Supply Chain - **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054),  [#10062](cloudnative-pg/cloudnative-pg#10062))  - **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048),  [#10074](cloudnative-pg/cloudnative-pg#10074))  - **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950))  ##### Changes - Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090))  ##### Fixes - Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342))  - Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302))  - Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192))  - Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977))  - Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952))  - Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978))  - Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981))  - Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268))  - Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973))  - When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193))  - Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035))  - Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311))  - Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285))  - Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849))  - `cnpg` plugin: - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174))  </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/5367 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

@bozkayasalihx

##### [\`v1.29.0\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0) **Release date:** Mar 31, 2026 ##### Important changes - Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167))  ##### Features - **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#9781](cloudnative-pg/cloudnative-pg#9781)) - **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#10148](cloudnative-pg/cloudnative-pg#10148)) - **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@bozkayasalihx](https://github.com/bozkayasalihx). ([#9287](cloudnative-pg/cloudnative-pg#9287)) ##### Enhancements - Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571))  - Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298))  - Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#10040](cloudnative-pg/cloudnative-pg#10040)) - Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@GabriFedi97](https://github.com/GabriFedi97). ([#10020](cloudnative-pg/cloudnative-pg#10020)) - Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#10250](cloudnative-pg/cloudnative-pg#10250)) - Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#10375](cloudnative-pg/cloudnative-pg#10375)) - Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#9560](cloudnative-pg/cloudnative-pg#9560)) - Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971))  - The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720))  - Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968))  - Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#9353](cloudnative-pg/cloudnative-pg#9353)) - Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#9351](cloudnative-pg/cloudnative-pg#9351)) - Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#9364](cloudnative-pg/cloudnative-pg#9364)) ##### Security and Supply Chain - **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054),  [#10062](cloudnative-pg/cloudnative-pg#10062))  - **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048),  [#10074](cloudnative-pg/cloudnative-pg#10074))  - **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950))  ##### Changes - Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090))  ##### Fixes - Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342))  - Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302))  - Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192))  - Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977))  - Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952))  - Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978))  - Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981))  - Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268))  - Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973))  - When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193))  - Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035))  - Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311))  - Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285))  - Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849))  - `cnpg` plugin: - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174))  ##### Supported versions - Kubernetes 1.35, 1.34, and 1.33 - PostgreSQL 18, 17, 16, 15, and 14 - PostgreSQL 18.3 is the default image - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/)

@bozkayasalihx

##### [\`v1.29.0\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0) **Release date:** Mar 31, 2026 ##### Important changes - Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167))  ##### Features - **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#9781](cloudnative-pg/cloudnative-pg#9781)) - **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#10148](cloudnative-pg/cloudnative-pg#10148)) - **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@bozkayasalihx](https://github.com/bozkayasalihx). ([#9287](cloudnative-pg/cloudnative-pg#9287)) ##### Enhancements - Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571))  - Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298))  - Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#10040](cloudnative-pg/cloudnative-pg#10040)) - Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@GabriFedi97](https://github.com/GabriFedi97). ([#10020](cloudnative-pg/cloudnative-pg#10020)) - Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#10250](cloudnative-pg/cloudnative-pg#10250)) - Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#10375](cloudnative-pg/cloudnative-pg#10375)) - Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#9560](cloudnative-pg/cloudnative-pg#9560)) - Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971))  - The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720))  - Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968))  - Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#9353](cloudnative-pg/cloudnative-pg#9353)) - Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#9351](cloudnative-pg/cloudnative-pg#9351)) - Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#9364](cloudnative-pg/cloudnative-pg#9364)) ##### Security and Supply Chain - **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054),  [#10062](cloudnative-pg/cloudnative-pg#10062))  - **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048),  [#10074](cloudnative-pg/cloudnative-pg#10074))  - **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950))  ##### Changes - Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090))  ##### Fixes - Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342))  - Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302))  - Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192))  - Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977))  - Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952))  - Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978))  - Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981))  - Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268))  - Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973))  - When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193))  - Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035))  - Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311))  - Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285))  - Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849))  - `cnpg` plugin: - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174))  ##### Supported versions - Kubernetes 1.35, 1.34, and 1.33 - PostgreSQL 18, 17, 16, 15, and 14 - PostgreSQL 18.3 is the default image - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/)

armru requested review from NiccoloFei, jsilvela and litaocdl as code owners March 5, 2026 12:36

armru requested a review from a team March 5, 2026 12:36

dosubot Bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Mar 5, 2026

cnpg-bot added backport-requested ◀️ This pull request should be backported to all supported releases release-1.25 release-1.28 labels Mar 5, 2026

dosubot Bot added the enhancement 🪄 New feature or request label Mar 5, 2026

armru added do not backport This PR must not be backported - it will be in the next minor release and removed backport-requested ◀️ This pull request should be backported to all supported releases release-1.25 release-1.28 labels Mar 5, 2026

cnpg-bot added the ok to merge 👌 This PR can be merged label Mar 5, 2026

leonardoce approved these changes Mar 6, 2026

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Mar 6, 2026

gbartolini changed the title ~~feat: add podSelectorRefs for dynamic pg_hba address resolution~~ feat: add podSelectorRefs for dynamic pg_hba address resolution Mar 6, 2026

gbartolini force-pushed the dev/10087 branch from 41b9eab to dd4f8d0 Compare March 6, 2026 09:41

mnencia self-assigned this Mar 6, 2026

mnencia requested review from gbartolini and mnencia March 6, 2026 09:48

mnencia force-pushed the dev/10087 branch 2 times, most recently from b091b17 to 1589982 Compare March 9, 2026 15:36

mnencia force-pushed the dev/10087 branch from 027fe8a to 0423611 Compare March 9, 2026 20:34

armru and others added 11 commits March 9, 2026 21:35

docs: fix apidoc issues

905b60f

Signed-off-by: Gabriele Bartolini <[email protected]>

docs: review

16853d3

Signed-off-by: Gabriele Bartolini <[email protected]>

docs: updated operator capability levels

d5b3cff

Signed-off-by: Gabriele Bartolini <[email protected]>

fix: linter

2550f4a

Signed-off-by: Gabriele Bartolini <[email protected]>

docs: align pattern with CRD validation for podSelectorRef names

599f65a

Signed-off-by: Marco Nenciarini <[email protected]>

fix: use status instead of spec in GetPodSelectorIPs

65ceff9

Signed-off-by: Marco Nenciarini <[email protected]>

review: improve podSelectorRefs validation and docs

4d7059a

Add list-type markers to status field for consistent SSA behavior, detect duplicate selector names in the webhook, fix documentation inaccuracies and clarify code comments. Signed-off-by: Marco Nenciarini <[email protected]>

docs: regenerate API documentation

75e0b96

Signed-off-by: Marco Nenciarini <[email protected]>

refactor: use net.IPNet for CIDR formatting in HBA expansion

50c5779

Replace ensureCIDR with hostCIDR using net.IPNet for proper CIDR formatting and IPv6 address normalization. Signed-off-by: Marco Nenciarini <[email protected]>

mnencia force-pushed the dev/10087 branch from 0423611 to 50c5779 Compare March 9, 2026 20:36

test: add matchExpressions coverage for podSelectorRefs mapper

8a17084

Signed-off-by: Marco Nenciarini <[email protected]>

mnencia approved these changes Mar 9, 2026

View reviewed changes

mnencia mentioned this pull request Mar 10, 2026

[Feature]: Dynamic pg_hba entries via spec.podSelectorRefs #10087

Closed

2 tasks done

mnencia merged commit 4c41964 into main Mar 10, 2026
41 of 42 checks passed

mnencia deleted the dev/10087 branch March 10, 2026 08:09

github-actions Bot mentioned this pull request Apr 20, 2026

Update Helm release cloudnative-pg to v0.28.0 claytono/infra#2047

Merged

1 task

Navigation Menu

Repository navigation

feat: add `podSelectorRefs` for dynamic `pg_hba` address resolution - #10148

feat: add `podSelectorRefs` for dynamic `pg_hba` address resolution#10148
mnencia merged 13 commits into
mainfrom
dev/10087

armru commented Mar 5, 2026 •

edited by mnencia

Loading

Uh oh!

armru commented Mar 5, 2026

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

sxd commented Mar 5, 2026

Uh oh!

gbartolini commented Mar 6, 2026

Uh oh!

gbartolini commented Mar 6, 2026

Uh oh!

gbartolini commented Mar 6, 2026

Uh oh!

gbartolini commented Mar 6, 2026 •

edited

Loading

Uh oh!

mnencia commented Mar 9, 2026

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

mnencia commented Mar 9, 2026

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

armru commented Mar 5, 2026 • edited by mnencia Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

armru commented Mar 5, 2026

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

sxd commented Mar 5, 2026

Uh oh!

gbartolini commented Mar 6, 2026

Uh oh!

gbartolini commented Mar 6, 2026

Uh oh!

gbartolini commented Mar 6, 2026

Uh oh!

gbartolini commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mnencia commented Mar 9, 2026

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

mnencia commented Mar 9, 2026

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

armru commented Mar 5, 2026 •

edited by mnencia

Loading

gbartolini commented Mar 6, 2026 •

edited

Loading