fix(walrestore): prevent replicas from downloading future timeline history files - #9650

…story files (#9650)

Replicas can crash-loop when orphaned "future timeline" .history files
exist in the WAL archive. This can occur during split-brain scenarios
or other conditions where timeline history files are created for
timelines
that the cluster never officially adopts.

This fix adds validation during WAL restore to prevent replicas from
downloading timeline history files with timeline IDs greater than the
cluster's current timeline. Primary instances retain full access.

The validation works by:
- Parsing timeline ID from .history filenames (e.g., 00000022.history)
- Checking if the instance is a primary or replica
- For replicas, rejecting files where fileTimeline > clusterTimeline
- Returning "file not found" to PostgreSQL for rejected files

This prevents PostgreSQL from ever seeing the problematic history file,
allowing normal recovery to proceed. Combined with PR #9637
(auto-recovery
via re-cloning), this provides complete coverage of timeline divergence
scenarios.

Closes #4188

Signed-off-by: Marco Nenciarini <[email protected]>
Signed-off-by: Armando Ruocco <[email protected]>
Co-authored-by: Armando Ruocco <[email protected]>
(cherry picked from commit ef73994)

Move timeline history file validation to execute before any WAL restore
attempt (plugin or in-tree) rather than only for in-tree restores. This
prevents replicas from downloading timeline history files with timeline
IDs higher than the cluster's current timeline when plugins handle WAL
restore.

The timeline protection added in #9650 was only applied to in-tree WAL
restore, but not to plugin-based restore. This allowed the protection to
be completely bypassed when using plugins, causing replicas to download
future timeline history files and fail with timeline mismatch errors.

Fixes the timeline protection introduced in ef73994.

Signed-off-by: Marco Nenciarini <[email protected]>

…9849)

Move timeline history file validation to execute before any WAL restore
attempt (plugin or in-tree) rather than only for in-tree restores. This
prevents replicas from downloading timeline history files with timeline
IDs higher than the cluster's current timeline when plugins handle WAL
restore.

The timeline protection added in #9650 was only applied to in-tree WAL
restore, but not to plugin-based restore. This allowed the protection to
be completely bypassed when using plugins, causing replicas to download
future timeline history files and fail with timeline mismatch errors.

Fixes the timeline protection introduced in ef73994.

Signed-off-by: Marco Nenciarini <[email protected]>
Signed-off-by: Leonardo Cecchi <[email protected]>
Co-authored-by: Leonardo Cecchi <[email protected]>

…9849)

Move timeline history file validation to execute before any WAL restore
attempt (plugin or in-tree) rather than only for in-tree restores. This
prevents replicas from downloading timeline history files with timeline
IDs higher than the cluster's current timeline when plugins handle WAL
restore.

The timeline protection added in #9650 was only applied to in-tree WAL
restore, but not to plugin-based restore. This allowed the protection to
be completely bypassed when using plugins, causing replicas to download
future timeline history files and fail with timeline mismatch errors.

Fixes the timeline protection introduced in ef73994.

Signed-off-by: Marco Nenciarini <[email protected]>
Signed-off-by: Leonardo Cecchi <[email protected]>
Co-authored-by: Leonardo Cecchi <[email protected]>
(cherry picked from commit 1044c8e)

…9849)

Move timeline history file validation to execute before any WAL restore
attempt (plugin or in-tree) rather than only for in-tree restores. This
prevents replicas from downloading timeline history files with timeline
IDs higher than the cluster's current timeline when plugins handle WAL
restore.

The timeline protection added in #9650 was only applied to in-tree WAL
restore, but not to plugin-based restore. This allowed the protection to
be completely bypassed when using plugins, causing replicas to download
future timeline history files and fail with timeline mismatch errors.

Fixes the timeline protection introduced in ef73994.

Signed-off-by: Marco Nenciarini <[email protected]>
Signed-off-by: Leonardo Cecchi <[email protected]>
Co-authored-by: Leonardo Cecchi <[email protected]>
(cherry picked from commit 1044c8e)
(cherry picked from commit d0e801ee5392465d8629056c79e58c32b215dcff)

…9849)

Move timeline history file validation to execute before any WAL restore
attempt (plugin or in-tree) rather than only for in-tree restores. This
prevents replicas from downloading timeline history files with timeline
IDs higher than the cluster's current timeline when plugins handle WAL
restore.

The timeline protection added in #9650 was only applied to in-tree WAL
restore, but not to plugin-based restore. This allowed the protection to
be completely bypassed when using plugins, causing replicas to download
future timeline history files and fail with timeline mismatch errors.

Fixes the timeline protection introduced in ef73994.

Signed-off-by: Marco Nenciarini <[email protected]>
Signed-off-by: Leonardo Cecchi <[email protected]>
Co-authored-by: Leonardo Cecchi <[email protected]>
(cherry picked from commit 1044c8e)
(cherry picked from commit d0e801ee5392465d8629056c79e58c32b215dcff)
(cherry picked from commit 9e2e469dd6f9f7880448cb27a7f6d7a294e9a9fb)

##### [\`v1.28.1\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.1)

**Release date:** Feb 5, 2026

##### Enhancements

- Added support for Azure's `DefaultAzureCredential` authentication mechanism for backup and recovery operations. This can be enabled by setting `azureCredentials.useDefaultAzureCredentials: true` in the backup configuration, simplifying authentication in Azure environments without requiring explicit storage account keys or SAS tokens. ([#9468](cloudnative-pg/cloudnative-pg#9468)) <!-- 1.27 1.25 -->

##### Fixes

- Fixed validation of PostgreSQL extension names containing underscores (e.g., `pg_partman`, `pg_ivm`). Extension names with underscores are automatically sanitized to use hyphens for Kubernetes volume names while preserving the original name in mount paths. Webhook validation prevents naming conflicts after sanitization. Contributed by [@shusaan](https://github.com/shusaan). ([#9386](cloudnative-pg/cloudnative-pg#9386)) <!-- 1.27 -->

- Fixed a critical issue where the `TimelineID` in the cluster status was not reset to 1 after a major version upgrade. Because `pg_upgrade` initializes a new timeline, keeping the old ID (e.g., timeline 2) caused replicas to attempt to restore incompatible history files from object storage, leading to fatal "requested timeline is not a child of this server's history" errors. ([#9830](cloudnative-pg/cloudnative-pg#9830)) <!-- 1.27 -->

- Fixed an issue where stale TLS status fields in the `Pooler` were not cleared after being removed from the specification. This was particularly critical when upgrading to v1.28.0, where the `ServerTLS` field was repurposed, causing PgBouncer to use incorrect certificates and resulting in "unsupported certificate" errors that blocked all application connectivity. The operator now explicitly clears `ServerCA`, `ClientCA`, `ClientTLS`, and `ServerTLS` status fields when they are no longer configured. ([#9397](cloudnative-pg/cloudnative-pg#9397))

- Fixed a bug where replicas could enter a crash-loop by attempting to download timeline history files from future timelines. This occurred when stale files remained in the WAL archive from a previous cluster life, and replicas would incorrectly try to fetch them during recovery. ([#9650](cloudnative-pg/cloudnative-pg#9650)) <!-- 1.27 1.25 -->

- Fixed a race condition in `replica_cluster` setups during designated primary transitions, preventing transient "no primary" states in the replica cluster. ([#9601](cloudnative-pg/cloudnative-pg#9601)) <!-- 1.27 1.25 -->

- The backup controller now uses the unique instance session ID to detect instance manager restarts. This prevents the operator from incorrectly assuming a backup is still progressing if the underlying container has crashed and restarted, which previously led to orphaned backup objects. ([#9370](cloudnative-pg/cloudnative-pg#9370)) <!-- 1.27 -->

- Fixed a validation gap in Azure object store configurations where the `storageAccount` was not required when using explicit credentials (such as a storage key or SAS token). The operator now enforces that a storage account name is provided in these cases and that `connectionString` is mutually exclusive with other authentication parameters. ([#9604](cloudnative-pg/cloudnative-pg#9604)) <!-- 1.27 1.25 -->

- Optimized the deletion path so the operator begins cleaning up resources immediately when a cluster is marked for deletion. This significantly reduces the time a cluster remains in `Terminating` status while waiting for internal reconciliation loops. ([#9555](cloudnative-pg/cloudnative-pg#9555)) <!-- 1.27 1.25 -->

- Fixed an issue where replication slots were not properly dropped from replicas when the feature was disabled or the cluster was reconfigured. This ensures that unused slots do not cause WAL build-up on the primary. ([#9381](cloudnative-pg/cloudnative-pg#9381)) <!-- 1.27 1.25 -->

- Fixed an issue where `imagePullSecrets` were not added to the `ServiceAccount` created for the `Pooler`. Previously, these secrets were applied to the Deployment but not the SA, which caused image pull failures in restricted environments using certain security policies. ([#9427](cloudnative-pg/cloudnative-pg#9427)) <!-- 1.27 1.25 -->

- Added a check to verify ownership before the operator deletes a `PodMonitor`. This prevents the operator from accidentally deleting manually managed monitoring resources that happen to share a name with expected CNPG resources. Contributed by [@juliamertz](https://github.com/juliamertz). ([#9340](cloudnative-pg/cloudnative-pg#9340)) <!-- 1.27 1.25 -->

- Fixed a bug where `pg_stat_archiver` metrics would continue to report stale data on standby instances after a switchover. The exporter now skips these metrics on standbys, as PostgreSQL only provides valid archiver stats on the primary. ([#9411](cloudnative-pg/cloudnative-pg#9411)) <!-- 1.27 1.25 -->

- Clarified the interpretation of timestamp formats for recovery `targetTime`. Timestamps provided without an explicit timezone are now consistently interpreted as UTC. Contributed by [@pchovelon](https://github.com/pchovelon). ([#8937](cloudnative-pg/cloudnative-pg#8937)) <!-- 1.27 1.25 -->

- Fixed backup status updates to prevent "resource has been modified" errors during concurrent updates. ([#9551](cloudnative-pg/cloudnative-pg#9551)) <!-- 1.27 1.25 -->

- Fixed event reporting to use the correct pod name when a backup pod is not found. ([#9552](cloudnative-pg/cloudnative-pg#9552)) <!-- 1.27 1.25 -->

- Improved performance of scheduled backup operations for clusters with a very high number of historical backups. ([#9489](cloudnative-pg/cloudnative-pg#9489)) <!-- 1.27 1.25 -->

- Fixed error handling when removing finalizers on `Database` objects. ([#9431](cloudnative-pg/cloudnative-pg#9431)) <!-- 1.27 1.25 -->

- `cnpg` plugin:

  - Updated the `status` command to display "Disabled" when the `skipWalArchiving` annotation is present on a cluster. This replaces confusing "starting up" or "unknown" states when WAL archiving is intentionally bypassed. ([#9709](cloudnative-pg/cloudnative-pg#9709)) <!-- 1.27 1.25 -->

  - Fixed the `logs --follow` command to continue polling for new pods instead of exiting prematurely when all current log streams complete. ([#9599](cloudnative-pg/cloudnative-pg#9599)) <!-- 1.27 1.25 -->

##### [\`v1.28.1\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.1)

**Release date:** Feb 5, 2026

##### Enhancements

- Added support for Azure's `DefaultAzureCredential` authentication mechanism for backup and recovery operations. This can be enabled by setting `azureCredentials.useDefaultAzureCredentials: true` in the backup configuration, simplifying authentication in Azure environments without requiring explicit storage account keys or SAS tokens. ([#9468](cloudnative-pg/cloudnative-pg#9468)) <!-- 1.27 1.25 -->

##### Fixes

- Fixed validation of PostgreSQL extension names containing underscores (e.g., `pg_partman`, `pg_ivm`). Extension names with underscores are automatically sanitized to use hyphens for Kubernetes volume names while preserving the original name in mount paths. Webhook validation prevents naming conflicts after sanitization. Contributed by [@shusaan](https://github.com/shusaan). ([#9386](cloudnative-pg/cloudnative-pg#9386)) <!-- 1.27 -->

- Fixed a critical issue where the `TimelineID` in the cluster status was not reset to 1 after a major version upgrade. Because `pg_upgrade` initializes a new timeline, keeping the old ID (e.g., timeline 2) caused replicas to attempt to restore incompatible history files from object storage, leading to fatal "requested timeline is not a child of this server's history" errors. ([#9830](cloudnative-pg/cloudnative-pg#9830)) <!-- 1.27 -->

- Fixed an issue where stale TLS status fields in the `Pooler` were not cleared after being removed from the specification. This was particularly critical when upgrading to v1.28.0, where the `ServerTLS` field was repurposed, causing PgBouncer to use incorrect certificates and resulting in "unsupported certificate" errors that blocked all application connectivity. The operator now explicitly clears `ServerCA`, `ClientCA`, `ClientTLS`, and `ServerTLS` status fields when they are no longer configured. ([#9397](cloudnative-pg/cloudnative-pg#9397))

- Fixed a bug where replicas could enter a crash-loop by attempting to download timeline history files from future timelines. This occurred when stale files remained in the WAL archive from a previous cluster life, and replicas would incorrectly try to fetch them during recovery. ([#9650](cloudnative-pg/cloudnative-pg#9650)) <!-- 1.27 1.25 -->

- Fixed a race condition in `replica_cluster` setups during designated primary transitions, preventing transient "no primary" states in the replica cluster. ([#9601](cloudnative-pg/cloudnative-pg#9601)) <!-- 1.27 1.25 -->

- The backup controller now uses the unique instance session ID to detect instance manager restarts. This prevents the operator from incorrectly assuming a backup is still progressing if the underlying container has crashed and restarted, which previously led to orphaned backup objects. ([#9370](cloudnative-pg/cloudnative-pg#9370)) <!-- 1.27 -->

- Fixed a validation gap in Azure object store configurations where the `storageAccount` was not required when using explicit credentials (such as a storage key or SAS token). The operator now enforces that a storage account name is provided in these cases and that `connectionString` is mutually exclusive with other authentication parameters. ([#9604](cloudnative-pg/cloudnative-pg#9604)) <!-- 1.27 1.25 -->

- Optimized the deletion path so the operator begins cleaning up resources immediately when a cluster is marked for deletion. This significantly reduces the time a cluster remains in `Terminating` status while waiting for internal reconciliation loops. ([#9555](cloudnative-pg/cloudnative-pg#9555)) <!-- 1.27 1.25 -->

- Fixed an issue where replication slots were not properly dropped from replicas when the feature was disabled or the cluster was reconfigured. This ensures that unused slots do not cause WAL build-up on the primary. ([#9381](cloudnative-pg/cloudnative-pg#9381)) <!-- 1.27 1.25 -->

- Fixed an issue where `imagePullSecrets` were not added to the `ServiceAccount` created for the `Pooler`. Previously, these secrets were applied to the Deployment but not the SA, which caused image pull failures in restricted environments using certain security policies. ([#9427](cloudnative-pg/cloudnative-pg#9427)) <!-- 1.27 1.25 -->

- Added a check to verify ownership before the operator deletes a `PodMonitor`. This prevents the operator from accidentally deleting manually managed monitoring resources that happen to share a name with expected CNPG resources. Contributed by [@juliamertz](https://github.com/juliamertz). ([#9340](cloudnative-pg/cloudnative-pg#9340)) <!-- 1.27 1.25 -->

- Fixed a bug where `pg_stat_archiver` metrics would continue to report stale data on standby instances after a switchover. The exporter now skips these metrics on standbys, as PostgreSQL only provides valid archiver stats on the primary. ([#9411](cloudnative-pg/cloudnative-pg#9411)) <!-- 1.27 1.25 -->

- Clarified the interpretation of timestamp formats for recovery `targetTime`. Timestamps provided without an explicit timezone are now consistently interpreted as UTC. Contributed by [@pchovelon](https://github.com/pchovelon). ([#8937](cloudnative-pg/cloudnative-pg#8937)) <!-- 1.27 1.25 -->

- Fixed backup status updates to prevent "resource has been modified" errors during concurrent updates. ([#9551](cloudnative-pg/cloudnative-pg#9551)) <!-- 1.27 1.25 -->

- Fixed event reporting to use the correct pod name when a backup pod is not found. ([#9552](cloudnative-pg/cloudnative-pg#9552)) <!-- 1.27 1.25 -->

- Improved performance of scheduled backup operations for clusters with a very high number of historical backups. ([#9489](cloudnative-pg/cloudnative-pg#9489)) <!-- 1.27 1.25 -->

- Fixed error handling when removing finalizers on `Database` objects. ([#9431](cloudnative-pg/cloudnative-pg#9431)) <!-- 1.27 1.25 -->

- `cnpg` plugin:

  - Updated the `status` command to display "Disabled" when the `skipWalArchiving` annotation is present on a cluster. This replaces confusing "starting up" or "unknown" states when WAL archiving is intentionally bypassed. ([#9709](cloudnative-pg/cloudnative-pg#9709)) <!-- 1.27 1.25 -->

  - Fixed the `logs --follow` command to continue polling for new pods instead of exiting prematurely when all current log streams complete. ([#9599](cloudnative-pg/cloudnative-pg#9599)) <!-- 1.27 1.25 -->

##### [\`v1.28.2\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.2)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167)) <!-- 1.28 1.27 -->

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298)) <!-- 1.28 1.27 -->

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971)) <!-- 1.28 1.27 1.25 -->

- Extended the CRD schemas for `Cluster`, `ImageCatalog`, and `ClusterImageCatalog` to accept the `extensions`, `bin_path`, and `env` fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. ([#10131](cloudnative-pg/cloudnative-pg#10131), [#10387](cloudnative-pg/cloudnative-pg#10387)) <!-- 1.28 1.27 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968)) <!-- 1.28 -->

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054), <!-- 1.28 1.27 1.25 --> [#10062](cloudnative-pg/cloudnative-pg#10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048), <!-- 1.28 1.27 1.25 --> [#10074](cloudnative-pg/cloudnative-pg#10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174)) <!-- 1.28 1.27 1.25 -->

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cloudnative-pg](https://cloudnative-pg.io) ([source](https://github.com/cloudnative-pg/charts)) | minor | `0.27.1` → `0.28.0` |
| [cloudnative-pg/cloudnative-pg](https://github.com/cloudnative-pg/cloudnative-pg) | minor | `1.28.1` → `1.29.0` |

---

### Release Notes

<details>
<summary>cloudnative-pg/charts (cloudnative-pg)</summary>

### [`v0.28.0`](https://github.com/cloudnative-pg/charts/releases/tag/cloudnative-pg-v0.28.0)

[Compare Source](cloudnative-pg/charts@cloudnative-pg-v0.27.1...cloudnative-pg-v0.28.0)

CloudNativePG Operator Helm Chart

#### What's Changed

- fix(security): harden GitHub Actions workflows against expression injection by [@&#8203;mnencia](https://github.com/mnencia) in [#&#8203;823](cloudnative-pg/charts#823)
- feat(monitoring): add support for custom PodMonitor by [@&#8203;Dashing-Nelson](https://github.com/Dashing-Nelson) in [#&#8203;724](cloudnative-pg/charts#724)
- Release cloudnative-pg-v0.28.0 by [@&#8203;cnpg-bot](https://github.com/cnpg-bot) in [#&#8203;845](cloudnative-pg/charts#845)

#### New Contributors

- [@&#8203;Dashing-Nelson](https://github.com/Dashing-Nelson) made their first contribution in [#&#8203;724](cloudnative-pg/charts#724)

**Full Changelog**: <cloudnative-pg/charts@cluster-v0.6.0...cloudnative-pg-v0.28.0>

</details>

<details>
<summary>cloudnative-pg/cloudnative-pg (cloudnative-pg/cloudnative-pg)</summary>

### [`v1.29.0`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0)

[Compare Source](cloudnative-pg/cloudnative-pg@v1.28.2...v1.29.0-rc1)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#&#8203;10167](cloudnative-pg/cloudnative-pg#10167)) <!-- 1.28 1.27 -->

##### Features

- **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#&#8203;9781](cloudnative-pg/cloudnative-pg#9781))

- **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#&#8203;10148](cloudnative-pg/cloudnative-pg#10148))

- **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@&#8203;bozkayasalihx](https://github.com/bozkayasalihx). ([#&#8203;9287](cloudnative-pg/cloudnative-pg#9287))

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@&#8203;alex1989hu](https://github.com/alex1989hu). ([#&#8203;9571](cloudnative-pg/cloudnative-pg#9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#&#8203;10104](cloudnative-pg/cloudnative-pg#10104), [#&#8203;10298](cloudnative-pg/cloudnative-pg#10298)) <!-- 1.28 1.27 -->

- Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#&#8203;10040](cloudnative-pg/cloudnative-pg#10040))

- Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@&#8203;GabriFedi97](https://github.com/GabriFedi97). ([#&#8203;10020](cloudnative-pg/cloudnative-pg#10020))

- Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#&#8203;10250](cloudnative-pg/cloudnative-pg#10250))

- Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#&#8203;10375](cloudnative-pg/cloudnative-pg#10375))

- Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#&#8203;9560](cloudnative-pg/cloudnative-pg#9560))

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#&#8203;9971](cloudnative-pg/cloudnative-pg#9971)) <!-- 1.28 1.27 1.25 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#&#8203;9720](cloudnative-pg/cloudnative-pg#9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#&#8203;9968](cloudnative-pg/cloudnative-pg#9968)) <!-- 1.28 -->

- Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#&#8203;9353](cloudnative-pg/cloudnative-pg#9353))

- Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#&#8203;9351](cloudnative-pg/cloudnative-pg#9351))

- Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#&#8203;9364](cloudnative-pg/cloudnative-pg#9364))

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#&#8203;10054](cloudnative-pg/cloudnative-pg#10054), <!-- 1.28 1.27 1.25 --> [#&#8203;10062](cloudnative-pg/cloudnative-pg#10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#&#8203;10048](cloudnative-pg/cloudnative-pg#10048), <!-- 1.28 1.27 1.25 --> [#&#8203;10074](cloudnative-pg/cloudnative-pg#10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#&#8203;9950](cloudnative-pg/cloudnative-pg#9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#&#8203;10090](cloudnative-pg/cloudnative-pg#10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#&#8203;10342](cloudnative-pg/cloudnative-pg#10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#&#8203;10302](cloudnative-pg/cloudnative-pg#10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#&#8203;10192](cloudnative-pg/cloudnative-pg#10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@&#8203;ermakov-oleg](https://github.com/ermakov-oleg). ([#&#8203;9977](cloudnative-pg/cloudnative-pg#9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#&#8203;9952](cloudnative-pg/cloudnative-pg#9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@&#8203;sharifmshaker](https://github.com/sharifmshaker). ([#&#8203;9978](cloudnative-pg/cloudnative-pg#9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@&#8203;jmealo](https://github.com/jmealo). ([#&#8203;9981](cloudnative-pg/cloudnative-pg#9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#&#8203;10268](cloudnative-pg/cloudnative-pg#10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#&#8203;9973](cloudnative-pg/cloudnative-pg#9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#&#8203;10193](cloudnative-pg/cloudnative-pg#10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#&#8203;10035](cloudnative-pg/cloudnative-pg#10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#&#8203;10190](cloudnative-pg/cloudnative-pg#10190), [#&#8203;10311](cloudnative-pg/cloudnative-pg#10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#&#8203;10285](cloudnative-pg/cloudnative-pg#10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#&#8203;9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#&#8203;9849](cloudnative-pg/cloudnative-pg#9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#&#8203;10174](cloudnative-pg/cloudnative-pg#10174)) <!-- 1.28 1.27 1.25 -->

##### Supported versions

- Kubernetes 1.35, 1.34, and 1.33
- PostgreSQL 18, 17, 16, 15, and 14
  - PostgreSQL 18.3 is the default image
  - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/)

### [`v1.28.2`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.2)

[Compare Source](cloudnative-pg/cloudnative-pg@v1.28.1...v1.28.2)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#&#8203;10167](cloudnative-pg/cloudnative-pg#10167)) <!-- 1.28 1.27 -->

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@&#8203;alex1989hu](https://github.com/alex1989hu). ([#&#8203;9571](cloudnative-pg/cloudnative-pg#9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#&#8203;10104](cloudnative-pg/cloudnative-pg#10104), [#&#8203;10298](cloudnative-pg/cloudnative-pg#10298)) <!-- 1.28 1.27 -->

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#&#8203;9971](cloudnative-pg/cloudnative-pg#9971)) <!-- 1.28 1.27 1.25 -->

- Extended the CRD schemas for `Cluster`, `ImageCatalog`, and `ClusterImageCatalog` to accept the `extensions`, `bin_path`, and `env` fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. ([#&#8203;10131](cloudnative-pg/cloudnative-pg#10131), [#&#8203;10387](cloudnative-pg/cloudnative-pg#10387)) <!-- 1.28 1.27 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#&#8203;9720](cloudnative-pg/cloudnative-pg#9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#&#8203;9968](cloudnative-pg/cloudnative-pg#9968)) <!-- 1.28 -->

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#&#8203;10054](cloudnative-pg/cloudnative-pg#10054), <!-- 1.28 1.27 1.25 --> [#&#8203;10062](cloudnative-pg/cloudnative-pg#10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#&#8203;10048](cloudnative-pg/cloudnative-pg#10048), <!-- 1.28 1.27 1.25 --> [#&#8203;10074](cloudnative-pg/cloudnative-pg#10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#&#8203;9950](cloudnative-pg/cloudnative-pg#9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#&#8203;10090](cloudnative-pg/cloudnative-pg#10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#&#8203;10342](cloudnative-pg/cloudnative-pg#10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#&#8203;10302](cloudnative-pg/cloudnative-pg#10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#&#8203;10192](cloudnative-pg/cloudnative-pg#10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@&#8203;ermakov-oleg](https://github.com/ermakov-oleg). ([#&#8203;9977](cloudnative-pg/cloudnative-pg#9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#&#8203;9952](cloudnative-pg/cloudnative-pg#9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@&#8203;sharifmshaker](https://github.com/sharifmshaker). ([#&#8203;9978](cloudnative-pg/cloudnative-pg#9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@&#8203;jmealo](https://github.com/jmealo). ([#&#8203;9981](cloudnative-pg/cloudnative-pg#9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#&#8203;10268](cloudnative-pg/cloudnative-pg#10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#&#8203;9973](cloudnative-pg/cloudnative-pg#9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#&#8203;10193](cloudnative-pg/cloudnative-pg#10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#&#8203;10035](cloudnative-pg/cloudnative-pg#10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#&#8203;10190](cloudnative-pg/cloudnative-pg#10190), [#&#8203;10311](cloudnative-pg/cloudnative-pg#10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#&#8203;10285](cloudnative-pg/cloudnative-pg#10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#&#8203;9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#&#8203;9849](cloudnative-pg/cloudnative-pg#9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#&#8203;10174](cloudnative-pg/cloudnative-pg#10174)) <!-- 1.28 1.27 1.25 -->

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuNCIsInVwZGF0ZWRJblZlciI6IjQzLjEwMi42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJoZWxtIl19-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/5367
Co-authored-by: Renovate Bot <[email protected]>
Co-committed-by: Renovate Bot <[email protected]>

##### [\`v1.28.2\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.2)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167)) <!-- 1.28 1.27 -->

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298)) <!-- 1.28 1.27 -->

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971)) <!-- 1.28 1.27 1.25 -->

- Extended the CRD schemas for `Cluster`, `ImageCatalog`, and `ClusterImageCatalog` to accept the `extensions`, `bin_path`, and `env` fields introduced in 1.29. The operator ignores these fields on older versions, but accepting them in the schema allows users to share a single manifest across clusters running different CNPG versions. ([#10131](cloudnative-pg/cloudnative-pg#10131), [#10387](cloudnative-pg/cloudnative-pg#10387)) <!-- 1.28 1.27 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968)) <!-- 1.28 -->

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054), <!-- 1.28 1.27 1.25 --> [#10062](cloudnative-pg/cloudnative-pg#10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048), <!-- 1.28 1.27 1.25 --> [#10074](cloudnative-pg/cloudnative-pg#10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174)) <!-- 1.28 1.27 1.25 -->

##### [\`v1.29.0\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167)) <!-- 1.28 1.27 -->

##### Features

- **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#9781](cloudnative-pg/cloudnative-pg#9781))

- **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#10148](cloudnative-pg/cloudnative-pg#10148))

- **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@bozkayasalihx](https://github.com/bozkayasalihx). ([#9287](cloudnative-pg/cloudnative-pg#9287))

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298)) <!-- 1.28 1.27 -->

- Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#10040](cloudnative-pg/cloudnative-pg#10040))

- Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@GabriFedi97](https://github.com/GabriFedi97). ([#10020](cloudnative-pg/cloudnative-pg#10020))

- Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#10250](cloudnative-pg/cloudnative-pg#10250))

- Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#10375](cloudnative-pg/cloudnative-pg#10375))

- Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#9560](cloudnative-pg/cloudnative-pg#9560))

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971)) <!-- 1.28 1.27 1.25 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968)) <!-- 1.28 -->

- Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#9353](cloudnative-pg/cloudnative-pg#9353))

- Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#9351](cloudnative-pg/cloudnative-pg#9351))

- Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#9364](cloudnative-pg/cloudnative-pg#9364))

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054), <!-- 1.28 1.27 1.25 --> [#10062](cloudnative-pg/cloudnative-pg#10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048), <!-- 1.28 1.27 1.25 --> [#10074](cloudnative-pg/cloudnative-pg#10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174)) <!-- 1.28 1.27 1.25 -->

##### Supported versions

- Kubernetes 1.35, 1.34, and 1.33
- PostgreSQL 18, 17, 16, 15, and 14
  - PostgreSQL 18.3 is the default image
  - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/)

##### [\`v1.29.0\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.0)

**Release date:** Mar 31, 2026

##### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to reflect that it will now be removed in CloudNativePG 1.30.0, rather than 1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. ([#10167](cloudnative-pg/cloudnative-pg#10167)) <!-- 1.28 1.27 -->

##### Features

- **PostgreSQL extensions in image catalogs**: extended the `ImageCatalog` functionality to support PostgreSQL extensions. This allows users to define and manage extension-specific images within a catalog, simplifying the deployment of customized PostgreSQL builds. ([#9781](cloudnative-pg/cloudnative-pg#9781))

- **Dynamic network access control via pod selectors**: introduced the declarative definition of `podSelectorRefs` to manage `pg_hba.conf` rules dynamically. By using label selectors to identify client pods, the operator automatically resolves their ephemeral IP addresses and updates the PostgreSQL host-based authentication rules accordingly. This ensures that only authorized workloads in the same namespace can connect to the database, eliminating the need for manual IP management or static CIDR ranges. ([#10148](cloudnative-pg/cloudnative-pg#10148))

- **Shared `ServiceAccount` support**: added an optional `serviceAccountName` field to both `Cluster` and `Pooler` specifications. This allows multiple resources to share a pre-existing ServiceAccount, facilitating one-time IAM configurations (such as AWS IRSA, GCP Workload Identity, or Azure Workload Identity) across all clusters and poolers. Contributed by [@bozkayasalihx](https://github.com/bozkayasalihx). ([#9287](cloudnative-pg/cloudnative-pg#9287))

##### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS cipher suites and minimum/maximum TLS versions. This enables administrators to meet strict security compliance requirements for pooler-to-client and pooler-to-server connections. Contributed by [@alex1989hu](https://github.com/alex1989hu). ([#9571](cloudnative-pg/cloudnative-pg#9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The operator now automatically deletes the failed job when a user reverts the container image, allowing the cluster to restart gracefully on the original version. ([#10104](cloudnative-pg/cloudnative-pg#10104), [#10298](cloudnative-pg/cloudnative-pg#10298)) <!-- 1.28 1.27 -->

- Improved the operator's observability by emitting native Kubernetes events during key phases of the reconciliation loop, providing visibility into the operator's decision-making process and the lifecycle of managed resources directly through `kubectl get events`. ([#10040](cloudnative-pg/cloudnative-pg#10040))

- Extended support for the `cnpg.io/reconciliationDisabled` annotation on Backup resources. This allows administrators to temporarily freeze the operator's reconciliation logic for specific backup objects. Contributed by [@GabriFedi97](https://github.com/GabriFedi97). ([#10020](cloudnative-pg/cloudnative-pg#10020))

- Added a `bin_path` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows extensions to specify directory paths for external binaries, which are automatically appended to the `PATH` environment variable of the Postgres process. ([#10250](cloudnative-pg/cloudnative-pg#10250))

- Added an `env` field to the `postgresql.extensions` stanza, as well as in `ImageCatalog` and `ClusterImageCatalog` resources. This allows cluster administrators to define custom environment variables for the Postgres process. This field supports the `${image_root}` placeholder to dynamically resolve to the extension's absolute mount path. ([#10375](cloudnative-pg/cloudnative-pg#10375))

- Implemented a finalizer for plugins to ensure that resources managed by a plugin are gracefully cleaned up when the corresponding service is deleted. ([#9560](cloudnative-pg/cloudnative-pg#9560))

- Improved role management by verifying the instance is the primary before each reconciliation cycle, avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas. ([#9971](cloudnative-pg/cloudnative-pg#9971)) <!-- 1.28 1.27 1.25 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is respected during storage expansion or additions. ([#9720](cloudnative-pg/cloudnative-pg#9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to function even on pods that have not yet reached the `Ready` state, facilitating the recovery of stuck instances. ([#9968](cloudnative-pg/cloudnative-pg#9968)) <!-- 1.28 -->

- Introduced a "Terminal Error" phase for backups that encounter unrecoverable issues (such as invalid credentials or non-existent cloud buckets). This ensures the operator stops retrying doomed operations, preventing resource exhaustion and providing immediate, clear feedback in the status. ([#9353](cloudnative-pg/cloudnative-pg#9353))

- Improved monitoring of long-running backups by introducing `reconciliationStartedAt` and `reconciliationTerminatedAt` fields to the `Backup` status. This change separates the operator's internal lifecycle from the actual backup tool's execution timing (`startedAt`/`stoppedAt`), allowing users to track when the operator begins processing a request. ([#9351](cloudnative-pg/cloudnative-pg#9351))

- Added a `Pending` phase to the `Backup` status to explicitly indicate when a backup is queued and waiting for an available worker or instance availability. ([#9364](cloudnative-pg/cloudnative-pg#9364))

##### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align with industry-standard security reporting. ([#10054](cloudnative-pg/cloudnative-pg#10054), <!-- 1.28 1.27 1.25 --> [#10062](cloudnative-pg/cloudnative-pg#10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software Artifacts) provenance to release binaries and container images. Additionally, enabled Software Bill of Materials (SBOM) generation within the GoReleaser pipeline for improved dependency transparency. ([#10048](cloudnative-pg/cloudnative-pg#10048), <!-- 1.28 1.27 1.25 --> [#10074](cloudnative-pg/cloudnative-pg#10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL could leak role passwords in the logs during specific reconciliation phases. ([#9950](cloudnative-pg/cloudnative-pg#9950)) <!-- 1.28 1.27 1.25 -->

##### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`). ([#10090](cloudnative-pg/cloudnative-pg#10090)) <!-- 1.28 1.27 1.25 -->

##### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous replication, where pods running the old and new operator versions computed different PostgreSQL configuration hashes, causing the uniformity check to block indefinitely and preventing both rolling updates and in-place upgrades from proceeding. ([#10342](cloudnative-pg/cloudnative-pg#10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL disk was full, because the disk space check blocked the instance manager from starting. The check is now performed later in the lifecycle loop, after fencing is evaluated. ([#10302](cloudnative-pg/cloudnative-pg#10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the `VolumeSnapshot` used for the initial bootstrap had been deleted. The operator now validates snapshot existence before use; if a snapshot is missing, it attempts to use the next available candidate or falls back to `pg_basebackup`. ([#10192](cloudnative-pg/cloudnative-pg#10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all available rollout slots, which previously caused delays in scheduled updates. Contributed by [@ermakov-oleg](https://github.com/ermakov-oleg). ([#9977](cloudnative-pg/cloudnative-pg#9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being correctly applied to replica clusters. ([#9952](cloudnative-pg/cloudnative-pg#9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping subsequent plugins when a "continue" result was returned. Contributed by [@sharifmshaker](https://github.com/sharifmshaker). ([#9978](cloudnative-pg/cloudnative-pg#9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a filesystem on a PVC that was not currently attached to a Pod. Contributed by [@jmealo](https://github.com/jmealo). ([#9981](cloudnative-pg/cloudnative-pg#9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external clusters configured with `ConnectionParameters` (for `pg_basebackup`-based recovery). Previously, these were incorrectly rejected unless a Barman object store or CNPG-i plugin was also configured. ([#10268](cloudnative-pg/cloudnative-pg#10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming collisions with standard cluster volumes. ([#9973](cloudnative-pg/cloudnative-pg#9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a `WaitingForHealthy` condition, making the deferred hibernation state visible through `cnpg status`. ([#10193](cloudnative-pg/cloudnative-pg#10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist. Fencing operates on a cluster-level annotation and should not depend on pod existence; instance name validation is now performed only in the `cnpg fencing on` command. ([#10035](cloudnative-pg/cloudnative-pg#10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes to all spec fields when using the patch update strategy. The reconciler now uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields (such as `loadBalancerClass`) from being inadvertently removed. ([#10190](cloudnative-pg/cloudnative-pg#10190), [#10311](cloudnative-pg/cloudnative-pg#10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup implementation affecting parallel WAL restore, where prefetched files could be read while still being downloaded, causing PostgreSQL recovery to fail with "invalid checkpoint record" errors. ([#10285](cloudnative-pg/cloudnative-pg#10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL restore. Previously, the protection introduced in [#9650](cloudnative-pg/cloudnative-pg#9650) only covered in-tree restores, allowing plugins to bypass the check and download future timeline history files, causing timeline mismatch errors on replicas. ([#9849](cloudnative-pg/cloudnative-pg#9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

  - The cnpg plugin now correctly propagates ImagePullSecrets to the `pgbench` Job pod template. ([#10174](cloudnative-pg/cloudnative-pg#10174)) <!-- 1.28 1.27 1.25 -->

##### Supported versions

- Kubernetes 1.35, 1.34, and 1.33
- PostgreSQL 18, 17, 16, 15, and 14
  - PostgreSQL 18.3 is the default image
  - [PostgreSQL 14 support ends on November 12, 2026](https://www.postgresql.org/support/versioning/)