CloudNativePG Files

Release date: Sep 23, 2026

:::warning This is the final release in the 1.29.x series. Users are strongly encouraged to upgrade to a newer minor version, as 1.29 is no longer supported. :::

Enhancements

• Added restoreAdditionalCommandArgs to .barmanObjectStore.data for in-tree Barman Cloud recoveries, so custom flags are forwarded to barman-cloud-restore during recovery. (#11278)

• Plugin authors no longer need to re-derive whether an empty WAL archive should be treated as an error: the operator now computes the check_empty_wal_archive decision once and passes it to CNPG-I plugins on both WAL archiving and restore hooks. (#11216)

• Allowed setting the ssl_ecdh_curve PostgreSQL parameter in .spec.postgresql.parameters. It was previously rejected by the validating webhook even though the operator does not manage it. Contributed by @Jamstah. (#11308)

• Added support for setting auth_user in spec.pgbouncer.parameters to override the user PgBouncer uses for its auth_query connection, instead of always deriving it from the authQuerySecret. Useful with a custom authQuerySecret where the role to authenticate as differs from the one implied by the Secret. Contributed by @jonasbadstuebner. (#10899)

• Fixed PgBouncer metrics silently reporting zero when PgBouncer adds or reorders columns: SHOW STATS and SHOW POOLS results are now matched by column name instead of by position. Contributed by @AdzerKI (SHOW STATS). (#11366, #11464)

• cnpg plugin:

  • Added a --dry-run option to the backup command that prints the Backup resource that would be created, without creating it. (#11233)

Security and Supply Chain

• Fixed a webhook validation bypass where an absolute extension path with an embedded .. traversal (e.g. /a/../../../../etc) was accepted because only the raw path was checked; such paths still escaped the extension's mount point once resolved at runtime. Affected entries are now resolved and rejected/skipped consistently across admission, the major-upgrade job, and already-persisted Cluster specs. Contributed by @Anand-240. (#11210)

• Updated google.golang.org/grpc to v1.83.1, fixing CVE-2026-84304 / GHSA-vp52-pcj8-j9qc (gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation). (#11394)

Changes

• Updated the default PostgreSQL operand image to 18.6-system-trixie. (#11257)

• Moved the operator's own base image from Debian 12 (bookworm) to Debian 13 (trixie), now that Debian 12 has moved to LTS-only maintenance. (#11193)

Fixes

• Demoted an unreachable old primary immediately during failover, instead of waiting on checkpoint and fast-shutdown attempts that could never complete. Previously, an old primary whose PostgreSQL had become unresponsive was never shut down, so it could never rejoin the cluster as a replica of the new primary. The shutdown is now requested without blocking the reconciler, though demotion can still take up to a minute or more if PostgreSQL keeps ignoring shutdown signals. (#11347)

• Fixed failover and Pod recreation getting stuck while any instance in the cluster was fenced. A fenced instance kept reporting itself as healthy on its status endpoint even though its Pod was permanently not Ready, which blocked the readiness guard, the primary-election logic, and the Pod-reattachment gate from reacting to an unrelated failure elsewhere in the cluster, leaving it stalled until someone manually removed the fencing. All three now recognize and skip fenced instances. (#11274)

• Fixed a failover that could stall forever or get silently reverted. While a failover was pending, the reconciler could skip checking whether it was ready to complete, or mistake the pending state for a missing Pod and reset the target primary back to the unhealthy one. It now keeps progressing a pending failover and completes it once the WAL receivers are down, rechecking quorum safety right before promoting in case it changed while waiting. (#11336)

• Fixed the designated-primary sort in PostgresqlStatusList so a tie on LSN no longer sorts it out of order. If the designated primary's Pod later disappeared from the status list, this could have led the operator to promote the wrong standby. (#11494)

• Stopped abandoning a fast shutdown after 60 seconds. The request carried no explicit timeout, so pg_ctl fell back to its own implicit 60-second limit, and the instance manager, being PID 1 in the container, took PostgreSQL down mid-shutdown regardless of a larger configured stopDelay. The fast phase now waits for the full stopDelay instead. (#11263)

• Waited for certificate status before refreshing secrets during bootstrap. (#11450)

• Fixed in-tree Barman Cloud recovery ignoring wal.maxParallel and wal.restoreAdditionalCommandArgs, fetching WAL one segment at a time instead of using the configured parallelism. (#11105)

• Honored the unrecoverable annotation on pending and terminating instances. (#11241)

• Honored Backup.spec.online when finalizing VolumeSnapshot-based backups, so a cold backup is no longer reported as online in status. (#11276)

• Retried volume snapshot backups on transient instance-manager connection errors (e.g. a dial timeout from a brief pod-network disruption), instead of failing the backup outright. (#11069)

• Set --no-data-checksums explicitly when .spec.postgresql.dataChecksums is false on PostgreSQL 18+, which now enables checksums by default in initdb. Contributed by @evan314159. (#11488)

• Stopped discarding .spec.inheritedMetadata labels on PVC reconciliation; they were applied before, and then overwritten by, the operator's own labels. Contributed by @GellertBabel. (#11499)

• Stopped Pooler and DatabaseRole from recreating their owned resources after being marked for deletion, which could block an external finalizer (e.g. ArgoCD foreground deletion) waiting for those resources to disappear. Contributed by @mjlshen. (#11359)

• Handled a NULL stats_reset value in the pg_stat_wal metric, which could occasionally break Prometheus scraping on PostgreSQL 18 clusters. Contributed by @HoniSanders. (#11207)

• Recovered log streaming when a stale non-FIFO file blocked the log pipe. (#11246)

• Stopped sampling logs of the Pods' processes, so no log lines are silently dropped. (#11131)

• Stopped caching Helm release Secrets in the operator, which could spike memory usage and crashloop the operator on clusters with large Helm releases installed alongside it. (#11211)

• Re-ran owned-resource finalizer cleanup after an operator restart, so a namespace deleted while the operator was down doesn't hang in Terminating forever. (#11215)

• Fixed rejoining replicas taking a long time to complete pg_rewind when WAL prefetching (wal.maxParallel > 1) was enabled. (#11204)

• Treated a PostgreSQL instance rejecting connections as started up in probes. (#11152)

• Stopped issuing a redundant PATCH on every reconciliation when a cluster's pvcTemplate set volumeAttributesClass. Contributed by @andrew-farries. (#11196)

• Stopped halting replication slot reconciliation at the first failing slot. (#11119)

• During rollouts, compared the running configuration hash, rather than the on-disk one, avoiding unnecessary switchovers. (#11130)

• Retried VolumeSnapshot errors until the deadline, instead of giving up early. (#11132)

• Symlinked pg_wal to the WAL volume during plugin-based recovery, instead of replaying WAL onto the data volume, which could exhaust it on a large point-in-time recovery. (#11127)

• Corrected grammar in PhaseUpgradeDelayed status messages. Contributed by @Utkarsh-sharma47. (#11065)

• CloudNativePG Interface (CNPG-I):

  • Reported the Postgres capabilities of a plugin correctly. (#11447)
  • Prevented the plugin status field from flapping on Cluster reconciliation. Contributed by @sharifmshaker. (#11386)
  • Replaced a finalizer with in-memory cleanup on Service deletion. This avoids namespaces hanging in Terminating state when the operator and its plugins run in the same namespace. Contributed by @maxlengdell. (#10940)

• cnpg plugin:

  • Used UTC time zone for the default backup name. (#11329)
  • Deleted PVCs before Pods in cnpg destroy, avoiding a race that could leave dangling PVCs needing a second invocation to clean up. Contributed by @daanvinken. (#10847)