What cloudnative-pg/cloudnative-pg shipped

This week: online backups skip the separate WAL volume when the archive is complete, SSE-C customer keys work for backup and recovery, stale-lease step-downs now use a fast shutdown, and DatabaseRole certificates can set their own duration.

Changes this week include online volume snapshot backups that leave out the separate WAL volume when the archive is guaranteed to hold the needed WAL files, and SSE-C customer-provided keys for backup, WAL archiving and recovery. A primary stepping down on a stale lease now uses a fast shutdown so unstreamed WAL can reach the new primary, and the lease window starts at the pending marker to shorten failovers. DatabaseRole client certificates can set duration and renewBefore, Database schemas accept USAGE and CREATE grants, replicas from online snapshots start from the stored backup label, and WAL metrics no longer count partial files.

This week: a read-only viewer role for DBAs, follower hot standby parameters enforced even after removal from the spec, and on-demand backups keeping the cluster online configuration. Plus bootstrap safety on recreated Pods and steadier E2E tests.

This week's changes for CloudNativePG users: a new cnpg-viewer-role ClusterRole and read-only DBA persona docs give humans operational access without cluster-admin. Hot standby sensitive parameters removed from the Cluster spec are now still enforced for followers, and on-demand backups keep the cluster online configuration when only one of the checkpoint or archive options is set. The bootstrap-instance init container now leaves volumes that already hold the instance untouched when a Pod is recreated with its PVCs. E2E work resolves the csi-hostpath deploy directory at runtime, retries read-only psql checks that hit dropped exec streams on AKS, and dumps cnpg-system and cert-manager objects on failed upgrades.

This week: DatabaseRole can generate its own password. The liveness probe now restarts truly stuck Pods, and a replica that stops being target primary stops renewing the lease. Local connections get a connect timeout, plus timeline-aware WAL restore markers.

This week in CloudNativePG: DatabaseRole can now generate its own password and store it in a basic-auth Secret. The instance-manager liveness probe now fails so the kubelet can restart Pods stuck in states the lease and fencing logic cannot recover from, and a replica that stops being target primary no longer keeps renewing the primary lease. Local superuser and metrics connections now have a connect timeout. WAL restore uses timeline-scoped end-of-WAL markers, kubectl cnpg status handles a missing exec permission, and the docs announce 1.31 as the last release with native Barman Cloud support.

Weekly update: primary self-fencing now uses the primary lease, pg_basebackup bootstrap gains additionalArgs and tablespaceMapping, Backup start is guarded against duplicate reconciliations, and requeue without a delay works again.

This week in CloudNativePG: primary self-fencing on network isolation moved from the liveness probe to the primary lease. pg_basebackup bootstrap gained additionalArgs for tuning the copy and tablespaceMapping for sources that do not follow the CloudNativePG tablespace layout. Backup status patches are now conditional on resourceVersion so a second reconciliation cannot start or reset a backup. A hook returning BEHAVIOR_REQUEUE without requeue_after now requeues the Cluster, replica clusters report the system ID while PostgreSQL is down, and the exec timeout applies per attempt. Image extensions skip directories missing from the image, GitHub downloads retry on connection reset, and the GKE job uses Workload Identity Federation.

Dependency bumps clear govulncheck findings, threat assessment artifacts move to Gemara v1.6.0, and OpenShift CI drops the kubeadmin user after install. Replica switchover e2e tests now stop running out of disk and wait for the rollout.

This week in CloudNativePG: updated golang.org/x modules to fix govulncheck findings, bumped threat assessment artifacts to Gemara v1.6.0 with SECURITY_INSIGHTS.yml aligned to the same version, and removed the kubeadmin user after the OpenShift installation while hiding its password in installer output. The replica switchover end-to-end tests got two fixes: inserts are paused and max_wal_size is capped at 256MB with WAL on its own 1Gi volume so the disk no longer fills, and the spec waits for the second cluster to be ready before querying it, avoiding mid-restart reads.

This week: fixed restore hangs with backup tools, resolved licensing flags, improved CI reliability with longer timeouts, and made GKE configuration more flexible for different environments.

This week's updates focus on reliability and compliance. We fixed an issue where restore operations would hang when backup tools recreate Pods with PVCs, replaced a licensing-flagged test dependency with a standards-based approach, increased CI timeouts to prevent false failures on slower cloud runs, and made GKE infrastructure configuration more flexible. These changes strengthen backup/restore workflows and improve test reliability.

V1.30.1 and v1.29.3 released. v1.29 is now end-of-life. Fixes include Barman Cloud recovery args, PVC label handling, monitoring alert latching, and replica cluster sort order.

CloudNativePG v1.30.1 and v1.29.3 are now available. v1.29 reaches end-of-life; users should upgrade. This week's releases include enhanced Barman Cloud recovery parameter forwarding, fixes for monitoring alerts that latch forever, corrected replica cluster designated primary sorting, and improved PostgreSQL 18 compatibility with data checksums handling.

This week: failover no longer stalls, fencing affects only the target instance, restore deadlocks are fixed, and primary startup is safer. Critical reliability improvements for PostgreSQL on Kubernetes.

This week we fixed several critical reliability issues in CloudNativePG: failover operations no longer stall or revert, fencing now correctly isolates only the target instance, restore from orphan PVCs no longer deadlocks, and primary startups now properly acquire the lease first. These changes ensure clusters can reliably recover from failures and maintenance events.