#Release Notes

#v1.29.2-acp.1 (2026-08-14, GA)

Patch release tracking upstream CloudNativePG v1.29.2 (upstream release date 2026-06-29).

This is an operator-only release: the operator and bundle images are rebuilt, and every operand image — PostgreSQL, PostGIS, pgvector, pgaudit, PgBouncer, and the Barman Cloud plugin and its sidecar — is carried forward at the identical image tag as v1.29.1-acp.1.

#Highlights

• Two upstream security fixes, both in operator code.

  • CVE-2026-55769 — the operator now pins search_path = pg_catalog, public, pg_temp on every connection it opens. Previously a database owner could plant overloaded built-in operators in the public schema and alter the search_path so that the operator's introspection probes — which run as the cluster superuser — resolved those overloads before pg_catalog, a privilege-escalation chain of the same class as CVE-2018-1058. (#10774, GHSA-x8c2-3p4r-v9r6)
  • CVE-2026-55765 — the operator now SCRAM-SHA-256 encodes cleartext role passwords before issuing CREATE/ALTER ROLE ... PASSWORD, so the literal PostgreSQL parses — and that extensions such as pg_stat_statements or pgaudit may capture — is the SCRAM verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged, and the per-Secret annotation cnpg.io/passwordPassthrough: "enabled" opts out. (#10724, GHSA-w3gf-xc94-wvmj)

• endpointslices RBAC granted in the OLM bundle. Upstream v1.29.2 makes the operator watch the EndpointSlices backing CNPG-i plugin Services, so that an upgraded plugin is picked up as soon as its pods become Ready instead of at the next resync. The matching permission was absent from the ClusterServiceVersion, and without it the operator entered CrashLoopBackOff on install. It is granted in this release.

• Default PostgreSQL version is now 18.4. (#10719)

• Kubernetes 1.36 is supported. (#10900)

• A Cluster is now a valid autoscaler target. The scale subresource exposes status.selector, which lets the Vertical and Horizontal Pod Autoscalers map a Cluster to its instance pods and use it as a targetRef. (#8996)

• The cluster reference is now immutable on the Database, Pooler, Publication, Subscription, and ScheduledBackup resources. Repointing one of these at a different cluster has no well-defined semantics and previously left the controllers inconsistent; the update is now rejected at the API server by a CEL validation rule. (#10743)

• Native (in-tree) Barman Cloud support will be removed in CloudNativePG 1.31.0, not 1.30.0 as previously announced. Migration to the Barman Cloud Plugin — bundled since v1.29.1-acp.1 — is still recommended. (#11083)

#Upstream changes in this release

Upstream v1.29.2 carries 2 important changes, 4 enhancements, 2 security fixes, 3 changes, and 32 bug fixes. Beyond the highlights above, the fixes most likely to matter in an ACP deployment are:

• Switchover deadlock when a WAL-archiver plugin was enabled on an existing cluster. With primaryUpdateMethod: switchover the primary could not be rolled out, because a clean demotion needs the archiver sidecar that was still missing. The operator now recreates the primary Pod in place so the sidecar is injected and archiving resumes. The check also covers plugins that inject the archiver as a native sidecar, such as the Barman Cloud plugin. (#11032, #11059)
• A cluster staying in Setting up primary indefinitely when the instance-creation Job exhausted its backoff limit. The operator now detects the terminal Job failure, marks the cluster unrecoverable, names the failed Job and points to its logs. (#11035)
• spec.postgresql.parameters accepting keys that are not valid PostgreSQL parameter names, which could inject arbitrary directives into postgresql.conf. Key names are now validated by the webhook. (#11029)
• Non-sequential pod names (for example -1, -3), caused by the instance serial counter being advanced before the corresponding Job and PVCs were created. (#10491)
• Declarative Database, Publication, and Subscription objects reporting a stale primary-side status forever after their cluster was demoted to a replica (#10871), and getting stuck in Terminating on a replica cluster because the finalizer was never released (#10853).

The complete upstream change list is published at cloudnative-pg/cloudnative-pg releases/tag/v1.29.2.

#Security and CVE status

• No ERRATA is published for this release. No operand image was rebuilt, so no operating-system package CVE is fixed at product level. The operator image does pick up base package updates as part of its rebuild, but the same packages continue to ship in the unchanged Barman Cloud plugin and sidecar images delivered alongside it, so the exposure of a running deployment is unchanged.
• The two CVEs in the highlights are defects in the operator's own Go code, not in operating-system packages. They are therefore invisible to container-image CVE scanning, and their absence from any ERRATA does not mean this release carries no security content — it does.
• The residual no-fix base-OS CVEs listed under v1.29.1-acp.1 below still apply, unchanged. 0 fixable HIGH/CRITICAL CVEs remain on any shipped image.

#Extension support

Unchanged from v1.29.1-acp.1 — every operand image ships at the same tag, so the per-major extension matrix in the v1.29.1-acp.1 notes below applies to this release without change.

#Known issues / limitations

• All limitations listed under v1.29.1-acp.1 still apply, since the operand images are identical: pgaudit must be enabled declaratively, the residual no-fix Debian trixie CVEs, and the PostGIS/GDAL transitive no-fix HIGHs.
• In-place major upgrades via Image Volume extensions are not usable on ACP in this release. Upstream #10366 enables pg_upgrade in-place major upgrades for clusters that use Image Volume extensions, but it targets PostgreSQL 19 or later, and it depends on the Kubernetes ImageVolume feature gate, which is off by default on ACP. The highest PostgreSQL operand shipped here is 18.4.

#Validation summary

• Functional: new-deploy and in-place upgrade from v1.29.1-acp.1, on ACP 4.3 / amd64 / PostgreSQL 18, HA cluster — both passed with 0 product bugs. The upgrade round verified that the operator rolled to the new image, the previous ClusterServiceVersion was replaced, and pre-upgrade data was preserved intact.
• Continuous integration: the operator end-to-end suite passed on the exact tagged commit.
• Scope: this is an operator-only patch release, and performance and stability qualification were not repeated for it — no operand image changed, so the data-plane characteristics measured for v1.29.1-acp.1 continue to apply. The functional rounds above were run on ACP 4.3 / amd64 / PostgreSQL 18; other architectures and PostgreSQL majors are unchanged from the previous release by construction, not by re-measurement.

#Upgrade

In-place upgrade from v1.29.1-acp.1 is supported and verified. See Upgrade.

#v1.29.1-acp.1 (2026-06-11, GA)

First General Availability release of Alauda build of CloudNativePG, based on upstream CNPG v1.29.1. This is a security + capability release over the v1.29.0-acp.x preview line: all operand images were rebuilt against CVE-patched, compliance-hardened bases, the in-operand extension set was expanded, and Barman Cloud backup is now bundled.

#Highlights

• Barman Cloud backup is now bundled (resolves the Alpha known-limitation): the plugin-barman-cloud operator plugin + sidecar (0.12.0) ship inside the bundle. Object-store backup/restore and PITR work out of the box, alongside the CSI VolumeSnapshot backup path.
• Expanded in-operand extensions: the standard PostgreSQL operands now compile in PostGIS 3.6.3, zhparser 2.4, and TimescaleDB 2.27.2 (Apache-2 OSS) in addition to pgvector 0.8.2, pgaudit, and pg_failover_slots. These are available without enabling the Kubernetes ImageVolume feature gate (which is off by default on ACP) — no overlay image needed.
• IPv6 single-stack fix: the operator now correctly brackets IPv6 Pod addresses when building instance URLs (forward-port of upstream #10682). HA clusters now converge on single-stack IPv6 ACP clusters; previously a cluster could freeze at a single instance.
• Security & compliance: the build-time gnupg dependency (and CVE-2026-24882) is removed via a gnupg-free rebuild; red-line hardening (nologin accounts, no sniffer tools, no sensitive build artifacts, flattened layers) is applied across all images. 0 fixable HIGH/CRITICAL CVEs remain on any shipped image.
• Multi-architecture: amd64 + arm64 across operator, plugin, bundle, and PostgreSQL container images.

#Extension support by PostgreSQL major

TimescaleDB ships as the Apache-2 (OSS) edition only (matching the incumbent Zalando/Spilo stack) — TSL-gated features (compression/columnstore, continuous aggregates) are intentionally absent. There is no OSS TimescaleDB for PG 14 on Debian trixie; migrate PG 14 TimescaleDB workloads to PG 15+.

#Known issues / limitations

• pgaudit must be enabled declaratively. It is an operator-managed, shared_preload_libraries-loaded extension — set it via spec.postgresql.shared_preload_libraries + pgaudit.* parameters. A manual CREATE EXTENSION pgaudit is dropped on the next restart by the operator. See Configuration → Extensions.
• Residual no-fix base-OS CVEs (Debian trixie, fix_available=false, accepted under a filed security exception): ncurses (CVE-2025-69720), libxml2 (CVE-2026-6732), perl/Archive::Tar (CVE-2026-42496 / 8376 / 42497 / 9538). These packages are not on the PostgreSQL runtime path.
• PostGIS GDAL transitive no-fix HIGHs: bundling PostGIS pulls the full GDAL driver stack (libgdal36 → poppler/heif/curl/…), which carries Debian-unfixed HIGH CVEs in codec libraries (libheif1, libpoppler147, libgdal36, libcurl*, libexpat1, libgif7, libssh2-1t64). Accepted: PostGIS core geospatial/raster paths do not invoke the PDF/HEIF codec drivers. 0 fixable HIGH/CRITICAL.

#Validation summary

• Functional: R1 new-deploy (arm64 + single-stack IPv6 + dual-stack, TopoLVM) + R2 in-place upgrade (v1.29.0-acp.2 → v1.29.1-acp.1) — 100% pass, 0 product bugs. IPv6 fix verified on real single-stack IPv6 (3/3 instances converge; the prior build froze at 1/3 in the same environment).
• Performance: meets or exceeds the incumbent Zalando operator across all 8 scenarios.
• Stability: 24h soak under sustained load — no memory leak, 0 restart/OOM/failover.
• High availability: 6/6 robustness scenarios (pod/PVC deletion, partition, reboot, shutdown) — failover + reconverge with RPO = 0.

#Upgrade

In-place upgrade from v1.29.0-acp.2 is verified (operand swap; data intact, replica and metadata correct, 0 crash). See Upgrade.

#v1.29.0-acp.1 (2026-05-08, Alpha)

First release of Alauda build of CloudNativePG. Based on upstream CNPG v1.29.0.

#Highlights

• Air-gapped operation: PostgreSQL container images for PG 14, 15, 16, 17, 18 (both standard and minimal variants), pgaudit/pgvector/pgbouncer extensions, all mirrored to build-harbor.alauda.cn/middleware/cnpg/....
• Image-rewrite tolerance: ENABLE_IMAGE_REWRITE_TOLERANCE=true baked in the CSV so admission-time image rewriting (mirror substitution) does not trigger phantom rollouts of PostgreSQL primary pods.
• Pre-baked default images: POSTGRES_IMAGE_NAME=cnpg/postgresql:18.3-standard-trixie and PGBOUNCER_IMAGE_NAME=cnpg/pgbouncer:1.25.1 (rolling tags, mirror-resolvable). Bare community-quickstart Cluster and Pooler CRs work zero-edit.
• L5 RBAC: cpaas:middleware-cnpg:business-ns:{admin,edit,view,backup,restore} ClusterRoles, plus cluster-scope:*-base companion roles for ClusterImageCatalog. Aggregation labels target ACP aggregate-to-namespace-admin / aggregate-to-namespace-developer.
• Multi-architecture: amd64 + arm64 across operator, plugin, bundle, and PostgreSQL containers.

#Known limitations

• Backup: Barman Cloud plugin is not bundled in this release. It will ship as a separate sibling package (cloudnative-pg-barman-cloud-plugin) post-Alpha.
• OLM upgrade from rc-suffixed builds: due to strict SemVer §11 ordering, an rc.X.gSHA-suffixed ArtifactVersion semver-sorts above its bare release tag. Upgrading from a pre-release build requires the historical-version recovery sequence.

#Verified install paths

• Fresh install on ACP IDP-style cluster: bundle deploys cleanly via Subscription without startingCSV pin. CSV reaches Succeeded in under 30 seconds.
• 3-instance Cluster CR with default image (POSTGRES_IMAGE_NAME rolling tag) and bare storageClass reference reaches "Cluster in healthy state" in ~2 minutes.
• psql -h <cluster>-rw connection via TCP with auto-generated app-user password works out of the box (replace <cluster> with the Cluster CR name).
• Failover (kubectl delete pod on primary): operator promotes a replica to primary in single-digit seconds.