|
| 1 | +--- |
| 2 | +# IMPORTANT: Do not edit this file directly - it is generated from yaml source. |
| 3 | +title: EDB CloudNativePG Cluster 1.27.4 release notes |
| 4 | +navTitle: Version 1.27.4 |
| 5 | +originalFilePath: product_docs/docs/postgres_for_kubernetes/1/rel_notes/src/1.27.4_rel_notes.yml |
| 6 | +editTarget: originalFilePath |
| 7 | +--- |
| 8 | + |
| 9 | +Released: 31 March 2026 |
| 10 | + |
| 11 | +This release of EDB CloudNativePG Cluster includes the following: |
| 12 | + |
| 13 | +## Highlights |
| 14 | + |
| 15 | +Updated the deprecation notice for native (in-tree) Barman Cloud support to |
| 16 | +reflect that it will now be removed in EDB Postgres for Kubernetes 1.30.0, rather than |
| 17 | +1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin. |
| 18 | +([#10167](https://github.com/cloudnative-pg/cloudnative-pg/pull/10167)) |
| 19 | + |
| 20 | +## Enhancements |
| 21 | + |
| 22 | +<table class="table w-100"><thead><tr><th>Description</th><th width="10%">Addresses</th></tr></thead><tbody> |
| 23 | +<tr><td><details><summary>Improved the <code>Pooler</code> CRD with support for granular configuration of TLS |
| 24 | +cipher suites and minimum/maximum TLS versions. |
| 25 | +</summary><hr/><p>This enables administrators |
| 26 | +to meet strict security compliance requirements for pooler-to-client and |
| 27 | +pooler-to-server connections. |
| 28 | +Contributed by @alex1989hu.</p> |
| 29 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9571">#9571</a></td></tr> |
| 30 | +<tr><td><details><summary>Improved the reliability of major upgrades by setting <code>BackoffLimit=0</code> on the |
| 31 | +upgrade job, preventing unnecessary retries of a failed <code>pg_upgrade</code>. |
| 32 | +</summary><hr/><p>The operator now automatically deletes the failed job when a user reverts the |
| 33 | +container image, allowing the cluster to restart gracefully on the original |
| 34 | +version.</p> |
| 35 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10104">#10104</a>, <a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10298">#10298</a></td></tr> |
| 36 | +<tr><td><details><summary>Improved role management by verifying the instance is the primary before |
| 37 | +each reconciliation cycle |
| 38 | +</summary><hr/><p>...avoiding unnecessary reconciliation attempts and spurious error messages on read-only replicas.</p> |
| 39 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9971">#9971</a></td></tr> |
| 40 | +<tr><td>The operator now honors the `primaryUpdateMethod` when adding new PVCs to a |
| 41 | +cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is |
| 42 | +respected during storage expansion or additions. |
| 43 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9720">#9720</a></td></tr> |
| 44 | +</tbody></table> |
| 45 | + |
| 46 | + |
| 47 | +## Security Fixes |
| 48 | + |
| 49 | +<table class="table w-100"><thead><tr><th>Description</th><th width="10%">Addresses</th></tr></thead><tbody> |
| 50 | +<tr><td>Security best practices integration**: integrated the OpenSSF baseline |
| 51 | +scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align |
| 52 | +with industry-standard security reporting. |
| 53 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10054">#10054</a>, <a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10062">#10062</a></td></tr> |
| 54 | +<tr><td><details><summary>SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software |
| 55 | +Artifacts) provenance to release binaries and container images. |
| 56 | +</summary><hr/><p>Additionally, |
| 57 | +enabled Software Bill of Materials (SBOM) generation within the GoReleaser |
| 58 | +pipeline for improved dependency transparency.</p> |
| 59 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10048">#10048</a>, <a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10074">#10074</a></td></tr> |
| 60 | +<tr><td>Password leak prevention**: fixed a potential security risk where PostgreSQL |
| 61 | +could leak role passwords in the logs during specific reconciliation phases. |
| 62 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9950">#9950</a></td></tr> |
| 63 | +</tbody></table> |
| 64 | + |
| 65 | + |
| 66 | +## Changes |
| 67 | + |
| 68 | +<table class="table w-100"><thead><tr><th>Description</th><th width="10%">Addresses</th></tr></thead><tbody> |
| 69 | +<tr><td>Updated the default PostgreSQL version to 18.3 (image `18.3-standard-ubi9`). |
| 70 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10090">#10090</a></td></tr> |
| 71 | +</tbody></table> |
| 72 | + |
| 73 | + |
| 74 | +## Bug Fixes |
| 75 | + |
| 76 | +<table class="table w-100"><thead><tr><th>Description</th><th width="10%">Addresses</th></tr></thead><tbody> |
| 77 | +<tr><td><details><summary>Fixed an issue where fencing annotations could not be processed when the WAL |
| 78 | +disk was full |
| 79 | +</summary><hr/><p>...because the disk space check blocked the instance manager from |
| 80 | +starting. The check is now performed later in the lifecycle loop, after |
| 81 | +fencing is evaluated.</p> |
| 82 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10302">#10302</a></td></tr> |
| 83 | +<tr><td><details><summary>Fixed an issue where replicas would get stuck in a <code>Pending</code> state if the |
| 84 | +<code>VolumeSnapshot</code> used for the initial bootstrap had been deleted. |
| 85 | +</summary><hr/><p>The operator now validates snapshot existence before use; if a snapshot is missing, |
| 86 | +it attempts to use the next available candidate or falls back to |
| 87 | +<code>pg_basebackup</code>.</p> |
| 88 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10192">#10192</a></td></tr> |
| 89 | +<tr><td>Prevented the "supervised primary" rollout strategy from consuming all |
| 90 | +available rollout slots, which previously caused delays in scheduled updates. |
| 91 | +Contributed by @ermakov-oleg. |
| 92 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9977">#9977</a></td></tr> |
| 93 | +<tr><td>Fixed an issue where certain hot-standby parameter changes were not being |
| 94 | +correctly applied to replica clusters. |
| 95 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9952">#9952</a></td></tr> |
| 96 | +<tr><td>Fixed a bug in the CNPG-I reconciler hook that could lead to skipping |
| 97 | +subsequent plugins when a "continue" result was returned. |
| 98 | +Contributed by @sharifmshaker. |
| 99 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9978">#9978</a></td></tr> |
| 100 | +<tr><td>Fixed a deadlock scenario that occurred when attempting to resize a |
| 101 | +filesystem on a PVC that was not currently attached to a Pod. |
| 102 | +Contributed by @jmealo. |
| 103 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9981">#9981</a></td></tr> |
| 104 | +<tr><td><details><summary>Fixed webhook validation of bootstrap recovery sources to accept external |
| 105 | +clusters configured with <code>ConnectionParameters</code> (for <code>pg_basebackup</code>-based |
| 106 | +recovery). |
| 107 | +</summary><hr/><p>Previously, these were incorrectly rejected unless a Barman |
| 108 | +object store or CNPG-i plugin was also configured.</p> |
| 109 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10268">#10268</a></td></tr> |
| 110 | +<tr><td>Volume names for extensions and tablespaces are now prefixed to avoid naming |
| 111 | +collisions with standard cluster volumes. |
| 112 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9973">#9973</a></td></tr> |
| 113 | +<tr><td>When hibernating a non-healthy cluster, the operator now reports a |
| 114 | +`WaitingForHealthy` condition, making the deferred hibernation state visible |
| 115 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10193">#10193</a></td></tr> |
| 116 | +<tr><td><details><summary>Fixed fencing to work correctly even when the target pod does not exist. |
| 117 | +</summary><hr/><p>Fencing operates on a cluster-level annotation and should not depend on pod |
| 118 | +existence; instance name validation is now performed only in the <code>cnp fencing on</code> command.</p> |
| 119 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10035">#10035</a></td></tr> |
| 120 | +<tr><td>Fixed the cluster and pooler service reconcilers to correctly handle changes |
| 121 | +to all spec fields when using the patch update strategy. The reconciler now |
| 122 | +uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields |
| 123 | +(such as `loadBalancerClass`) from being inadvertently removed. |
| 124 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10190">#10190</a>, <a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10311">#10311</a></td></tr> |
| 125 | +<tr><td>Fixed a race condition in the deprecated in-tree Barman Cloud backup |
| 126 | +implementation affecting parallel WAL restore, where prefetched files could |
| 127 | +be read while still being downloaded, causing PostgreSQL recovery to fail |
| 128 | +with "invalid checkpoint record" errors. |
| 129 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10285">#10285</a></td></tr> |
| 130 | +<tr><td><details><summary>Fixed the timeline history file validation to also apply to plugin-based WAL restore. |
| 131 | +</summary><hr/><p>Previously, the protection introduced in |
| 132 | +<a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9650">#9650</a> only |
| 133 | +covered in-tree restores, allowing plugins to bypass the check and download |
| 134 | +future timeline history files, causing timeline mismatch errors on replicas.</p> |
| 135 | +</details></td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/9849">#9849</a></td></tr> |
| 136 | +<tr><td>The cnp plugin now correctly propagates ImagePullSecrets to the |
| 137 | + `pgbench` Job pod template. |
| 138 | +</td><td><a href="https://github.com/cloudnative-pg/cloudnative-pg/pull/10174">#10174</a></td></tr> |
| 139 | +</tbody></table> |
| 140 | + |
| 141 | + |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments