diff --git a/content/releases/cloudnative-pg-1-30.0-released/58364dde1adc4a0a8.37186404-2048x1445.jpg b/content/releases/cloudnative-pg-1-30.0-released/58364dde1adc4a0a8.37186404-2048x1445.jpg new file mode 100644 index 00000000..7c5ea16e Binary files /dev/null and b/content/releases/cloudnative-pg-1-30.0-released/58364dde1adc4a0a8.37186404-2048x1445.jpg differ diff --git a/content/releases/cloudnative-pg-1-30.0-released/index.md b/content/releases/cloudnative-pg-1-30.0-released/index.md new file mode 100644 index 00000000..ced96de9 --- /dev/null +++ b/content/releases/cloudnative-pg-1-30.0-released/index.md @@ -0,0 +1,183 @@ +--- +title: "CloudNativePG 1.30.0 Released!" +date: 2026-06-29 +draft: false +authors: + - gbartolini +image: + url: 58364dde1adc4a0a8.37186404-2048x1445.jpg + attribution: from Saurabh +tags: + - release + - postgresql + - postgres + - kubernetes + - k8s + - cloudnativepg + - cnpg + - DatabaseRole + - primaryLease + - high-availability + - failover + - security + - RBAC + - supplychain + - GitOps + - PgBouncer + - ImageCatalogs +summary: "CloudNativePG 1.30 is here! This stable release introduces the DatabaseRole CRD for declarative, GitOps-friendly role management and a Lease-based primary election primitive for safer failover. We also announce maintenance releases 1.29.2 and the final 1.28.4. Upgrade today for enhanced stability, security, and high availability." +--- + +The CloudNativePG Community is excited to announce the immediate availability +of **CloudNativePG 1.30.0**! + +This minor release introduces the new `DatabaseRole` CRD for declarative, +GitOps-friendly PostgreSQL role management and a Lease-based primary election +primitive for safer failover, alongside notable security and operational +improvements, further cementing CloudNativePG as the leading operator for +running PostgreSQL workloads on Kubernetes. + +We are also pleased to announce the release of maintenance versions **1.29.2** +and **1.28.4**, the latter of which is the final planned release in the 1.28.x +series. We encourage users on 1.28 to plan their upgrade to 1.29 or 1.30. + +With the release of CloudNativePG 1.30.0, the CloudNativePG 1.28.x series +reaches its End-of-Life (EOL) date of June 30, 2026, and the EOL date for the +CloudNativePG 1.29.x series is confirmed as September 29, 2026. + +--- + +## Highlights in 1.30.0 + +### DatabaseRole CRD for declarative role management + +The headline addition in 1.30 is the new +[`DatabaseRole`](https://cloudnative-pg.io/docs/1.30/declarative_role_management/#the-databaserole-resource) +custom resource, which manages a PostgreSQL role as a standalone Kubernetes +object rather than inline in the `Cluster`'s `.spec.managed.roles` stanza. Each +role now has its own lifecycle, status and RBAC, which suits GitOps workflows +and lets role definitions live next to the applications that own them. Migrating +an existing role is a matter of moving its stanza into a dedicated +manifest. + +A `DatabaseRole` can also include a `clientCertificate` block, having the +operator automatically generate and renew a TLS client certificate signed by +the cluster's client CA and stored in a `-client-cert` +Secret. This enables password-free PostgreSQL `cert` authentication, with the +Secret cleaned up automatically when the feature is disabled or the resource is +deleted. + +### Primary Lease for safe primary election + +CloudNativePG 1.30 introduces a Kubernetes `Lease` object, named after the +cluster, that acts as a mutex serializing primary promotion. The instance +manager must hold the lease before acting as primary and releases it on clean +shutdown, so replicas can promote without waiting for the full TTL. Timings are +configurable through the new +[`.spec.primaryLease`](https://cloudnative-pg.io/docs/1.30/failover/#tuning-the-primary-lease) +stanza. + +To be precise about the architecture: the lease is a promotion gate, not a +fence. Primary isolation remains responsible for fencing — the Lease closes +the window for an uncoordinated promotion during transitions. + +--- + +## Enhanced Security and Resilience + +This release includes significant improvements focused on stability, security, +and supply-chain integrity: + +- **`search_path` pinning ([CVE-2026-55769](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-x8c2-3p4r-v9r6)):** + Fixed a privilege-escalation vulnerability (CWE-426) where a database owner + could plant overloaded operators in the `public` schema. The operator now + pins `search_path = pg_catalog, public, pg_temp` on its pooled connections. +- **SCRAM-SHA-256 password encoding ([CVE-2026-55765](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-w3gf-xc94-wvmj)):** + The operator now SCRAM-SHA-256 encodes cleartext passwords before issuing + `CREATE`/`ALTER ROLE` commands, so the SCRAM verifier — rather than the + cleartext secret — is what could ever appear in logs or extension captures. +- **Authenticated instance communication ([GHSA-7qwx-x8ff-3px9](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-7qwx-x8ff-3px9)):** + Operator-to-instance-manager communication is now authenticated via ECDSA + certificates. This hardening is new in 1.30.0 and is not backported; on + earlier releases continue to restrict the instance status port with a + `NetworkPolicy`. + +## Other Notable Enhancements + +- **In-place major upgrades with Image Volume extensions** — `pg_upgrade` + in-place upgrades are now supported for clusters using Image Volume + extensions, mounting the source- and target-version extension images side by + side so a failed upgrade reverts cleanly. +- **PgBouncer image management via Image Catalogs** — the `Pooler` can now + reference an `ImageCatalog` or `ClusterImageCatalog` entry through + `spec.pgbouncer.imageCatalogRef`, with referencing `Poolers` automatically + reconciled and rolled out when a catalog entry changes. +- **TLS for the Pooler metrics endpoint** via `.spec.monitoring.tls.enabled`, + with hot certificate reloading on every handshake. +- **Cluster as a VPA/HPA target** through a new `status.selector` on the scale + subresource, mapping a `Cluster` to its instance pods. +- **Primary status visibility** — the operator now emits a + `PrimaryStatusCheckFailed` warning event when a primary pod looks Ready to the + kubelet but fails the operator's `/pg/status` check, surfacing failover + deferrals via `kubectl describe cluster`. + +This release also adds support for Kubernetes 1.36 and updates the default +PostgreSQL version to 18.4. + +> **Heads-up on an API change:** the `cluster` reference is now immutable on the +> `Database`, `Pooler`, `Publication`, `Subscription` and `ScheduledBackup` +> resources. Re-pointing one of these at a different cluster is now rejected by a +> CEL validation rule at the API server, as it had no well-defined semantics. + +Dive into the full list of changes and fixes in the +[release notes for CloudNativePG 1.30](https://cloudnative-pg.io/docs/1.30/release_notes/v1.30/). + +## Maintenance Releases: 1.29.2 & 1.28.4 + +In parallel with the 1.30 release, we have also shipped maintenance updates for +the previous stable series. Both backport the security fixes above — including +`search_path` pinning and SCRAM-SHA-256 password encoding — along with VPA/HPA +support, primary status visibility, automatic CNPG-I plugin reloading, Kubernetes +1.36 support, the updated PostgreSQL 18.4 default, and dozens of bug fixes: + +- **CloudNativePG 1.29.2:** see the + [release notes for 1.29](https://cloudnative-pg.io/docs/1.29/release_notes/v1.29/#version-1292). +- **CloudNativePG 1.28.4:** the final planned maintenance release for the + 1.28.x series — see the + [release notes for 1.28](https://cloudnative-pg.io/docs/1.28/release_notes/v1.28/#version-1284). + We strongly recommend planning an upgrade to a currently supported version. + +We encourage all users to upgrade to the latest stable versions to benefit from +the latest features, security enhancements, and bug fixes. + +Follow the [upgrade instructions](https://cloudnative-pg.io/docs/1.30/installation_upgrade/#upgrades) +for a smooth transition. + +--- + +## Get Involved with the Community + +[Join us](https://github.com/cloudnative-pg/cloudnative-pg?tab=readme-ov-file#communications) +to help shape the future of cloud-native Postgres! + +If you're using CloudNativePG in production, consider +[adding your organization as an adopter](https://github.com/cloudnative-pg/cloudnative-pg/blob/main/ADOPTERS.md) +to support the project's growth and evolution. + +Thank you for your continued support! Upgrade today and discover how +CloudNativePG can elevate your PostgreSQL experience to new heights. + +