---
id: v1.28
title: Release notes for CloudNativePG 1.28
---

# Release notes for CloudNativePG 1.28

History of user-visible changes in the 1.28 minor release of CloudNativePG.

For a complete list of changes, please refer to the
[commits](https://github.com/cloudnative-pg/cloudnative-pg/commits/release-1.28)
on the release branch in GitHub.

## Version 1.28.3

**Release date:** May 8, 2026

### Security and Supply Chain

- **`CVE-2026-44477` / `GHSA-423p-g724-fr39`: metrics exporter privilege
  escalation**: the metrics exporter no longer authenticates as the
  `postgres` superuser. It now uses a dedicated `cnpg_metrics_exporter`
  role with `pg_monitor` privileges only, closing a chain that let a
  low-privilege database user gain PostgreSQL superuser.
  ([`GHSA-423p-g724-fr39`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39)) <!-- 1.29 1.28 1.25 -->

    Upgrade impact: custom monitoring queries that read user-owned tables,
    or use `target_databases: '*'` against databases where
    `PUBLIC CONNECT` has been revoked, need explicit `GRANT` statements to
    `cnpg_metrics_exporter`. See ["Custom query privileges and
    safety"](../monitoring.md#custom-query-privileges-and-safety) and ["Manually
    creating the metrics exporter
    role"](../monitoring.md#manually-creating-the-metrics-exporter-role)
    in the monitoring documentation.

    For replica clusters, upgrade the source primary cluster before any
    replica clusters that consume from it. The `cnpg_metrics_exporter`
    role is created on the source primary and replicates downstream; a
    replica cluster upgraded first will scrape against a missing role
    until the source primary upgrades. The manual-recovery section
    linked above also covers replica clusters.

- **Schema-qualified catalog references in default monitoring queries**:
  hardened the shipped monitoring configuration and documentation samples by
  qualifying every `pg_catalog` object explicitly. Unqualified references
  resolve through `search_path`, which a database user can manipulate to
  shadow built-in objects.
  ([#10576](https://github.com/cloudnative-pg/cloudnative-pg/pull/10576)) <!-- 1.29 1.28 1.25 -->

- **Discoverable SBOM and provenance attestations**: SBOM and SLSA provenance
  attached to operator container images now follow the OCI 1.1 Referrers
  spec, so standard registry tooling and supply-chain scanners can discover
  them automatically.
  ([#10601](https://github.com/cloudnative-pg/cloudnative-pg/pull/10601)) <!-- 1.29 1.28 1.25 -->

- **CVE remediation in `github.com/jackc/pgx/v5`**: bumped to v5.9.2 to pick
  up upstream fixes for `CVE-2026-33816` (memory-safety in `pgproto3`) and
  `GHSA-j88v-2chj-qfwx` (SQL injection via simple-protocol dollar-quoted
  string handling).
  ([#10436](https://github.com/cloudnative-pg/cloudnative-pg/pull/10436),
  [#10498](https://github.com/cloudnative-pg/cloudnative-pg/pull/10498))

- **CVE remediation in the Go runtime**: built with Go 1.26.3 to pick up
  upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net`
  (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814,
  CVE-2026-33811, CVE-2026-39825).
  ([#10462](https://github.com/cloudnative-pg/cloudnative-pg/pull/10462),
  [#10647](https://github.com/cloudnative-pg/cloudnative-pg/pull/10647)) <!-- 1.29 1.28 1.25 -->

- **Build pipeline hardening**: the Go 1.26.3 bump also addresses
  CVE-2026-42501 (`cmd/go` module-checksum validation), reducing
  supply-chain exposure during release builds. The affected code paths
  are not reachable from the running operator.
  ([#10647](https://github.com/cloudnative-pg/cloudnative-pg/pull/10647)) <!-- 1.29 1.28 1.25 -->

### Changes

- Switched TLS peer verification from `VerifyPeerCertificate` to
  `VerifyConnection`, which runs on every completed handshake (the former is
  skipped on resumed TLS 1.3 sessions). Session resumption is not enabled in
  CloudNativePG today, so this has no observable effect, but it future-proofs
  verification if session caching is introduced later.
  ([#10478](https://github.com/cloudnative-pg/cloudnative-pg/pull/10478)) <!-- 1.29 1.28 1.25 -->

### Fixes

- Fixed a failover window where the former primary kept its primary label.
  If it returned during failover (for example, after a transient network
  partition), the `-rw` service kept routing to it, replicas could reconnect,
  and committed writes were lost to `pg_rewind`. The old primary is now
  labeled `unhealthy` to isolate it from service traffic during failover.
  ([#10409](https://github.com/cloudnative-pg/cloudnative-pg/pull/10409)) <!-- 1.29 1.28 1.25 -->

- Fixed failover not being triggered when the node hosting the primary
  becomes unreachable. The operator now reads the pod's `Ready` condition
  (flipped to `False` by the node controller when the kubelet stops
  reporting) instead of `ContainersReady`, which stays stale as `True` in
  that scenario. Combined with the spurious-failover guard
  ([#10445](https://github.com/cloudnative-pg/cloudnative-pg/pull/10445)),
  failover triggers only when Kubernetes itself marks the pod not Ready.
  ([#10448](https://github.com/cloudnative-pg/cloudnative-pg/pull/10448)) <!-- 1.29 1.28 1.25 -->

- Fixed spurious failovers caused by transient failures on the primary's HTTP
  status endpoint.
  ([#10445](https://github.com/cloudnative-pg/cloudnative-pg/pull/10445)) <!-- 1.29 1.28 1.25 -->

- Fixed escaping of backslashes and control characters in PostgreSQL
  configuration values. Previously, such characters in parameters like
  `log_line_prefix` could corrupt the configuration file or be silently
  stripped at runtime.
  ([#10515](https://github.com/cloudnative-pg/cloudnative-pg/pull/10515)) <!-- 1.29 1.28 1.25 -->

- Fixed `restore_command` construction to shell-quote each argument. Values
  such as a `destinationPath` containing whitespace (for example,
  `s3://my bucket/wal`) were word-split by the POSIX shell and passed to the
  WAL restore tool as separate arguments.
  ([#10518](https://github.com/cloudnative-pg/cloudnative-pg/pull/10518)) <!-- 1.29 1.28 1.25 -->

- Tightened `recoveryTarget` validation in the admission webhook:
  `targetXID` must now be a non-negative 32-bit integer, and `targetName`
  must be shorter than 64 bytes and free of ASCII control characters.
  Malformed values are rejected at admission instead of failing later
  during PostgreSQL recovery.
  ([#10565](https://github.com/cloudnative-pg/cloudnative-pg/pull/10565)) <!-- 1.29 1.28 1.25 -->

- Fixed snapshot restores failing when leftover `pgsql_tmp*` directories were
  present in the data directory.
  ([#10447](https://github.com/cloudnative-pg/cloudnative-pg/pull/10447)) <!-- 1.29 1.28 1.25 -->

- Fixed a deadlock occurring when PVC storage size and resource requests are
  changed simultaneously.
  ([#10427](https://github.com/cloudnative-pg/cloudnative-pg/pull/10427)) <!-- 1.29 1.28 1.25 -->

## Version 1.28.2

**Release date:** Mar 31, 2026

### Important changes

- Updated the deprecation notice for native (in-tree) Barman Cloud support to
  reflect that it will now be removed in CloudNativePG 1.30.0, rather than
  1.29.0. Users are still encouraged to migrate to the Barman Cloud Plugin.
  ([#10167](https://github.com/cloudnative-pg/cloudnative-pg/pull/10167)) <!-- 1.28 1.27 -->

### Enhancements

- Improved the `Pooler` CRD with support for granular configuration of TLS
  cipher suites and minimum/maximum TLS versions. This enables administrators
  to meet strict security compliance requirements for pooler-to-client and
  pooler-to-server connections.
  Contributed by @alex1989hu.
  ([#9571](https://github.com/cloudnative-pg/cloudnative-pg/pull/9571)) <!-- 1.28 1.27 1.25 -->

- Improved the reliability of major upgrades by setting `BackoffLimit=0` on the
  upgrade job, preventing unnecessary retries of a failed `pg_upgrade`. The
  operator now automatically deletes the failed job when a user reverts the
  container image, allowing the cluster to restart gracefully on the original
  version.
  ([#10104](https://github.com/cloudnative-pg/cloudnative-pg/pull/10104),
  [#10298](https://github.com/cloudnative-pg/cloudnative-pg/pull/10298)) <!-- 1.28 1.27 -->

- Improved role management by verifying the instance is the primary before
  each reconciliation cycle, avoiding unnecessary reconciliation attempts and
  spurious error messages on read-only replicas.
  ([#9971](https://github.com/cloudnative-pg/cloudnative-pg/pull/9971)) <!-- 1.28 1.27 1.25 -->

- Extended the CRD schemas for `Cluster`, `ImageCatalog`, and
  `ClusterImageCatalog` to accept the `extensions`, `bin_path`, and `env`
  fields introduced in 1.29. The operator ignores these fields on older
  versions, but accepting them in the schema allows users to share a single
  manifest across clusters running different CNPG versions.
  ([#10131](https://github.com/cloudnative-pg/cloudnative-pg/pull/10131),
  [#10387](https://github.com/cloudnative-pg/cloudnative-pg/pull/10387)) <!-- 1.28 1.27 -->

- The operator now honors the `primaryUpdateMethod` when adding new PVCs to a
  cluster, ensuring that the rollout strategy (e.g., switchover vs. restart) is
  respected during storage expansion or additions.
  ([#9720](https://github.com/cloudnative-pg/cloudnative-pg/pull/9720)) <!-- 1.28 1.27 -->

- Refined the `alpha.cnpg.io/unrecoverable` annotation logic to allow it to
  function even on pods that have not yet reached the `Ready` state,
  facilitating the recovery of stuck instances.
  ([#9968](https://github.com/cloudnative-pg/cloudnative-pg/pull/9968)) <!-- 1.28 -->

### Security and Supply Chain

- **Security best practices integration**: integrated the OpenSSF baseline
  scanner and added a `SECURITY-INSIGHTS.yaml` file to the repository to align
  with industry-standard security reporting.
  ([#10054](https://github.com/cloudnative-pg/cloudnative-pg/pull/10054), <!-- 1.28 1.27 1.25 -->
  [#10062](https://github.com/cloudnative-pg/cloudnative-pg/pull/10062)) <!-- 1.28 1.27 1.25 -->

- **SLSA provenance and SBOMs**: added SLSA (Supply-chain Levels for Software
  Artifacts) provenance to release binaries and container images. Additionally,
  enabled Software Bill of Materials (SBOM) generation within the GoReleaser
  pipeline for improved dependency transparency.
  ([#10048](https://github.com/cloudnative-pg/cloudnative-pg/pull/10048), <!-- 1.28 1.27 1.25 -->
  [#10074](https://github.com/cloudnative-pg/cloudnative-pg/pull/10074)) <!-- 1.28 1.27 1.25 -->

- **Password leak prevention**: fixed a potential security risk where PostgreSQL
  could leak role passwords in the logs during specific reconciliation phases.
  ([#9950](https://github.com/cloudnative-pg/cloudnative-pg/pull/9950)) <!-- 1.28 1.27 1.25 -->

### Changes

- Updated the default PostgreSQL version to 18.3 (image `18.3-system-trixie`).
  ([#10090](https://github.com/cloudnative-pg/cloudnative-pg/pull/10090)) <!-- 1.28 1.27 1.25 -->

### Fixes

- Fixed a deadlock during operator upgrades affecting clusters using synchronous
  replication, where pods running the old and new operator
  versions computed different PostgreSQL configuration hashes, causing the
  uniformity check to block indefinitely and preventing both rolling updates
  and in-place upgrades from proceeding.
  ([#10342](https://github.com/cloudnative-pg/cloudnative-pg/pull/10342)) <!-- 1.28 -->

- Fixed an issue where fencing annotations could not be processed when the WAL
  disk was full, because the disk space check blocked the instance manager from
  starting. The check is now performed later in the lifecycle loop, after
  fencing is evaluated.
  ([#10302](https://github.com/cloudnative-pg/cloudnative-pg/pull/10302)) <!-- 1.28 1.27 -->

- Fixed an issue where replicas would get stuck in a `Pending` state if the
  `VolumeSnapshot` used for the initial bootstrap had been deleted. The
  operator now validates snapshot existence before use; if a snapshot is missing,
  it attempts to use the next available candidate or falls back to
  `pg_basebackup`.
  ([#10192](https://github.com/cloudnative-pg/cloudnative-pg/pull/10192)) <!-- 1.28 1.27 1.25 -->

- Prevented the "supervised primary" rollout strategy from consuming all
  available rollout slots, which previously caused delays in scheduled updates.
  Contributed by @ermakov-oleg.
  ([#9977](https://github.com/cloudnative-pg/cloudnative-pg/pull/9977)) <!-- 1.28 1.27 1.25 -->

- Fixed an issue where certain hot-standby parameter changes were not being
  correctly applied to replica clusters.
  ([#9952](https://github.com/cloudnative-pg/cloudnative-pg/pull/9952)) <!-- 1.28 1.27 1.25 -->

- Fixed a bug in the CNPG-I reconciler hook that could lead to skipping
  subsequent plugins when a "continue" result was returned.
  Contributed by @sharifmshaker.
  ([#9978](https://github.com/cloudnative-pg/cloudnative-pg/pull/9978)) <!-- 1.28 1.27 -->

- Fixed a deadlock scenario that occurred when attempting to resize a
  filesystem on a PVC that was not currently attached to a Pod.
  Contributed by @jmealo.
  ([#9981](https://github.com/cloudnative-pg/cloudnative-pg/pull/9981)) <!-- 1.28 1.27 -->

- Fixed webhook validation of bootstrap recovery sources to accept external
  clusters configured with `ConnectionParameters` (for `pg_basebackup`-based
  recovery). Previously, these were incorrectly rejected unless a Barman
  object store or CNPG-i plugin was also configured.
  ([#10268](https://github.com/cloudnative-pg/cloudnative-pg/pull/10268)) <!-- 1.28 1.27 1.25 -->

- Volume names for extensions and tablespaces are now prefixed to avoid naming
  collisions with standard cluster volumes.
  ([#9973](https://github.com/cloudnative-pg/cloudnative-pg/pull/9973)) <!-- 1.28 1.27 -->

- When hibernating a non-healthy cluster, the operator now reports a
  `WaitingForHealthy` condition, making the deferred hibernation state visible
  through `cnpg status`.
  ([#10193](https://github.com/cloudnative-pg/cloudnative-pg/pull/10193)) <!-- 1.28 1.27 1.25 -->

- Fixed fencing to work correctly even when the target pod does not exist.
  Fencing operates on a cluster-level annotation and should not depend on pod
  existence; instance name validation is now performed only in the `cnpg
  fencing on` command.
  ([#10035](https://github.com/cloudnative-pg/cloudnative-pg/pull/10035)) <!-- 1.28 1.27 1.25 -->

- Fixed the cluster and pooler service reconcilers to correctly handle changes
  to all spec fields when using the patch update strategy. The reconciler now
  uses RFC 7386 JSON Merge Patching, preventing cloud-provider-set fields
  (such as `loadBalancerClass`) from being inadvertently removed.
  ([#10190](https://github.com/cloudnative-pg/cloudnative-pg/pull/10190),
  [#10311](https://github.com/cloudnative-pg/cloudnative-pg/pull/10311)) <!-- 1.28 1.27 1.25 -->

- Fixed a race condition in the deprecated in-tree Barman Cloud backup
  implementation affecting parallel WAL restore, where prefetched files could
  be read while still being downloaded, causing PostgreSQL recovery to fail
  with "invalid checkpoint record" errors.
  ([#10285](https://github.com/cloudnative-pg/cloudnative-pg/pull/10285)) <!-- 1.28 1.27 1.25 -->

- Fixed the timeline history file validation to also apply to plugin-based WAL
  restore. Previously, the protection introduced in
  [#9650](https://github.com/cloudnative-pg/cloudnative-pg/pull/9650) only
  covered in-tree restores, allowing plugins to bypass the check and download
  future timeline history files, causing timeline mismatch errors on replicas.
  ([#9849](https://github.com/cloudnative-pg/cloudnative-pg/pull/9849)) <!-- 1.28 1.27 1.25 -->

- `cnpg` plugin:

    - The cnpg plugin now correctly propagates ImagePullSecrets to the
      `pgbench` Job pod template.
      ([#10174](https://github.com/cloudnative-pg/cloudnative-pg/pull/10174)) <!-- 1.28 1.27 1.25 -->

## Version 1.28.1

**Release date:** Feb 5, 2026

### Enhancements

- Added support for Azure's `DefaultAzureCredential` authentication mechanism
  for backup and recovery operations. This can be enabled by setting
  `azureCredentials.useDefaultAzureCredentials: true` in the backup
  configuration, simplifying authentication in Azure environments without
  requiring explicit storage account keys or SAS tokens.
  ([#9468](https://github.com/cloudnative-pg/cloudnative-pg/pull/9468)) <!-- 1.27 1.25 -->

### Fixes

- Fixed validation of PostgreSQL extension names containing underscores (e.g.,
  `pg_partman`, `pg_ivm`). Extension names with underscores are
  automatically sanitized to use hyphens for Kubernetes volume names while
  preserving the original name in mount paths. Webhook validation prevents
  naming conflicts after sanitization. Contributed by @shusaan.
  ([#9386](https://github.com/cloudnative-pg/cloudnative-pg/pull/9386)) <!-- 1.27 -->

- Fixed a critical issue where the `TimelineID` in the cluster status was not
  reset to 1 after a major version upgrade. Because `pg_upgrade` initializes a
  new timeline, keeping the old ID (e.g., timeline 2) caused replicas to attempt
  to restore incompatible history files from object storage, leading to fatal
  "requested timeline is not a child of this server's history" errors.
  ([#9830](https://github.com/cloudnative-pg/cloudnative-pg/pull/9830)) <!-- 1.27 -->

- Fixed an issue where stale TLS status fields in the `Pooler` were not cleared
  after being removed from the specification. This was particularly critical
  when upgrading to v1.28.0, where the `ServerTLS` field was repurposed, causing
  PgBouncer to use incorrect certificates and resulting in "unsupported
  certificate" errors that blocked all application connectivity.
  The operator now explicitly clears `ServerCA`, `ClientCA`, `ClientTLS`, and
  `ServerTLS` status fields when they are no longer configured.
  ([#9397](https://github.com/cloudnative-pg/cloudnative-pg/pull/9397))

- Fixed a bug where replicas could enter a crash-loop by attempting to download
  timeline history files from future timelines. This occurred when stale files
  remained in the WAL archive from a previous cluster life, and replicas would
  incorrectly try to fetch them during recovery.
  ([#9650](https://github.com/cloudnative-pg/cloudnative-pg/pull/9650)) <!-- 1.27 1.25 -->

- Fixed a race condition in `replica_cluster` setups during designated primary
  transitions, preventing transient "no primary" states in the replica cluster.
  ([#9601](https://github.com/cloudnative-pg/cloudnative-pg/pull/9601)) <!-- 1.27 1.25 -->

- The backup controller now uses the unique instance session ID to detect
  instance manager restarts. This prevents the operator from incorrectly
  assuming a backup is still progressing if the underlying container has crashed
  and restarted, which previously led to orphaned backup objects.
  ([#9370](https://github.com/cloudnative-pg/cloudnative-pg/pull/9370)) <!-- 1.27 -->

- Fixed a validation gap in Azure object store configurations where the
  `storageAccount` was not required when using explicit credentials (such as a
  storage key or SAS token). The operator now enforces that a storage account
  name is provided in these cases and that `connectionString` is mutually
  exclusive with other authentication parameters.
  ([#9604](https://github.com/cloudnative-pg/cloudnative-pg/pull/9604)) <!-- 1.27 1.25 -->

- Optimized the deletion path so the operator begins cleaning up resources
  immediately when a cluster is marked for deletion. This significantly reduces
  the time a cluster remains in `Terminating` status while waiting for internal
  reconciliation loops.
  ([#9555](https://github.com/cloudnative-pg/cloudnative-pg/pull/9555)) <!-- 1.27 1.25 -->

- Fixed an issue where replication slots were not properly dropped from
  replicas when the feature was disabled or the cluster was reconfigured.
  This ensures that unused slots do not cause WAL build-up on the primary.
  ([#9381](https://github.com/cloudnative-pg/cloudnative-pg/pull/9381)) <!-- 1.27 1.25 -->

- Fixed an issue where `imagePullSecrets` were not added to the `ServiceAccount`
  created for the `Pooler`. Previously, these secrets were applied to the
  Deployment but not the SA, which caused image pull failures in restricted
  environments using certain security policies.
  ([#9427](https://github.com/cloudnative-pg/cloudnative-pg/pull/9427)) <!-- 1.27 1.25 -->

- Added a check to verify ownership before the operator deletes a `PodMonitor`.
  This prevents the operator from accidentally deleting manually managed
  monitoring resources that happen to share a name with expected CNPG
  resources. Contributed by @juliamertz.
  ([#9340](https://github.com/cloudnative-pg/cloudnative-pg/pull/9340)) <!-- 1.27 1.25 -->

- Fixed a bug where `pg_stat_archiver` metrics would continue to report stale
  data on standby instances after a switchover. The exporter now skips these
  metrics on standbys, as PostgreSQL only provides valid archiver stats on the
  primary.
  ([#9411](https://github.com/cloudnative-pg/cloudnative-pg/pull/9411)) <!-- 1.27 1.25 -->

- Clarified the interpretation of timestamp formats for recovery `targetTime`.
  Timestamps provided without an explicit timezone are now consistently
  interpreted as UTC. Contributed by @pchovelon.
  ([#8937](https://github.com/cloudnative-pg/cloudnative-pg/pull/8937)) <!-- 1.27 1.25 -->

- Fixed backup status updates to prevent "resource has been modified" errors
  during concurrent updates.
  ([#9551](https://github.com/cloudnative-pg/cloudnative-pg/pull/9551)) <!-- 1.27 1.25 -->

- Fixed event reporting to use the correct pod name when a backup pod is not
  found.
  ([#9552](https://github.com/cloudnative-pg/cloudnative-pg/pull/9552)) <!-- 1.27 1.25 -->

- Improved performance of scheduled backup operations for clusters with a very
  high number of historical backups.
  ([#9489](https://github.com/cloudnative-pg/cloudnative-pg/pull/9489)) <!-- 1.27 1.25 -->

- Fixed error handling when removing finalizers on `Database` objects.
  ([#9431](https://github.com/cloudnative-pg/cloudnative-pg/pull/9431)) <!-- 1.27 1.25 -->

- `cnpg` plugin:

    - Updated the `status` command to display "Disabled" when the
      `skipWalArchiving` annotation is present on a cluster. This replaces
      confusing "starting up" or "unknown" states when WAL archiving is
      intentionally bypassed.
      ([#9709](https://github.com/cloudnative-pg/cloudnative-pg/pull/9709)) <!-- 1.27 1.25 -->

    - Fixed the `logs --follow` command to continue polling for new pods instead
      of exiting prematurely when all current log streams complete.
      ([#9599](https://github.com/cloudnative-pg/cloudnative-pg/pull/9599)) <!-- 1.27 1.25 -->

## Version 1.28.0

**Release date:** Dec 9, 2025

### Features

- **Quorum-Based Failover Promoted to Stable**: Promoted the quorum-based
  failover feature, introduced experimentally in 1.27.0, to a stable API.
  This data-driven failover mechanism is now configured via the
  `spec.postgresql.synchronous.failoverQuorum` field, graduating from the
  previous `alpha.cnpg.io/failoverQuorum` annotation.
  ([#8589](https://github.com/cloudnative-pg/cloudnative-pg/pull/8589))

- **Declarative Foreign Data Management**: Introduced comprehensive declarative
  management for Foreign Data Wrappers (FDW) by extending the `Database` CRD.
  This feature adds the `.spec.fdws` and `.spec.servers` fields, allowing you to
  manage FDW extensions and their corresponding foreign servers directly from the
  `Database` resource. This work was implemented by Ying Zhu (@EdwinaZhu) as part
  of the LFX Mentorship Program 2025 Term 2.
  ([#7942](https://github.com/cloudnative-pg/cloudnative-pg/pull/7942),
  [#8401](https://github.com/cloudnative-pg/cloudnative-pg/pull/8401))

### Changes

- Updated the default PostgreSQL version to `18.1-system-trixie`.
  ([#9178](https://github.com/cloudnative-pg/cloudnative-pg/pull/9178)) <!-- 1.27 1.26 1.25 -->

- Updated the default PgBouncer version to **1.25.1** for new `Pooler`
  deployments.
  ([#9367](https://github.com/cloudnative-pg/cloudnative-pg/pull/9367)) <!-- 1.27 1.26 1.25 -->

### Enhancements

- Enabled simultaneous image and configuration changes when using
  `primaryUpdateMethod: restart`, allowing you to update the container image
  (including PostgreSQL version or extensions) and PostgreSQL configuration
  settings in the same operation.
  Note that when using `primaryUpdateMethod: switchover`, image and
  configuration changes must still be performed separately to avoid configuration
  mismatches during the switchover process.
  ([#8241](https://github.com/cloudnative-pg/cloudnative-pg/pull/8241))

- Improved network failure detection for replica instances by setting the
  default `tcp_user_timeout` to 5 seconds. This change helps replicas detect
  and recover from silent network drops more quickly. Previously, replicas could
  wait up to 127 seconds before detecting such failures; with the new timeout,
  they reconnect to the primary within 5 seconds. To preserve the previous
  behavior, set `STANDBY_TCP_USER_TIMEOUT` to `0` in the operator configuration.
  ([#9317](https://github.com/cloudnative-pg/cloudnative-pg/pull/9317))

- Adopted standard Kubernetes recommended labels (e.g.,
  `app.kubernetes.io/name`) for all resources generated by CloudNativePG
  (Clusters, Backups, Poolers, etc.). Contributed by @JefeDavis.
  ([#8087](https://github.com/cloudnative-pg/cloudnative-pg/pull/8087))

- Introduced `securityContext` at the pod level and `containerSecurityContext`
  for individual containers (including `postgres`, `init`, and sidecars).
  This provides granular control over security settings, replacing the previous
  cluster-wide `postgres` and `operator` user settings. Contributed by @x0ddf.
  ([#6614](https://github.com/cloudnative-pg/cloudnative-pg/pull/6614))

- Introduced the `alpha.cnpg.io/unrecoverable=true` annotation for replica
  pods. When applied, this annotation instructs the operator to permanently
  delete the instance by removing its Pod and PVCs, after which it will recreate
  the replica from the primary.
  ([#8178](https://github.com/cloudnative-pg/cloudnative-pg/pull/8178))

- Introduced a new caching layer for user-defined monitoring queries to reduce
  load on the PostgreSQL database.
  ([#8003](https://github.com/cloudnative-pg/cloudnative-pg/pull/8003))

- Enhanced PgBouncer integration by automatically setting `auth_dbname` to the
  `pgbouncer` database, simplifying auth setup.
  ([#8671](https://github.com/cloudnative-pg/cloudnative-pg/pull/8671))

- Allowed providing stage-specific `pg_restore` options (`preRestore`,
  `postRestore`, `dataRestore`) during database import. Contributed by
  @hanshal101.
  ([#7690](https://github.com/cloudnative-pg/cloudnative-pg/pull/7690))

- Added the PostgreSQL `majorVersion` to the `Backup` object's status for
  easier identification and management.
  ([#8464](https://github.com/cloudnative-pg/cloudnative-pg/pull/8464)) <!-- 1.27 1.26 -->

- Enhanced cluster restore to wait for all init containers to complete before
  starting the restore process. This ensures that backup tools running in init
  containers finish preparing the data before the restore begins. The
  implementation correctly handles Kubernetes init container sidecars by
  ignoring those with `RestartPolicy=Always`.
  ([#9026](https://github.com/cloudnative-pg/cloudnative-pg/pull/9026))

- Added the `PGBOUNCER_IMAGE_NAME` operator configuration parameter to allow
  overriding the default PgBouncer image. This is useful for air-gapped
  environments or when using internal registries.
  ([#9232](https://github.com/cloudnative-pg/cloudnative-pg/pull/9232)) <!-- 1.27 1.26 1.25 -->

- `cnpg` plugin:

    - Added a `--timeout` flag to the `kubectl cnpg status` command for
      configuring the timeout for filesystem operations such as calculating
      cluster size. The default remains 10 seconds but can be adjusted for
      large clusters where operations may take longer.
      ([#9201](https://github.com/cloudnative-pg/cloudnative-pg/pull/9201)) <!-- 1.27 -->

    - Improved `cnpg report` to generate more shell-friendly file names.
      ([#8984](https://github.com/cloudnative-pg/cloudnative-pg/pull/8984)) <!-- 1.27 1.26 1.25 -->

### Security

- Allowed providing fine-grained custom TLS configurations for PgBouncer. The
  `Pooler` CRD was extended with `clientTLSSecret`, `clientCASecret`,
  `serverTLSSecret`, and `serverCASecret` fields under `.spec.pgbouncer`.
  These fields enable users to supply their own certificates for both
  client-to-pooler and pooler-to-server connections, taking precedence over the
  operator-generated certificates.
  ([#8692](https://github.com/cloudnative-pg/cloudnative-pg/pull/8692))

- Added optional TLS support for the operator's metrics server (port 8080).
  This feature is opt-in and enabled by setting the `METRICS_CERT_DIR`
  environment variable, which instructs the operator to look for `tls.crt` and
  `tls.key` files in the specified directory. When unset, the server continues to
  use HTTP for backward compatibility.
  ([#8997](https://github.com/cloudnative-pg/cloudnative-pg/pull/8997))

- Enabled `cnpg report operator` to work with minimal permissions by making
  only the operator deployment required. All other resources (pods, secrets,
  config maps, events, webhooks, and OLM data) are now optional and collected on
  a best-efforts basis. The command gracefully handles permission errors for
  those resources by logging clear warnings and continuing report generation with
  available data, rather than failing completely. This enables least-privileged
  access, where users may have limited, namespace-scoped permissions.
  ([#8982](https://github.com/cloudnative-pg/cloudnative-pg/pull/8982))

### Fixes

- Improved resilience of all probe types (liveness, readiness, and startup) to
  transient Kubernetes API server connectivity issues. Probes now use a caching
  mechanism that falls back to cached cluster definitions during brief network
  interruptions, preventing unnecessary pod restarts and probe failures.
  ([#9148](https://github.com/cloudnative-pg/cloudnative-pg/pull/9148)) <!-- 1.27 -->

- Fixed the `CheckEmptyWalArchive` safeguard to run correctly when restoring
  from a volume snapshot using CNPG-I backup/WAL plugins (e.g.,
  `plugin-barman-cloud`). Previously, this check was skipped for plugin-based
  implementations.
  ([#9306](https://github.com/cloudnative-pg/cloudnative-pg/pull/9306)) <!-- 1.27 1.26 1.25 -->

- Improved error reporting when ImageCatalog retrieval fails. The operator now
  emits a Warning event and logs errors for all failure types, not just
  `NotFound` errors, improving visibility into configuration issues.
  ([#9266](https://github.com/cloudnative-pg/cloudnative-pg/pull/9266)) <!-- 1.27 -->

- Fixed TLS certificate verification issues when connecting to CNPG-I plugins
  by adding the `cnpg.io/pluginServerName` annotation. This allows customizing
  the DNS name used for certificate verification in environments where the
  plugin's certificate uses a different DNS name than the Service name.
  ([#9222](https://github.com/cloudnative-pg/cloudnative-pg/pull/9222)) <!-- 1.27 1.26 1.25 -->

- Fixed an issue where the instance manager controller could fail to restart
  after an error, reporting a "controller already exists" message. The
  controller now uses `SkipNameValidation` for subsequent initialization
  attempts. Contributed by @mateusoliveira43.
  ([#9123](https://github.com/cloudnative-pg/cloudnative-pg/pull/9123)) <!-- 1.27 1.26 1.25 -->

- Fixed incorrect WAL restore path handling in plugins when the destination
  path is absolute, preventing path duplication issues. Contributed by
  @Endevir.
  ([#9093](https://github.com/cloudnative-pg/cloudnative-pg/pull/9093)) <!-- 1.27 1.26 1.25 -->

- Fixed the `CREATE PUBLICATION` SQL generation for multi-table publications to
  be backward-compatible with PostgreSQL 13+. The previously generated syntax
  was only valid for PostgreSQL 15+ and caused syntax errors on older versions.
  ([#8888](https://github.com/cloudnative-pg/cloudnative-pg/pull/8888)) <!-- 1.27 1.26 1.25 -->

- Fixed backup failures in complex pod definitions by reliably selecting the
  `postgres` container by name instead of by index. Contributed by @Joda89.
  ([#8964](https://github.com/cloudnative-pg/cloudnative-pg/pull/8964)) <!-- 1.27 1.26 1.25 -->

- `cnpg` plugin:

    - Fixed bugs in `cnpg report` log collection, especially when fetching previous
      logs. The collector now correctly fetches previous and current logs in
      separate requests and gracefully handles missing previous logs (e.g., on
      containers with no restart history), ensuring current logs are always
      collected.
      ([#8992](https://github.com/cloudnative-pg/cloudnative-pg/pull/8992)) <!-- 1.27 1.26 1.25 -->

### Supported versions

- Kubernetes 1.34, 1.33, and 1.32
- PostgreSQL 18, 17, 16, 15, and 14
    - PostgreSQL 18.1 is the default image
