---
id: v1.20
title: Release notes for CloudNativePG 1.20
---

# Release notes for CloudNativePG 1.20

History of user-visible changes in the 1.20 minor release of CloudNativePG.

For a complete list of changes, please refer to the
[commits](https://github.com/cloudnative-pg/cloudnative-pg/commits/release-1.20)
on the release branch in GitHub.

## Version 1.20.6

**Release date:** Feb 2, 2024

:::warning
    This is expected to be the last release in the 1.20.X series.
    Users are encouraged to update to a newer minor version soon.
:::

Enhancements:

- Tailor ephemeral volume storage in a Postgres cluster using a claim template
  through the `ephemeralVolumeSource` option (#3678)
- Introduce the `pgadmin4` command in the `cnpg` plugin for `kubectl`,
  providing a straightforward method to demonstrate connecting to a given
  database cluster and navigate its content in a local environment such as kind -
  for evaluation purposes only (#3701)
- Allow customization of PostgreSQL's ident map file via the
  `.spec.postgresql.pg_ident` stanza, through a list of user name maps (#3534)

Fixes:

- Prevent an unrecoverable issue with `pg_rewind` failing due to
  `postgresql.auto.conf` being read-only on clusters where the `ALTER SYSTEM`
  SQL command is disabled - the default (#3728)
- Reduce the risk of disk space shortage when using the import facility of the
  `initdb` bootstrap method, by disabling the durability settings in the PostgreSQL
  instance for the duration of the import process (#3743)
- Avoid pod restart due to erroneous resource quantity comparisons, e.g. "1 !=
  1000m"  (#3706)
- Properly escape reserved characters in `pgpass` connection fields (#3713)
- Prevent systematic rollout of pods due to considering zero and nil different
  values in `.spec.projectedVolumeTemplate.sources` (#3647)

## Version 1.20.5

**Release date:** Dec 21, 2023

Security:

- By default, TLSv1.3 is now enforced on all PostgreSQL 12 or higher
  installations. Additionally, users can configure the `ssl_ciphers`,
  `ssl_min_protocol_version`, and `ssl_max_protocol_version` GUCs (#3408).
- Integration of Docker image scanning with Dockle and Snyk to enhance security
  measures (#3300).

Enhancements:

- Improved reconciliation of external clusters (#3533).
- Introduction of the ability to enable/disable the `ALTER SYSTEM` command (#3535).
- Support for Prometheus' dynamic relabeling through the
  `podMonitorMetricRelabelings` and `podMonitorRelabelings` options in the
  `.spec.monitoring` stanza of the `Cluster` and `Pooler` resources (#3075).
- Elimination of the use of the `PGPASSFILE` environment variable when
  establishing a network connection to PostgreSQL (#3522).
- Improved `cnpg report` plugin command by collecting a cluster's PVCs (#3357).
- Enhancement of the `cnpg status` plugin command, providing information about
  managed roles, including alerts (#3310).
- Connection pooler:
    - Scaling down instances of a `Pooler` resource to 0 is now possible (#3517).
    - Addition of the `cnpg.io/podRole` label with a value of 'pooler' to every
      pooler deployment, differentiating them from instance pods (#3396).

Fixes:

- Reconciliation of metadata, annotations, and labels of `PodDisruptionBudget`
  resources (#3312 and #3434).
- Reconciliation of the metadata of the managed credential secrets (#3316).
- Resolution of a bug in the backup snapshot code where an error reading the
  body would be handled as an overall error, leaving the backup process
  indefinitely stuck (#3321).
- Implicit setting of online backup with the `cnpg backup` plugin command when
  either `immediate-checkpoint` or `wait-for-archive` options are requested (#3449).
- Disabling of wal_sender_timeout when joining through pg_basebackup (#3586)
- Reloading of secrets used by external clusters (#3565)
- Connection pooler:
    - Ensuring the controller watches all secrets owned by a `Pooler` resource (#3428).
    - Reconciliation of `RoleBinding` for `Pooler` resources (#3391).
    - Reconciliation of `imagePullSecret` for `Pooler` resources (#3389).
    - Reconciliation of the service of a `Pooler` and addition of the required labels (#3349).
    - Extension of `Pooler` labels to the deployment as well, not just the pods (#3350).

Changes:

- Default operand image set to PostgreSQL 16.1 (#3270).

## Version 1.20.4

**Release date:** Nov 3, 2023

Enhancements:

- Enhance the `status` command of the `cnpg` plugin for `kubectl` with progress
  information on active streaming base backups (#3101)
- Allow the configuration of `max_prepared_statements` with the pgBouncer
  `Pooler` resource (#3174)

Fixes:

- Suspend WAL archiving during a switchover and resume it when it is completed
  (#3227)
- Ensure that the instance manager always uses `synchronous_commit = local`
  when managing the PostgreSQL cluster (#3143)
- Custom certificates for streaming replication user through
  `.spec.certificates.replicationTLSSecret` are now working (#3209)
- Set the `cnpg.io/cluster` label to the `Pooler` pods (#3153)

Changes:

- Stop using the `postgresql.auto.conf` file inside PGDATA to control Postgres
  replication settings, and replace it with a file named `override.conf` (#2812)

Technical enhancements:

- Use extended query protocol for PostgreSQL in the instance manager (#3152)

## Version 1.20.3

**Release date:** Oct 11, 2023

Important Changes:

- Change the default value of `stopDelay` to 1800 seconds instead of 30 seconds
  (#2848)
- Introduce a new parameter, called `smartShutdownTimeout`, to control the
  window of time reserved for the smart shutdown of Postgres to complete; the
  general formula to compute the overall timeout to stop Postgres is
  `max(stopDelay -  smartShutdownTimeout, 30)` (#2848)
- Change the default value of `startDelay` to 3600, instead of 30 seconds
  (#2847)
- Replace the livenessProbe initial delay with a more proper Kubernetes
  startup probe to deal with the start of a Postgres server (#2847)
- Change the default value of `switchoverDelay` to 3600 seconds instead of
  40000000 seconds (#2846)
- Stop supporting the `postgresql` label - replaced by `cnpg.io/cluster` in
  1.18 (#2744)

Security:

- Add a default `seccompProfile` to the operator deployment (#2926)

Enhancements:

- Introduce the `cnpg.io/coredumpFilter` annotation to control the content of a
  core dump generated in the unlikely event of a PostgreSQL crash, by default
  set to exclude shared memory segments from the dump (#2733)
- Allow to configure ephemeral-storage limits for the shared memory and
  temporary data ephemeral volumes (#2830)
- Validate resource limits and requests through the webhook (#2663)
- Ensure that PostgreSQL's `shared_buffers` are coherent with the pods'
  allocated memory resources (#2840)
- Add `uri` and `jdbc-uri` fields in the credential secrets to facilitate
  developers when connecting their applications to the database (#2186)
- Add a new phase `Waiting for the instances to become active` for finer
  control of a cluster's state waiting for the replicas to be ready (#2612)
- Improve detection of Pod rollout conditions through the `podSpec` annotation
  (#2243)
- Add primary timestamp and uptime to the kubectl plugin’s `status` command
  (#2953)

Fixes:

- Ensure that the primary instance is always recreated first by prioritizing
  ready PVCs with a primary role (#2544)
- Honor the `cnpg.io/skipEmptyWalArchiveCheck` annotation during recovery to
  bypass the check for an empty WAL archive (#2731)
- Prevent a cluster from being stuck when the PostgreSQL server is down but the
  pod is up on the primary (#2966)
- Avoid treating the designated primary in a replica cluster as a regular HA
  replica when replication slots are enabled (#2960)
- Reconcile services every time the selectors change or when labels/annotations
  need to be changed (#2918)
- Defaults to `app` both the owner and database during recovery bootstrap
  (#2957)
- Avoid write-read concurrency on cached cluster (#2884)
- Remove empty items, make them unique and sort in the `ResourceName` sections
  of the generated roles (#2875)
- Ensure that the `ContinuousArchiving` condition is properly set to 'failed'
  in case of errors (#2625)
- Make the `Backup` resource reconciliation cycle more resilient on
  interruptions by stopping only if the backup is completed or failed (#2591)
- Reconcile PodMonitor `labels` and `annotations` (#2583)
- Fix backup failure due to missing RBAC `resourceNames` on the `Role` object
  (#2956)
- Observability:

    - Add TCP port label to default `pg_stat_replication` metric (#2961)
    - Fix the `pg_wal_stat` default metric for Prometheus (#2569)
    - Improve the `pg_replication` default metric for Prometheus (#2744 and
      #2750)
    - Use `alertInstanceLabelFilter` instead of `alertName` in the provided
      Grafana dashboard
    - Enforce `standard_conforming_strings` in metric collection (#2888)

Changes:

- Set the default operand image to PostgreSQL 16.0
- Fencing now uses PostgreSQL’s fast shutdown instead of smart shutdown to halt
  an instance (#3051)
- Rename webhooks from kb.io to cnpg.io group (#2851)
- Replace the `cnpg snapshot` command with `cnpg backup -m volumeSnapshot` for
  the `kubectl` plugin
- Let the `cnpg hibernate` plugin command use the
  `ClusterManifestAnnotationName` and `PgControldataAnnotationName` annotations
  on PVCs (#2657)
- Add the `cnpg.io/instanceRole` label while deprecating the existing `role`
  label (#2915)

Technical enhancements:

- Replace `k8s-api-docgen` with `gen-crd-api-reference-docs` to automatically
  build the API reference documentation (#2606)


## Version 1.20.2

**Release date:** July 27, 2023

Enhancements:

- New `logs` command in the kubectl plugin, to retrieve or follow the logs
  of all pods in a cluster (#2375)
- Add support for specifying priorityClassName in pods, helping Kubernetes
  make scheduling decisions (#2043)
- Add a metric and status field to monitor node usage by a CloudNativePG cluster (#2257)
- Various enhancements to the documentation:
    - Add troubleshooting instructions relating to hugepages (#1390)
    - Extend the FAQs page (#2344)

Technical enhancements:

- Add a check at the start of the restore process to ensure it can proceed; give
  improved error diagnostics if it cannot (#2419)
- Improve handling of non-expiring passwords in managed roles (#2334)

Fixes:

- Ensure the logic of setting the recovery target matches that of Postgres (#2460)
- Prevent taking over service accounts not owned by the cluster, by setting
  ownerMetadata only during service account creation (#2462)
- Ensure correct permissions of the PGDATA directory for initdb and restore (#2384)
- Prevent a possible crash of the instance manager during the configuration reload (#2393)
- Prevent the LastFailedArchiveTime alert from triggering if a new backup has been
  successful after the failed ones (#1751)
- Prevent services from targeting non-instance pods (#2336)

Security:

- Updated all project dependencies to the latest versions

## Version 1.20.1

**Release date:** June 12, 2023

Enhancements:

- Add the `snapshot` command to the `cnpg` plugin to create a consistent cold
  backup of the cluster from a standby using the Kubernetes `VolumeSnapshot`
  standard resource (#1960)
- First implementation of recovery from a set of CSI VolumeSnapshot resources
  via the `.spec.bootstrap.recovery.volumeSnapshot` stanza (#1960)
- Add `pg_failover_slots` to managed extensions (#2057)
- Improved Grafana dashboard with updated instructions in the documentation and
  the quickstart guide (#1916)
- Introduce the `schemaOnly` option in the `import` stanza, to avoid exporting
  and importing data when you bootstrap a new Postgres Cluster from one or more
  existing databases (#2234)
- Add support for TopologySpreadConstraints to manage scheduling of instance
  pods (#2202)
- Add `PodMonitor` support to the `Pooler`for PgBouncer (#2034)
- Add option to override the default Kubernetes scheduler (#2013)
- Allow configuration of deployment strategy of a `Pooler` resource (#1983)
- Update default PostgreSQL version to 15.3 (#2022)
- Use PgBouncer 1.19 by default (#2018)

Technical enhancements:

- Updated k8s kind tested versions (#2054)
- Declarative roles should ignore passwords if not set, easing management of
  previously existing roles  (#2029)
- Use separate transactions to reconcile role credentials. Before this patch,
  the operator would revert the synchronization of all roles if one failed
  (#2004)
- Ensure fencing is removed during cluster restore (#1987)
- Improve logging when deleting Pods (#2136)

Fixes:

- Fix unbound variable with k3s engine which could prevent setup on K3’s (#2157)
- Report the correct PG version in the metrics (#2126)
- Use the correct walStorage key in the documentation (#2140)
- Halt reconciliation when the operator cannot connect with the instances, and
  provide a clear diagnostic on such occasions. This will help clarify cases
  where network issues obstruct normal operation of CloudNativePG (#2145),
  (#2233), and (#2242)

## Version 1.20.0

**Release date:** April 27, 2023

:::info[Important changes from previous versions]
    CloudNativePG 1.20 introduces some changes to the default behavior of a
    few features for newly created `Cluster` resources, compared to previous
    versions of the operator. The goal of these changes is to improve the
    resilience of a Postgres cluster out of the box through convention over
    configuration. For clusters with one or more replicas:
    
      - Backup from standby is now enabled by default, unless `target` is
        explicitly set to `primary`
      - Restart of the primary is now the default method to complete the
        unsupervised rolling update procedure (`primaryUpdateMethod`
        defaults to `restart`, unless explicitly set to `switchover`)
    
    For further information, please refer to the "Installation and upgrades" section.
:::

Features:

- **Declarative role management:** introduce the `managed.roles` stanza in the
  `Cluster` spec to provide full lifecycle management of database roles, by
  providing an abstraction to the related DDL commands in PostgreSQL, such as
  `CREATE ROLE` and `ALTER ROLE` (#1524, #1793 and #1815)
- **Declarative hibernation of a PostgreSQL cluster:** introduce a new
  annotation called `cnpg.io/hibernation` to declaratively hibernate a
  PostgreSQL cluster by deleting all pods and keeping the PVCs only; the feature
  also implements the inverse procedure (#1657)

Enhancements:

- Improve the `--logs` option of the `report` command of the `cnpg` plugin for
  `kubectl` to also include the previous logs where available (#1811)
- The `-any` service is now disabled by default (#1755)

Security:

- Enable customization of `SeccompProfile` through override via a local file (#1827)

Fixes:

- Apply the PostgreSQL configuration provided by the user during the `initdb`
  bootstrap phase, before the server is started the first time (#1858)
