CloudNativePG 1.30 brings declarative Postgres roles and safer failover to Kubernetes

The CloudNativePG community has released version 1.30.0 of its PostgreSQL operator, the de facto standard for running production Postgres on Kubernetes. The headline feature is a new DatabaseRole custom resource that turns database roles into standalone Kubernetes objects with their own lifecycle and RBAC — a genuinely GitOps-friendly model where role definitions live beside the applications that own them, and the operator can even issue and renew TLS client certificates for password-free authentication. The second major addition is a Kubernetes Lease-based primary election: a promotion mutex that closes the window for uncoordinated primary promotion during failover transitions. The release also fixes two CVEs — a privilege-escalation flaw addressed by pinning search_path on operator connections, and cleartext password exposure now avoided by SCRAM-SHA-256 encoding before role commands — and adds authenticated operator-to-instance communication. Rounding it out: Kubernetes 1.36 support, PostgreSQL 18.4 as the new default, and in-place major upgrades for clusters using Image Volume extensions. With the 1.28.x series now end-of-life, teams running stateful Postgres on Kubernetes should plan their upgrade path — this release is a marker of how mature the cloud-native Postgres story has become.

This is a summary by our content curator. Read the original at PostgreSQL News: https://www.postgresql.org/about/news/cloudnativepg-1300-released-3337/.