#Release Notes

#v4.3.4

#New and Optimized Features

• Security. The operator and its Spilo, pg-agent, RDS Operator, Pgpool-II, and PostgreSQL exporter images were rebuilt on patched bases and dependencies, and the Go toolchain, golang.org/x/net, and golang.org/x/text were updated. The v4.3.4 scan reported no High or Critical findings, down from 206 High in v4.3.3; total reported findings fell from 672 to 100. See security advisory ASA-2026:00280 for the full list of addressed CVEs.

#Fixed Issues

• A cluster demoted to standby could not rejoin its cross-cluster pair. After a planned cross-cluster switchover — patching a primary to a standby rather than deleting and recreating it — the demoted cluster kept replicating against the topology that existed before the switchover and never reached the newly promoted primary. Patroni retried against the <cluster>-xcr endpoint in a connect-timeout loop without reporting the cause, and because a standby cluster has no automatic reinitialization fallback, the cluster could remain stuck instead of recovering on its own. The operator now recognizes that the demoted cluster's local replication metadata predates the switchover — evaluating it against the configuration being applied rather than the one still running — and queries the peer cluster directly for the current topology when the local copy cannot be trusted, falling back to the local copy if the peer is unreachable. Spilo images ship with use_pg_rewind enabled, so where its prerequisites hold the demoted cluster can rejoin via pg_rewind instead of being deleted and recreated. Where use_pg_rewind has been explicitly disabled, Patroni cannot reinitialize a diverged standby cluster and the operator now logs that the cluster has to be re-created from its new primary by hand; other pg_rewind failures can still require manual recreation.

No issues in this release.

#Known Issues

• Logical backups require the backup image to be made available separately. Enabling enableLogicalBackup schedules a job that runs an image which is not included in the plugin package. Unless that image is separately mirrored or overridden, the job pod remains in ImagePullBackOff. Clusters that do not enable logical backups are unaffected.

No issues in this release.

#v4.3.3

#Fixed Issues

• PostgreSQL 16 clusters failed to start on amd64 nodes. The Spilo image shipped with v4.3.1 contained a bg_mon extension compiled against the wrong PostgreSQL major version on the amd64 architecture, causing PostgreSQL 16 instances to fail at startup with could not load library ".../16/lib/bg_mon.so": undefined symbol: pgstat_fetch_stat_beentry. The extension build now pins the target PostgreSQL version explicitly, and the fixed image has been verified across all supported PostgreSQL versions on both amd64 and arm64. arm64 clusters and other PostgreSQL versions were not affected. Affected v4.3.1 clusters recover by upgrading the plugin to v4.3.3.

• Fixed an issue where PostgreSQL 16 clusters failed to start on amd64 nodes with "could not load library bg_mon.so: undefined symbol: pgstat_fetch_stat_beentry". The bundled spilo image contained a bg_mon extension compiled against the wrong PostgreSQL major version on amd64. The extension build now pins PG_CONFIG per PostgreSQL major, and the fixed spilo build has been verified on all architecture/version combinations.

#Known Issues

No issues in this release.

#v4.3.1

#New and Optimized Features

• Security. Remediated multiple CVEs across all PostgreSQL operand images — the operator, Spilo, pg-agent, RDS Operator, Pgpool-II, and the PostgreSQL exporter were rebuilt on patched base images and dependencies. The bundled WAL-G binary was rebuilt with an updated jackc/pgx/v5 and Go toolchain to clear a critical CVE.
• In-place major upgrade fix. Fixed PostgreSQL major-version in-place upgrades (for example, 14 → 16) that failed immediately on the Patroni 3.3 line because of a removed get_global_config API. The upgrade pre-flight now uses the current Patroni global-config API.
• RBAC project-admin aggregation. PostgreSQL user-facing roles now aggregate to the platform project-admin, cluster-admin, and platform-admin roles, so project administrators can manage postgresqls, postgresbackups, and postgresrestores in their namespaces.

#Fixed Issues

No issues in this release.

#Known Issues

No issues in this release.

#v4.3.0

#New and Optimized Features

• RBAC least-privilege and role segregation. The operator no longer manages cluster-level RBAC resources, and deletecollection has been removed from all resource rules. Five new user-facing aggregated roles are introduced — admin, edit, view, backup, and restore — enabling segregation of duties. The SkipRuntimeRBACCreation configuration option was removed; the operator now always provisions the namespace-scoped ServiceAccount and RoleBinding at runtime. See RBAC Architecture and Assign PostgreSQL RBAC Roles for details.
• Cross-Cluster Replication (XCR) stability. Added statement_timeout to XCR connections and silenced spurious error logging. Guarded XCR metadata writes when no sync replica is ready and cleaned up orphaned replication slots when standby clusters scale down. Removed aggressive slot removal from BeforeClusterSync that could disrupt healthy replicas, and eliminated unnecessary local-DB connection attempts in preReconcile for LoadBalancer-based standby clusters.
• Reliability fixes.
  • waitForPodDeletion now polls the Kubernetes API in addition to the informer channel, eliminating 10-minute worker stalls caused by missed Delete events (observed on IPv6 / kube-ovn clusters).
  • Patroni status updates during cluster lifecycle are now non-fatal — transient Patroni API errors are logged as warnings and no longer drive the cluster to SyncFailed / AddFailed. Also fixed a defer-variable-capture bug where the Patroni error leaked into the enclosing deferred status-setting closure.
  • Fixed empty external-IP issue when a LoadBalancer Service is used for replication.
  • Fixed restore errors and CSV generation issues.
• Build and security.
  • Renovate is integrated across release branches for automated dependency management.
  • Go toolchain bumped to v1.26; upstream Zalando components (operator, operator-ui, logical-backup) updated to v1.15.0; Spilo rebuilt with the latest security fixes.
  • Batch Go-module security patches across golang.org/x/crypto, golang.org/x/net, logrus, requests, and related dependencies.

#Fixed Issues

No issues in this release.

#Known Issues

No issues in this release.

#v4.2.0

#New and Optimized Features

• Supported deploying a Postgres instance in PSA-restricted mode.
• Supported using the Load Balancer Service type for hot standby cluster replication.
• Fixed multiple CVEs.
• Removed PostgreSQL 11 and 12 support.

#Fixed Issues

No issues in this release.

#Known Issues

No issues in this release.