| The raft consensus verdict of a group is now decided from the fullest view of the raft the operator can read, instead of whatever the first node to answer reported. Raft health is group-wide, so one reachable node is enough: a lagging, minority, just-restarted or unreachable node no longer keeps a recovered group stuck in a critical phase or blocks a node from joining. |
| A PGD group in a failed phase is now re-evaluated every 10 seconds rather than every 60, so a group that has already recovered stops reporting the failure sooner. |
| A change that rewrites the pod definition of a data node is now applied to one node at a time. CloudNativePG accepts a cluster change before it deletes the pod, and the operator read that short interval as "done" and moved on to the next node, taking two nodes down at once. The group reconciliation now waits until the rollout of the previous node is visible, so a rolling change takes longer but never overlaps. |
| A node added through a physical join now waits for a source node that is an active PGD member. On a freshly restored group the only candidate could still be in point-in-time recovery, and its promotion restart aborted the base backup mid-copy; every retry then failed on a tablespace directory that was no longer empty, leaving the joining node permanently stuck. |
| The physical join job now retries transient failures on its own, with a `BackoffLimit` of `3`, and is reported as `Failed` only once those retries are exhausted. See [Physical join](trouble_shooting/#physical-join) for what to do with a job that has failed. |
| The pods the operator manages for a group are now selected by their instance role. A completed initdb or physical-join job pod carries the same group and cluster labels and keeps its pod IP until it is cleaned up, so it could be picked instead of the instance pod, and the connection manager probe of that node pinned the group at `Waiting for Connection Manager to be ready`. |
| The output of `bdr_init_physical` is now streamed to the container log as it is produced, instead of being written to a file on the pod's ephemeral volume that was lost with the pod. Physical join failures can be diagnosed from the pod logs, including when the pod is killed. |
| A node is bootstrapped into a new group, or joined to an existing one, only once the raft of the parent group has a leader, has consensus, and has no other node mid-join. The join job verifies this on the join target itself, and the cross-location group bootstrap is guarded the same way, so the request reaches a node that can commit it. |
| The `manager group` subcommands — barman restore, join, remote join and group bootstrap — now write their logs and honor `--log-level` and `--log-destination`. |
| Deleting a region no longer stalls a physical join group. A node deleted while the operator was reconciling the group's nodes failed the whole reconcile, which then retried on the same missing node, and the group stopped making progress on its removal. Such a node is now skipped. |