EDB Postgres® AI for CloudNativePG™ Global Cluster 2.1.0 release notes v2.1.0

Released: 16 September 2026

Highlights

  • The connection manager (proxy) services now route only to data nodes that have joined the PGD group and are active members, so a node that is still joining or has no routing no longer receives client traffic. Once a node is a member, its pod readiness probe reports the connection manager's /connection/is-ready endpoint instead of Postgres readiness.
  • The operator no longer restarts a PGD node when the raft cannot spare a member. Both the parent raft and, for locally routed groups, the local subgroup raft must still reach quorum after losing one more member. Nodes that do not answer the raft or have not joined yet are not counted, and a held node does not block others in the same pass.
  • With the fix of CVE-2026-55769 in CloudNativePG 1.28.4 or later, search_path is now pinned to pg_catalog, public, pg_temp on every operator-issued connection. The PGD operator's mutation reconciler now scopes search_path to public for the duration of each PGDGroup mutation transaction, so unqualified CREATE statements in user-authored mutations continue to land in the intended schema instead of failing with a permission error.

Supported versions

  • Kubernetes: 1.34, 1.35, and 1.36
  • PostgreSQL: 18, 17, 16, 15, and 14
  • The tested PG4K version is v1.28.4
  • Update the default PGD image to PostgreSQL 18.6 and PGD 6.5.0 expanded (image postgresql-pgd:18.6-pgd650-expanded-ubi9)

This release of EDB Postgres® AI for CloudNativePG™ Global Cluster includes the following:

Features

Description
The operator log level can now be set from the operator's ConfigMap or Secret with the `OPERATOR_LOG_LEVEL` key, which overrides the log level configured in the operator deployment. Accepted values are `trace`, `debug`, `info`, `warn`, and `error`.
The labels and annotations of a `PGDGroup` are now inherited by the physical join job it creates, so the job is selected by the same label-based tooling — network policies, cost allocation, monitoring — as the rest of the group.
The group phase `Waiting for Connection Manager to be ready` now names the nodes whose connection manager is not live or not ready.

Security Fixes

Description
Bump the go version to v1.27.1
Bump grpc go module version to v1.83.2

Bug Fixes

Description
The raft consensus verdict of a group is now decided from the fullest view of the raft the operator can read, instead of whatever the first node to answer reported. Raft health is group-wide, so one reachable node is enough: a lagging, minority, just-restarted or unreachable node no longer keeps a recovered group stuck in a critical phase or blocks a node from joining.
A PGD group in a failed phase is now re-evaluated every 10 seconds rather than every 60, so a group that has already recovered stops reporting the failure sooner.
A change that rewrites the pod definition of a data node is now applied to one node at a time. CloudNativePG accepts a cluster change before it deletes the pod, and the operator read that short interval as "done" and moved on to the next node, taking two nodes down at once. The group reconciliation now waits until the rollout of the previous node is visible, so a rolling change takes longer but never overlaps.
A node added through a physical join now waits for a source node that is an active PGD member. On a freshly restored group the only candidate could still be in point-in-time recovery, and its promotion restart aborted the base backup mid-copy; every retry then failed on a tablespace directory that was no longer empty, leaving the joining node permanently stuck.
The physical join job now retries transient failures on its own, with a `BackoffLimit` of `3`, and is reported as `Failed` only once those retries are exhausted. See [Physical join](trouble_shooting/#physical-join) for what to do with a job that has failed.
The pods the operator manages for a group are now selected by their instance role. A completed initdb or physical-join job pod carries the same group and cluster labels and keeps its pod IP until it is cleaned up, so it could be picked instead of the instance pod, and the connection manager probe of that node pinned the group at `Waiting for Connection Manager to be ready`.
The output of `bdr_init_physical` is now streamed to the container log as it is produced, instead of being written to a file on the pod's ephemeral volume that was lost with the pod. Physical join failures can be diagnosed from the pod logs, including when the pod is killed.
A node is bootstrapped into a new group, or joined to an existing one, only once the raft of the parent group has a leader, has consensus, and has no other node mid-join. The join job verifies this on the join target itself, and the cross-location group bootstrap is guarded the same way, so the request reaches a node that can commit it.
The `manager group` subcommands — barman restore, join, remote join and group bootstrap — now write their logs and honor `--log-level` and `--log-destination`.
Deleting a region no longer stalls a physical join group. A node deleted while the operator was reconciling the group's nodes failed the whole reconcile, which then retried on the same missing node, and the group stopped making progress on its removal. Such a node is now skipped.