EDB CloudNativePG Cluster 1.28.1 release notes v1.28.1

This can be enabled by settingazureCredentials.useDefaultAzureCredentials: true in the backup configuration, simplifying authentication in Azure environments without requiring explicit storage account keys or SAS tokens.

Extension names with underscores are automatically sanitized to use hyphens for Kubernetes volume names while preserving the original name in mount paths. Webhook validation prevents naming conflicts after sanitization. Contributed by @shusaan.

Because pg_upgrade initializes a new timeline, keeping the old ID (e.g., timeline 2) caused replicas to attempt to restore incompatible history files from object storage, leading to fatal "requested timeline is not a child of this server's history" errors.

This was particularly critical when upgrading to v1.28.0, where the ServerTLS field was repurposed, causing PgBouncer to use incorrect certificates and resulting in "unsupported certificate" errors that blocked all application connectivity. The operator now explicitly clears ServerCA, ClientCA, ClientTLS, andServerTLS status fields when they are no longer configured.

This occurred when stale files remained in the WAL archive from a previous cluster life, and replicas would incorrectly try to fetch them during recovery.

This prevents the operator from incorrectly assuming a backup is still progressing if the underlying container has crashed and restarted, which previously led to orphaned backup objects.

The operator now enforces that a storage account name is provided in these cases and that connectionString is mutually exclusive with other authentication parameters.

This significantly reduces the time a cluster remains in Terminating status while waiting for internal reconciliation loops.

This ensures that unused slots do not cause WAL build-up on the primary.

Previously, these secrets were applied to the Deployment but not the SA, which caused image pull failures in restricted environments using certain security policies.

This prevents the operator from accidentally deleting manually managed monitoring resources that happen to share a name with expected CNP resources. Contributed by @juliamertz.

The exporter now skips these metrics on standbys, as PostgreSQL only provides valid archiver stats on the primary.

Timestamps provided without an explicit timezone are now consistently interpreted as UTC. Contributed by @pchovelon.

This replaces confusing "starting up" or "unknown" states when WAL archiving is intentionally bypassed.