docs: import CloudNativePG v1.30.0

Author: cnpg-bot

website/docusaurus.config.ts

@@ -6,7 +6,7 @@ import type * as Preset from '@docusaurus/preset-classic';
 
 const versionsConfig = require('./versions_config.json') as Record<string, import('@docusaurus/plugin-content-docs').VersionOptions>;
 
-const lastVersion = '1.29';
+const lastVersion = '1.30';
 
 const config: Config = {
   title: 'CloudNativePG',

website/versioned_docs/version-1.30/appendixes/object_stores.md

@@ -168,6 +168,26 @@ spec:
         [...]
 ```
 
+:::note
+Recent changes to the [boto3 implementation](https://github.com/boto/boto3/issues/4392)
+of [Amazon S3 Data Integrity Protections](https://docs.aws.amazon.com/sdkref/latest/guide/feature-dataintegrity.html)
+may lead to the `x-amz-content-sha256` error. If you encounter this issue, you
+can apply the following workaround by setting specific environment variables at
+the cluster level through `spec.env`:
+
+```yaml
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+[...]
+spec:
+  env:
+    - name: AWS_REQUEST_CHECKSUM_CALCULATION
+      value: when_required
+    - name: AWS_RESPONSE_CHECKSUM_VALIDATION
+      value: when_required
+```
+:::
+
 ### Using Object Storage with a private CA
 
 Suppose you configure an Object Storage provider which uses a certificate

website/versioned_docs/version-1.30/image_catalog.md

@@ -234,7 +234,7 @@ You can install all the available catalogs by using the `kustomization` file
 present in the `image-catalogs` directory:
 
 ```shell
-kubectl apply -k https://github.com/cloudnative-pg/artifacts//image-catalogs?ref=main
+kubectl apply -k 'https://github.com/cloudnative-pg/artifacts//image-catalogs?ref=main'
 ```
 
 You can then view all the catalogs deployed with:

website/versioned_docs/version-1.30/installation_upgrade.md

@@ -14,12 +14,12 @@ title: Installation and upgrades
 The operator can be installed like any other resource in Kubernetes,
 through a YAML manifest applied via `kubectl`.
 
-You can install the [latest operator manifest](https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.30.0-rc1.yaml)
+You can install the [latest operator manifest](https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.30/releases/cnpg-1.30.0.yaml)
 for this minor release as follows:
 
 ```sh
 kubectl apply --server-side -f \
-  https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.30.0-rc1.yaml
+  https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.30/releases/cnpg-1.30.0.yaml
 ```
 
 You can verify that with:
@@ -277,18 +277,20 @@ only the operator itself.
 
 These releases introduce changes worth reviewing before you upgrade. Two are
 security changes that apply to **1.30.0, 1.29.2, and 1.28.4**: operator-side
-password encoding and `search_path` hardening. The other three are new in
+password encoding (`CVE-2026-55765`) and `search_path` hardening
+(`CVE-2026-55769`). The other three are new in
 **1.30.0** only: the `DatabaseRole` resource for declarative role management,
 safe primary election via a per-cluster Lease, and operator-to-instance
-authentication on the instance manager's status port.
+authentication on the instance manager's status port (`GHSA-7qwx-x8ff-3px9`).
 In addition, if you are upgrading from a release **older than 1.29.1 or 1.28.3**,
 the metrics-exporter privilege separation from `CVE-2026-44477` also applies.
 Each is covered in its own subsection below.
 
-#### Operator-side password encoding
+#### Operator-side password encoding (`CVE-2026-55765`)
 
-Starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons,
-CloudNativePG SCRAM-SHA-256 encodes role passwords **operator-side**
+Starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons
+(`CVE-2026-55765` / `GHSA-w3gf-xc94-wvmj`), CloudNativePG SCRAM-SHA-256 encodes
+role passwords **operator-side**
 (client-side from PostgreSQL's point of view) before issuing
 `CREATE`/`ALTER ROLE` statements. As a result, the literal that reaches
 the PostgreSQL parser (and that extensions such as `pg_stat_statements`
@@ -328,10 +330,11 @@ according to its own `password_encryption` GUC.
 See ["Opting out of operator-side encoding"](declarative_role_management.md#opting-out-of-operator-side-encoding)
 for details.
 
-#### `search_path` hardening
+#### `search_path` hardening (`CVE-2026-55769`)
 
-Also starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons,
-CloudNativePG pins the `search_path` to a fixed `pg_catalog, public,
+Also starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons
+(`CVE-2026-55769` / `GHSA-x8c2-3p4r-v9r6`), CloudNativePG pins the `search_path`
+to a fixed `pg_catalog, public,
 pg_temp` on every connection it opens to PostgreSQL, so that a
 tenant-controlled `ALTER DATABASE`/`ALTER ROLE` setting can no longer
 influence how operator-issued queries resolve unqualified object names.
@@ -389,13 +392,16 @@ and `watch` verbs on `leases` in the `coordination.k8s.io` API group before
 upgrading, otherwise primaries will be unable to promote.
 :::
 
-#### Operator-to-instance authentication
+#### Operator-to-instance authentication (`GHSA-7qwx-x8ff-3px9`)
 
 Starting from version 1.30.0, the operator authenticates its calls to the
 sensitive endpoints of the instance manager's status port (backup,
 `pg_controldata`, partial WAL archive, and instance-manager upgrade) by pinning
 an in-memory client certificate. This is enabled automatically and requires no
-configuration. Status, health, and probe endpoints remain unauthenticated. See
+configuration. Status, health, and probe endpoints remain unauthenticated.
+This hardening is not backported; on releases earlier than 1.30.0, continue to
+restrict the status port (TCP 8000) with a `NetworkPolicy`, which remains its
+security boundary there. See
 [Operator-to-instance authentication](security.md#operator-to-instance-authentication)
 for details.
 

website/versioned_docs/version-1.30/kubectl-plugin.md

@@ -38,11 +38,11 @@ them in your systems.
 
 #### Debian packages
 
-For example, let's install the 1.30.0-rc1 release of the plugin, for an Intel based
+For example, let's install the 1.30.0 release of the plugin, for an Intel based
 64 bit server. First, we download the right `.deb` file.
 
 ```sh
-wget https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0-rc1/kubectl-cnpg_1.30.0-rc1_linux_x86_64.deb \
+wget https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0/kubectl-cnpg_1.30.0_linux_x86_64.deb \
   --output-document kube-plugin.deb
 ```
 
@@ -53,17 +53,17 @@ $ sudo dpkg -i kube-plugin.deb
 Selecting previously unselected package cnpg.
 (Reading database ... 6688 files and directories currently installed.)
 Preparing to unpack kube-plugin.deb ...
-Unpacking cnpg (1.30.0-rc1) ...
-Setting up cnpg (1.30.0-rc1) ...
+Unpacking cnpg (1.30.0) ...
+Setting up cnpg (1.30.0) ...
 ```
 
 #### RPM packages
 
-As in the example for `.rpm` packages, let's install the 1.30.0-rc1 release for an
+As in the example for `.rpm` packages, let's install the 1.30.0 release for an
 Intel 64 bit machine. Note the `--output` flag to provide a file name.
 
 ```sh
-curl -L https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0-rc1/kubectl-cnpg_1.30.0-rc1_linux_x86_64.rpm \
+curl -L https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0/kubectl-cnpg_1.30.0_linux_x86_64.rpm \
   --output kube-plugin.rpm
 ```
 
@@ -77,7 +77,7 @@ Dependencies resolved.
  Package            Architecture         Version                   Repository                  Size
 ====================================================================================================
 Installing:
- cnpg               x86_64               1.30.0-rc1-1                  @commandline                20 M
+ cnpg               x86_64               1.30.0-1                  @commandline                20 M
 
 Transaction Summary
 ====================================================================================================
@@ -306,9 +306,9 @@ sandbox-3  0/604DE38  0/604DE38  0/604DE38  0/604DE38   00:00:00   00:00:00   00
 Instances status
 Name       Current LSN  Replication role  Status  QoS         Manager Version  Node
 ----       -----------  ----------------  ------  ---         ---------------  ----
-sandbox-1  0/604DE38    Primary           OK      BestEffort  1.30.0-rc1           k8s-eu-worker
-sandbox-2  0/604DE38    Standby (async)   OK      BestEffort  1.30.0-rc1           k8s-eu-worker2
-sandbox-3  0/604DE38    Standby (async)   OK      BestEffort  1.30.0-rc1           k8s-eu-worker
+sandbox-1  0/604DE38    Primary           OK      BestEffort  1.30.0           k8s-eu-worker
+sandbox-2  0/604DE38    Standby (async)   OK      BestEffort  1.30.0           k8s-eu-worker2
+sandbox-3  0/604DE38    Standby (async)   OK      BestEffort  1.30.0           k8s-eu-worker
 ```
 
 If you require more detailed status information, use the `--verbose` option (or
@@ -362,9 +362,9 @@ sandbox-primary  primary  1              1                1
 Instances status
 Name       Current LSN  Replication role  Status  QoS         Manager Version  Node
 ----       -----------  ----------------  ------  ---         ---------------  ----
-sandbox-1  0/6053720    Primary           OK      BestEffort  1.30.0-rc1           k8s-eu-worker
-sandbox-2  0/6053720    Standby (async)   OK      BestEffort  1.30.0-rc1           k8s-eu-worker2
-sandbox-3  0/6053720    Standby (async)   OK      BestEffort  1.30.0-rc1           k8s-eu-worker
+sandbox-1  0/6053720    Primary           OK      BestEffort  1.30.0           k8s-eu-worker
+sandbox-2  0/6053720    Standby (async)   OK      BestEffort  1.30.0           k8s-eu-worker2
+sandbox-3  0/6053720    Standby (async)   OK      BestEffort  1.30.0           k8s-eu-worker
 ```
 
 With an additional `-v` (e.g. `kubectl cnpg status sandbox -v -v`), you can
@@ -640,12 +640,12 @@ Archive:  report_operator_<TIMESTAMP>.zip
 
 ```output
 ====== Beginning of Previous Log =====
-2023-03-28T12:56:41.251711811Z {"level":"info","ts":"2023-03-28T12:56:41Z","logger":"setup","msg":"Starting CloudNativePG Operator","version":"1.30.0-rc1","build":{"Version":"1.30.0-rc1+dev107","Commit":"cc9bab17","Date":"2023-03-28"}}
+2023-03-28T12:56:41.251711811Z {"level":"info","ts":"2023-03-28T12:56:41Z","logger":"setup","msg":"Starting CloudNativePG Operator","version":"1.30.0","build":{"Version":"1.30.0+dev107","Commit":"cc9bab17","Date":"2023-03-28"}}
 2023-03-28T12:56:41.251851909Z {"level":"info","ts":"2023-03-28T12:56:41Z","logger":"setup","msg":"Starting pprof HTTP server","addr":"0.0.0.0:6060"}
   <snipped …>
 
 ====== End of Previous Log =====
-2023-03-28T12:57:09.854306024Z {"level":"info","ts":"2023-03-28T12:57:09Z","logger":"setup","msg":"Starting CloudNativePG Operator","version":"1.30.0-rc1","build":{"Version":"1.30.0-rc1+dev107","Commit":"cc9bab17","Date":"2023-03-28"}}
+2023-03-28T12:57:09.854306024Z {"level":"info","ts":"2023-03-28T12:57:09Z","logger":"setup","msg":"Starting CloudNativePG Operator","version":"1.30.0","build":{"Version":"1.30.0+dev107","Commit":"cc9bab17","Date":"2023-03-28"}}
 2023-03-28T12:57:09.854363943Z {"level":"info","ts":"2023-03-28T12:57:09Z","logger":"setup","msg":"Starting pprof HTTP server","addr":"0.0.0.0:6060"}
 ```
 

website/versioned_docs/version-1.30/monitoring.md

@@ -1004,7 +1004,7 @@ metadata:
 spec:
   containers:
   - name: curl
-    image: curlimages/curl:8.17.0
+    image: curlimages/curl:8.21.0
     command: ['sleep', '3600']
 EOF
 ```

website/versioned_docs/version-1.30/operator_conf.md

@@ -68,6 +68,15 @@ Name | Description
 `STANDBY_TCP_USER_TIMEOUT` | Defines the [`TCP_USER_TIMEOUT` socket option](https://www.postgresql.org/docs/current/runtime-config-connection.html#GUC-TCP-USER-TIMEOUT) in milliseconds for replication connections from standby instances to the primary. Default is 5000 (5 seconds). Set to `0` to use the system's default.
 `WATCH_NAMESPACE` | Specifies the namespace(s) where the operator should watch for resources. Multiple namespaces can be specified separated by commas. If not set, the operator watches all namespaces (cluster-wide mode).
 
+:::warning
+    CloudNativePG does NOT currently support running multiple operators on
+    the same cluster. While this can be achieved through the use of namespaced
+    deployments using `ENABLE_WEBHOOK_NAMESPACE_SUFFIX` and `WATCH_NAMESPACE`,
+    multiple operators still use the same set of shared CRDs. We cannot
+    guarantee a backwards compatible upgrade across multiple concurrently
+    running operators.
+:::
+
 Values in `INHERITED_ANNOTATIONS` and `INHERITED_LABELS` support path-like wildcards. For example, the value `example.com/*` will match
 both the value `example.com/one` and `example.com/two`.
 
@@ -221,4 +230,4 @@ You can also access pprof using the browser at [http://localhost:6060/debug/ppro
     This is **not** the intended way to expose the feature in production.
     Treat pprof as a sensitive debugging interface and never expose it publicly.
     If you must access it remotely, secure it with proper network policies and access controls.
-:::
+:::

website/versioned_docs/version-1.30/preview_version.md

@@ -20,12 +20,16 @@ intended for public testing prior to the final release.
 
 ## Current Preview Version
 
-The current preview version is **1.30.0-rc1**.
+There are currently no preview versions available.
+
+<!--
+The current preview version is **1.31.0-rc1**.
 
 For more information on the current preview version and how to test, please view the links below:
 
-- [Announcement](https://cloudnative-pg.io/releases/cloudnative-pg-1-30.0-rc1-released/)
-- [Documentation](https://cloudnative-pg.io/docs/preview/)
+- [Announcement](https://cloudnative-pg.io/releases/cloudnative-pg-1-31.0-rc1-released/)
+- [Documentation](https://cloudnative-pg.io/docs/1.31/)
+-->
 
 ## Purpose of Release Candidates
 
@@ -73,7 +77,7 @@ non-production environment:
 - **Report Issues:** **Immediately report any issues or unexpected behavior**
   by opening a GitHub issue and clearly marking it with a **`Release
   Candidate`** tag or label, along with the RC version number
-  (e.g., `1.29.0-rc1`).
+  (e.g., `1.31.0-rc1`).
 
 ## Usage Advisory
 

website/versioned_docs/version-1.30/release_notes.md

@@ -9,16 +9,17 @@ title: Release notes
 
 History of user-visible changes for CloudNativePG, classified for each minor release.
 
-- [CloudNativePG 1.30 - Release Candidate](release_notes/v1.30.md) (preview)
+<!-- - [CloudNativePG 1.31 - Release Candidate](release_notes/v1.31.md) (preview) -->
+- [CloudNativePG 1.30](release_notes/v1.30.md)
 - [CloudNativePG 1.29](release_notes/v1.29.md)
-- [CloudNativePG 1.28](release_notes/v1.28.md)
 
 For information on the community support policy for CloudNativePG, please
 refer to ["Supported releases"](supported_releases.md).
 
 Older releases:
 
-- [CloudNativePG 1.27](release_notes/v1.27.md)
+- [CloudNativePG 1.28](release_notes/old/v1.28.md)
+- [CloudNativePG 1.27](release_notes/old/v1.27.md)
 - [CloudNativePG 1.26](release_notes/old/v1.26.md)
 - [CloudNativePG 1.25](release_notes/old/v1.25.md)
 - [CloudNativePG 1.24](release_notes/old/v1.24.md)

…docs/version-1.30/release_notes/v1.27.md …/version-1.30/release_notes/old/v1.27.mdwebsite/versioned_docs/version-1.30/release_notes/v1.27.md renamed to website/versioned_docs/version-1.30/release_notes/old/v1.27.md website/versioned_docs/version-1.30/release_notes/v1.27.md renamed to website/versioned_docs/version-1.30/release_notes/old/v1.27.md

@@ -506,8 +506,8 @@ on the release branch in GitHub.
 
 ### Important changes
 
-- The default behavior of the [liveness probe](../instance_manager.md#liveness-probe) has been updated.
-  An [isolated primary is now forcibly shut down](../instance_manager.md#primary-isolation)
+- The default behavior of the [liveness probe](../../instance_manager.md#liveness-probe) has been updated.
+  An [isolated primary is now forcibly shut down](../../instance_manager.md#primary-isolation)
   within the configured `livenessProbeTimeout` (default: 30 seconds).
 
 ### Features