EDB Postgres® AI for CloudNativePG™ Global Cluster 2.2.0 release notes v2.2.0

Released: 15 October 2026

Highlights

  • The operator now hands the write and Raft leaderships of a PGD node off before its pod is evicted, for example by kubectl drain. The eviction is rejected with 429 Too Many Requests, which the drain retries, while another pod of the PGD group is unavailable or the hand-off runs. The hand-off is bounded by the Raft election timeouts of the node, 160 seconds with the defaults; one that can't finish in that time admits the eviction with a warning. See Eviction held, drain retrying.
  • The operator deployment now runs two replicas, with a PodDisruptionBudget of maxUnavailable: 1 and a soft pod anti-affinity that spreads them over different nodes, so a webhook endpoint stays up while a node drains. Every replica serves the webhooks; the controllers run on the leader.

Upgrade notes

  • The PodDisruptionBudget of a PGD group now selects the pods of the group by the k8s.enterprisedb.io/podRole: instance label, which a pod has from its creation, instead of the k8s.enterprisedb.io/instanceRole label, which CNP sets once the instance runs. A recreated pod is now covered by the budget until it's Ready. The operator patches the budget of existing groups after the upgrade.
  • The webhook server accepts any client on port 9443, and the pod eviction webhook has side effects: any workload that reaches that port on the operator pods can send forged eviction reviews. Restrict ingress to that port with a NetworkPolicy, see Webhooks.

Supported versions

  • Kubernetes: 1.34, 1.35, 1.36, and 1.37
  • PostgreSQL: 18, 17, 16, 15, and 14
  • The tested PG4K version is v1.28.5

This release of EDB Postgres® AI for CloudNativePG™ Global Cluster includes the following:

Features

Description
The common name of the node server certificates can now use a different domain than the one the nodes connect to, by setting spec.connectivity.tls.serverCert.commonNameDomain. This helps when a certificate authority requires a specific domain in the common name. See Common name domain.

Security Fixes

Description
Bump the go version to v1.27.2
Bump golang.org/x/crypto to v0.57.0
Bump golang.org/x/net to v0.60.0
Bump golang.org/x/mod to v0.41.0