The operator was not announcing the TYPE_INSTANCE_SIDECAR_INJECTION
capability so the CNPG operator did not consider the plugin enabled
for instance pods. The instance manager never queried the plugin's
metrics endpoint, and the barman_cloud_cloudnative_pg_io_* metrics
were missing entirely.
This bug was masked when isWALArchiver was set to true in the plugin
configuration, because the backward compatibility code in CNPG would
mark the plugin as enabled as a side-effect. Users with isWALArchiver
set to false (or omitted) never saw the new metrics.
Closes#682
Signed-off-by: Kenny Root <kenny@the-b.org>
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.79.2` → `v1.79.3` |
|
|
### GitHub Vulnerability Alerts
####
[CVE-2026-33186](https://redirect.github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3)
### Impact
_What kind of vulnerability is it? Who is impacted?_
It is an **Authorization Bypass** resulting from **Improper Input
Validation** of the HTTP/2 `:path` pseudo-header.
The gRPC-Go server was too lenient in its routing logic, accepting
requests where the `:path` omitted the mandatory leading slash (e.g.,
`Service/Method` instead of `/Service/Method`). While the server
successfully routed these requests to the correct handler, authorization
interceptors (including the official `grpc/authz` package) evaluated the
raw, non-canonical path string. Consequently, "deny" rules defined using
canonical paths (starting with `/`) failed to match the incoming
request, allowing it to bypass the policy if a fallback "allow" rule was
present.
**Who is impacted?**
This affects gRPC-Go servers that meet both of the following criteria:
1. They use path-based authorization interceptors, such as the official
RBAC implementation in `google.golang.org/grpc/authz` or custom
interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`.
2. Their security policy contains specific "deny" rules for canonical
paths but allows other requests by default (a fallback "allow" rule).
The vulnerability is exploitable by an attacker who can send raw HTTP/2
frames with malformed `:path` headers directly to the gRPC server.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
Yes, the issue has been patched. The fix ensures that any request with a
`:path` that does not start with a leading slash is immediately rejected
with a `codes.Unimplemented` error, preventing it from reaching
authorization interceptors or handlers with a non-canonical path string.
Users should upgrade to the following versions (or newer):
* **v1.79.3**
* The latest **master** branch.
It is recommended that all users employing path-based authorization
(especially `grpc/authz`) upgrade as soon as the patch is available in a
tagged release.
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without
upgrading?_
While upgrading is the most secure and recommended path, users can
mitigate the vulnerability using one of the following methods:
#### 1. Use a Validating Interceptor (Recommended Mitigation)
Add an "outermost" interceptor to your server that validates the path
before any other authorization logic runs:
```go
func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
if info.FullMethod == "" || info.FullMethod[0] != '/' {
return nil, status.Errorf(codes.Unimplemented, "malformed method name")
}
return handler(ctx, req)
}
// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)
```
#### 2. Infrastructure-Level Normalization
If your gRPC server is behind a reverse proxy or load balancer (such as
Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to
enforce strict HTTP/2 compliance for pseudo-headers and reject or
normalize requests where the `:path` header does not start with a
leading slash.
#### 3. Policy Hardening
Switch to a "default deny" posture in your authorization policies
(explicitly listing all allowed paths and denying everything else) to
reduce the risk of bypasses via malformed inputs.
---
### Release Notes
<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>
###
[`v1.79.3`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.79.3):
Release 1.79.3
[Compare
Source](https://redirect.github.com/grpc/grpc-go/compare/v1.79.2...v1.79.3)
### Security
- server: fix an authorization bypass where malformed :path headers
(missing the leading slash) could bypass path-based restricted "deny"
rules in interceptors like `grpc/authz`. Any request with a
non-canonical path is now immediately rejected with an `Unimplemented`
error.
([#​8981](https://redirect.github.com/grpc/grpc-go/issues/8981))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update github.com/cloudnative-pg/barman-cloud from the pre-release pin
(ced266c) to the official v0.5.0 release.
This update fixes a race condition in parallel WAL restore where
prefetched files could be read while still being downloaded, causing
PostgreSQL recovery to fail with "invalid checkpoint record" errors. It
also fixes a misleading "missing Azure credentials" error message when
no object store credentials are defined at all.
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| commitlint | digest | `d6be835` → `9d731d1` |
| controller-gen | digest | `d6be835` → `9d731d1` |
| crd-gen-refs | digest | `d6be835` → `9d731d1` |
| spellcheck | digest | `d6be835` → `9d731d1` |
| uncommitted | digest | `d6be835` → `9d731d1` |
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
---------
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency
versions.
---
### Configuration
📅 **Schedule**: Branch creation - "before 4am on monday" (UTC),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Closes#777
Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| commitlint | digest | `a63b483` → `d6be835` |
| controller-gen | digest | `a63b483` → `d6be835` |
| crd-gen-refs | digest | `a63b483` → `d6be835` |
| spellcheck | digest | `a63b483` → `d6be835` |
| uncommitted | digest | `a63b483` → `d6be835` |
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| commitlint | digest | `7e6e09f` → `a63b483` |
| controller-gen | digest | `7e6e09f` → `a63b483` |
| crd-gen-refs | digest | `7e6e09f` → `a63b483` |
| spellcheck | digest | `7e6e09f` → `a63b483` |
| uncommitted | digest | `7e6e09f` → `a63b483` |
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
|
[golangci/golangci-lint](https://redirect.github.com/golangci/golangci-lint)
| patch | `v2.11.1` → `v2.11.2` |
---
### Release Notes
<details>
<summary>golangci/golangci-lint (golangci/golangci-lint)</summary>
###
[`v2.11.2`](https://redirect.github.com/golangci/golangci-lint/blob/HEAD/CHANGELOG.md#v2112)
[Compare
Source](https://redirect.github.com/golangci/golangci-lint/compare/v2.11.1...v2.11.2)
*Released on 2026-03-07*
1. Fixes
- `fmt`: fix error when using the `fmt` command with explicit paths.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency
versions.
---
### Configuration
📅 **Schedule**: Branch creation - "before 4am on monday" (UTC),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cloudnative-pg/plugin-barman-cloud).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwibm8taXNzdWUiXX0=-->
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Move `${{ }}` expressions from `run:` blocks into step-level `env:`
blocks, then reference them as properly-quoted shell variables.
Part of cloudnative-pg/cloudnative-pg#10113
Assisted-by: Claude Opus 4.6
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
The crd-ref-docs tool v0.3.0 started rendering `+optional` Go markers as
`Optional: {}` in API documentation's validation column. This appeared
as redundant empty JSON objects since the Required column already
conveyed this information. The PR updates the documentation template to
filter these markers while keeping meaningful validation rules like
patterns and enums, and removes unnecessary customMarkers configuration.
Closes#722
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Removed the mention of `s3UsePathStyle`, which has never been implemented.
For details, see #588
Signed-off-by: Andreas Lindhé <7773090+lindhe@users.noreply.github.com>
The barman-cloud plugin experienced significant performance degradation
and memory growth compared to the embedded solution. WAL archiving was
noticeably slower and memory consumption grew over time.
Root cause: The sidecar uses a read-only filesystem which prevents
Python from creating bytecode at runtime. When Python finds missing or
stale bytecode (.pyc files), it attempts to recompile on every
invocation, causing high CPU usage and memory consumption. The previous
approach pre-compiled bytecode in a separate base image, but the
bytecode was marked as stale when copied between Docker stages,
triggering runtime recompilation attempts.
This change eliminates bytecode staleness by ensuring all Python
bytecode is properly compiled in the final image before the sidecar
starts. The image is now fully distroless and based on trixie
(previously it was distroless-based but copied unnecessary files from
the build stage), reducing size from 463MB to 270MB and package count
from 188 to 35, while maintaining zero HIGH/CRITICAL vulnerabilities.
Closes#656Closes#711Closes#735
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
