Release 4.3 - #28
Open
SuJinpei wants to merge 9 commits into
Open
Conversation
- Add v4.3.0 release notes: PG 17 support, RBAC least-privilege, XCR stability, reliability fixes, build/security hardening - Add JIRA query templates for v4.3.0 fixed/known issues in doom.config.yml - Bump sites.yaml published version to 4.3 - Extend upgrade.mdx compatibility matrix to PG 13-17 for v4.3.x - Add how_to/assign_postgres_rbac.mdx with RoleBinding examples for the five user-facing aggregated roles - Update PG version references in intro, functions, and how_to to include PG 13-17 (PG 12 is end-of-life) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
PostgreSQL 17 support is not fully tested for v4.3.0 yet. Remove PG 17 references from release notes, intro, create-instance, backup/restore, HA cluster, and upgrade compatibility matrix. Restore the lifecycle policy page (present on release-4.2, missing on release-4.3) and add the v4.3.x row.
WalkthroughThis PR updates the PostgreSQL operator documentation, tooling, and configuration for the v4.3.0 release. Changes include updating dependency versions (Yarn, TypeScript, Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
docs/en/release_notes.mdx (1)
14-14: Document the breaking change from removingSkipRuntimeRBACCreation.The removal of the
SkipRuntimeRBACCreationconfiguration option is a breaking change. Users who previously relied on this option to disable runtime RBAC provisioning will be affected. Consider adding a migration note or upgrade caveat to help users prepare for this change.📋 Suggested addition to document the breaking change
Add a "Breaking Changes" subsection before "New and Optimized Features":
### Breaking Changes - **`SkipRuntimeRBACCreation` removed**: The operator now always provisions namespace-scoped `ServiceAccount` and `RoleBinding` resources at runtime. If you previously set `SkipRuntimeRBACCreation: true`, remove this configuration before upgrading. The operator will automatically create the required RBAC resources in each namespace where PostgreSQL CRs are deployed.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/en/release_notes.mdx` at line 14, The release notes fail to document the breaking change caused by removing the SkipRuntimeRBACCreation option; update docs/en/release_notes.mdx to add a "Breaking Changes" subsection (placed before the "New and Optimized Features" section) that explicitly names SkipRuntimeRBACCreation as removed, instructs users to remove any SkipRuntimeRBACCreation: true setting before upgrading, and states that the operator will now always create namespace-scoped ServiceAccount and RoleBinding resources at runtime (reference RBAC Architecture and Assign PostgreSQL RBAC Roles for more details).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/en/functions/15_back_restore.mdx`:
- Line 150: Update the PostgreSQL version example to include version 13 for
consistency with the compatibility matrix and other docs; locate the line
containing the text "Choose PostgreSQL Version (e.g., 14, 15, 16)" and change it
to include 13 (e.g., "13, 14, 15, 16") or, if 13 is intentionally unsupported,
add a brief note next to that string explaining why 13 is excluded.
In `@docs/en/upgrade.mdx`:
- Line 13: The warning on "PostgreSQL 11 and 12 have been removed. Please
upgrade to PostgreSQL 14, 15 or 16..." conflicts with the compatibility matrix
that lists "13, 14, 15, 16" for v4.3.x; reconcile them by either adding "13" to
the upgrade warning text or removing "13" from the compatibility matrix entry so
both match; update the exact strings in the doc (the warning sentence and the
compatibility matrix row for v4.3.x) so they state the same allowed PostgreSQL
versions.
---
Nitpick comments:
In `@docs/en/release_notes.mdx`:
- Line 14: The release notes fail to document the breaking change caused by
removing the SkipRuntimeRBACCreation option; update docs/en/release_notes.mdx to
add a "Breaking Changes" subsection (placed before the "New and Optimized
Features" section) that explicitly names SkipRuntimeRBACCreation as removed,
instructs users to remove any SkipRuntimeRBACCreation: true setting before
upgrading, and states that the operator will now always create namespace-scoped
ServiceAccount and RoleBinding resources at runtime (reference RBAC Architecture
and Assign PostgreSQL RBAC Roles for more details).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b000a81c-9761-4328-939a-6e88c92f258a
⛔ Files ignored due to path filters (3)
.yarn/releases/yarn-4.14.1.cjsis excluded by!**/.yarn/**.yarn/releases/yarn-4.9.2.cjsis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (13)
.yarnrc.ymldocs/en/architecture.mdxdocs/en/functions/01_create_instance.mdxdocs/en/functions/15_back_restore.mdxdocs/en/how_to/assign_postgres_rbac.mdxdocs/en/how_to/configure_ha_cluster.mdxdocs/en/intro.mdxdocs/en/lifecycle_policy.mdxdocs/en/release_notes.mdxdocs/en/upgrade.mdxdoom.config.ymlpackage.jsonsites.yaml
| - Enter Display Name | ||
| - Select Deploy Location | ||
| - Choose PostgreSQL Version (e.g., 14, 16). | ||
| - Choose PostgreSQL Version (e.g., 14, 15, 16). |
There was a problem hiding this comment.
Inconsistent version list: PostgreSQL 13 is missing.
The example lists PostgreSQL versions "14, 15, 16" but excludes version 13. However, the v4.3.x Compatibility Matrix and other documentation pages (docs/en/intro.mdx, docs/en/functions/01_create_instance.mdx, docs/en/how_to/configure_ha_cluster.mdx) clearly state that PostgreSQL versions 13, 14, 15, and 16 are supported.
If version 13 is supported for restore operations, it should be included in this list for consistency. If there's a specific reason version 13 is not supported for restore, this should be documented.
📝 Suggested fix to include version 13
- - Choose PostgreSQL Version (e.g., 14, 15, 16).
+ - Choose PostgreSQL Version (e.g., 13, 14, 15, 16).📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - Choose PostgreSQL Version (e.g., 14, 15, 16). | |
| - Choose PostgreSQL Version (e.g., 13, 14, 15, 16). |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docs/en/functions/15_back_restore.mdx` at line 150, Update the PostgreSQL
version example to include version 13 for consistency with the compatibility
matrix and other docs; locate the line containing the text "Choose PostgreSQL
Version (e.g., 14, 15, 16)" and change it to include 13 (e.g., "13, 14, 15, 16")
or, if 13 is intentionally unsupported, add a brief note next to that string
explaining why 13 is excluded.
|
|
||
| :::warning | ||
| PostgreSQL 11 and 12 have been removed. Please upgrade to PostgreSQL 14 or 16 before upgrading Alauda support for PostgreSQL to v4.2.0. | ||
| PostgreSQL 11 and 12 have been removed. Please upgrade to PostgreSQL 14, 15 or 16 before upgrading Alauda support for PostgreSQL to v4.3.0. |
There was a problem hiding this comment.
Inconsistency between warning and compatibility matrix.
Line 13 instructs users to "upgrade to PostgreSQL 14, 15 or 16," but the compatibility matrix at line 20 shows v4.3.x supports PostgreSQL versions "13, 14, 15, 16" (including version 13).
If PostgreSQL 13 is supported in v4.3.0, the warning should mention it. If PostgreSQL 13 is intentionally excluded, the compatibility matrix should be corrected.
📝 Proposed fix to align the warning with the compatibility matrix
-PostgreSQL 11 and 12 have been removed. Please upgrade to PostgreSQL 14, 15 or 16 before upgrading Alauda support for PostgreSQL to v4.3.0.
+PostgreSQL 11 and 12 have been removed. Please upgrade to PostgreSQL 13, 14, 15 or 16 before upgrading Alauda support for PostgreSQL to v4.3.0.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| PostgreSQL 11 and 12 have been removed. Please upgrade to PostgreSQL 14, 15 or 16 before upgrading Alauda support for PostgreSQL to v4.3.0. | |
| PostgreSQL 11 and 12 have been removed. Please upgrade to PostgreSQL 13, 14, 15 or 16 before upgrading Alauda support for PostgreSQL to v4.3.0. |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docs/en/upgrade.mdx` at line 13, The warning on "PostgreSQL 11 and 12 have
been removed. Please upgrade to PostgreSQL 14, 15 or 16..." conflicts with the
compatibility matrix that lists "13, 14, 15, 16" for v4.3.x; reconcile them by
either adding "13" to the upgrade warning text or removing "13" from the
compatibility matrix entry so both match; update the exact strings in the doc
(the warning sentence and the compatibility matrix row for v4.3.x) so they state
the same allowed PostgreSQL versions.
Deploying alauda-postgresql with
|
| Latest commit: |
ff842e0
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://adb0e183.alauda-postgresql.pages.dev |
| Branch Preview URL: | https://release-4-3.alauda-postgresql.pages.dev |
- doom.config.yml: add mw-pg-v4.3.1-fixed / -known release-note query templates (fixVersion = PG-v4.3.1). - release_notes.mdx: add v4.3.1 section — security/CVE remediation across operand images (incl. WAL-G pgx rebuild), Patroni 3.3 in-place major-upgrade fix, and RBAC project-admin role aggregation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(release-notes): add v4.3.1 release notes
…-4.3 Auto-update doc build config
* docs: v4.3.2 release notes — amd64 PG16 bg_mon startup fix (MIDDLEWARE-32461) * docs: v4.3.2 -> v4.3.3 (v4.3.2 burned in release engineering, never shipped) --------- Co-authored-by: Jinpei Su <jpsu@alauda.io>
…38) * docs: v4.3.4 release notes — XCR demotion recovery + CVE remediation Adds the v4.3.4 section: the cross-cluster switchover fix (a cluster demoted to standby could not rejoin its pair without delete-and-recreate) and the operand CVE remediation (672 findings -> 100, no High/Critical remaining). Also defines the mw-pg-v4.3.3-fixed / -known query templates, which release_notes.mdx has referenced since v4.3.3 shipped but doom.config.yml never defined. All four new templates use versionMatch("PG-vX.Y.Z") rather than a literal fixVersion: PG-v4.3.4 does not exist in JIRA yet, and a literal reference fails the docs build with HTTP 400 "does not exist for the field fixVersion". Verified against JIRA — versionMatch returns total=0 for the missing version without erroring, and total=1 for PG-v4.3.3. doom lint docs: 0 errors, 0 warnings. * docs: cite the published advisory ASA-2026:00280 in the v4.3.4 security note * docs: correct the v4.3.4 rewind claim and scope the security wording Independent review (Codex) found two ship-blocking inaccuracies; both verified against v4.3.4 source before changing the text. 1. The rewind warning. The notes said the operator warns "when a demotion can never rewind because both wal_log_hints and data checksums are disabled". pkg/repl/rewind.go does not and cannot do that: data checksums live in pg_controldata and are not visible there, so the code deliberately treats wal_log_hints alone as inconclusive and stays quiet. It warns only when Patroni reports use_pg_rewind=false. The closing sentence was also unconditional -- "deleting and recreating is no longer required" -- while the warning the code emits says the cluster "will need to be re-created from it by hand". Both now match shipped behaviour. 2. Security scope. "All PostgreSQL operand images were rebuilt" was false: the logical-backup image was not in this set. The rebuilt images are now named. 672 and 100 are scan finding rows, not unique vulnerabilities, so they are described as reported findings, and the zero High/Critical statement is scoped to what the v4.3.4 scan reported. Also softened the logical-backup known issue: the image can be mirrored or overridden separately, so the failure is conditional rather than categorical. doom lint docs: 0 errors, 0 warnings. * docs: bound the v4.3.4 rejoin claim to what the code guarantees Second independent review (Codex) on the previous fix commit: my correction overcorrected into a new set of claims the source does not support. 1. "resolves peer information from the peer cluster" was too absolute. resolvePeerClusterInfo PREFERS the local copy and returns it directly when it is current and usable (pkg/repl/repl.go:555-604); it queries the peer only when the local copy errored, is stale, or cannot address the channel, and falls back to the local copy when the peer is unreachable. 2. Enabling the pg_rewind path is not a guarantee of rejoin. The text now says the cluster can rejoin via pg_rewind where its prerequisites hold, and states that other pg_rewind failures can still require manual recreation. 3. "the default" was unattributed. use_pg_rewind: true, wal_log_hints: on and initdb data-checksums are set by the SPILO image template (spilo v4.3.3 configure_spilo.py:200-206, 256-259), not guaranteed by the operator, so the sentence now attributes it to Spilo. The staleness half of the sentence was verified accurate and is unchanged: peerClusterInfoFromLocalDB compares against specOrRunning(c, pgSpec) precisely because BeforeClusterUpdate runs before the new spec is installed (pkg/repl/repl.go:498-520). doom lint docs: 0 errors, 0 warnings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Documentation
Chores