From 64d96cd34d991a4af2ef8bbe21610231c3e25882 Mon Sep 17 00:00:00 2001 From: Siva Date: Fri, 24 Jul 2026 20:54:42 +0530 Subject: [PATCH 1/6] build(release): bump version to v0.10.0 --- .circleci/config.yml | 22 ++++++++------ CHANGELOG.md | 29 +++++++++++++++++++ api/apiv1/gen/control_plane/service.go | 2 +- api/apiv1/gen/http/openapi.json | 2 +- api/apiv1/gen/http/openapi.yaml | 2 +- api/apiv1/gen/http/openapi3.json | 2 +- api/apiv1/gen/http/openapi3.yaml | 2 +- api/version.txt | 2 +- changes/unreleased/Added-20260625-000000.yaml | 3 -- changes/unreleased/Added-20260701-000000.yaml | 3 -- changes/unreleased/Added-20260701-000001.yaml | 3 -- changes/unreleased/Added-20260707-000000.yaml | 3 -- changes/unreleased/Added-20260707-000001.yaml | 3 -- changes/unreleased/Added-20260713-000000.yaml | 3 -- changes/unreleased/Added-20260723-000000.yaml | 3 -- changes/unreleased/Added-20260724-000000.yaml | 3 -- .../unreleased/Changed-20260706-204431.yaml | 3 -- changes/unreleased/Fixed-20260706-000000.yaml | 3 -- changes/unreleased/Fixed-20260708-000000.yaml | 3 -- changes/unreleased/Fixed-20260715-000001.yaml | 3 -- changes/unreleased/Fixed-20260716-000000.yaml | 3 -- .../unreleased/Security-20260717-040124.yaml | 3 -- .../unreleased/Security-20260721-000000.yaml | 3 -- changes/v0.10.0.md | 28 ++++++++++++++++++ docs/api/openapi.md | 8 ++--- docs/api/reference.md | 2 +- docs/changelog.md | 29 +++++++++++++++++++ docs/development/e2e-tests.md | 2 +- docs/installation/mtls.md | 8 ++--- docs/installation/swarm-installation.md | 12 ++++---- docs/installation/swarm-upgrading.md | 4 +-- docs/installation/systemd-installation.md | 4 +-- docs/installation/systemd-upgrading.md | 4 +-- 33 files changed, 127 insertions(+), 82 deletions(-) delete mode 100644 changes/unreleased/Added-20260625-000000.yaml delete mode 100644 changes/unreleased/Added-20260701-000000.yaml delete mode 100644 changes/unreleased/Added-20260701-000001.yaml delete mode 100644 changes/unreleased/Added-20260707-000000.yaml delete mode 100644 changes/unreleased/Added-20260707-000001.yaml delete mode 100644 changes/unreleased/Added-20260713-000000.yaml delete mode 100644 changes/unreleased/Added-20260723-000000.yaml delete mode 100644 changes/unreleased/Added-20260724-000000.yaml delete mode 100644 changes/unreleased/Changed-20260706-204431.yaml delete mode 100644 changes/unreleased/Fixed-20260706-000000.yaml delete mode 100644 changes/unreleased/Fixed-20260708-000000.yaml delete mode 100644 changes/unreleased/Fixed-20260715-000001.yaml delete mode 100644 changes/unreleased/Fixed-20260716-000000.yaml delete mode 100644 changes/unreleased/Security-20260717-040124.yaml delete mode 100644 changes/unreleased/Security-20260721-000000.yaml create mode 100644 changes/v0.10.0.md diff --git a/.circleci/config.yml b/.circleci/config.yml index 1fdea74d..3fcd8dc4 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -225,6 +225,19 @@ jobs: # the rpms can be signed before they are attached to the release. GORELEASER_CURRENT_TAG=${CIRCLE_TAG} goreleaser release \ --release-notes=${release_notes} --skip=nfpm + + # Build and publish the control plane image now, while the archives + # from the first goreleaser run (named with CIRCLE_TAG) are still in + # dist/. The second goreleaser run below uses --clean, which wipes + # dist/ and recreates archives with PKG_TAG — if the image build ran + # after that, docker buildx would look for the CIRCLE_TAG archive and + # fail because only the PKG_TAG archive exists. + echo "${IMAGE_PUBLISH_TOKEN}" \ + | docker login ghcr.io --username "${IMAGE_PUBLISH_USER}" --password-stdin + CONTROL_PLANE_IMAGE_REPO='ghcr.io/pgedge/control-plane' \ + CONTROL_PLANE_VERSION="${CIRCLE_TAG}" \ + make control-plane-images + GORELEASER_CURRENT_TAG=${PKG_TAG} goreleaser release \ --clean --skip=publish,announce,validate,sbom @@ -250,15 +263,6 @@ jobs: gh release upload "${CIRCLE_TAG}" dist/*.rpm dist/*.deb --clobber gh release edit "${CIRCLE_TAG}" --draft=false - # log into control plane ECR repo - echo "${IMAGE_PUBLISH_TOKEN}" \ - | docker login ghcr.io --username "${IMAGE_PUBLISH_USER}" --password-stdin - - # build and publish control plane image - CONTROL_PLANE_IMAGE_REPO='ghcr.io/pgedge/control-plane' \ - CONTROL_PLANE_VERSION="${CIRCLE_TAG}" \ - make control-plane-images - build_image: executor: common steps: diff --git a/CHANGELOG.md b/CHANGELOG.md index b32c62f5..474501b5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,34 @@ # Changelog +## v0.10.0 - 2026-07-24 + +### Added + +- The Control Plane now rejects database specs that remove `spock` from `postgresql_conf.shared_preload_libraries`, preventing accidental disabling of the replication extension. +- Added image upgrade support. Use `GET /v1/databases/{id}?include=available_upgrades` to list newer stable images within the same Postgres major and Spock major version bucket, and `POST /v1/databases/{id}/upgrade` to apply an upgrade without changing the Postgres major version. +- Added support for custom container image pinning per database or node via `orchestrator_opts.swarm.image`. pgEdge-formatted image tags are validated against the spec's declared versions; unrecognized tags are accepted without version checks. The Control Plane also persists the resolved image at creation time, preventing silent image changes during Control Plane upgrades. +- Version resolution is now fully manifest-driven. Supported versions update with manifest refreshes without requiring a Control Plane upgrade. +- The Control Plane now falls back to the first available IPv6 address when no IPv4 address is found during IP autodetection. +- Cancelling a task now propagates to any in-progress activities, interrupting long-running operations rather than waiting for them to complete. +- RPM and DEB packages are now published to the pgEdge dnf and apt repositories on every release, enabling installation via `dnf` and `apt-get` in addition to the existing Docker and binary distribution methods. +- Added support for Spock 5.0.10 on Postgres 16.14, 17.10, and 18.4. + +### Changed + +- **Breaking:** Changed the default `password_encryption` from `md5` to `scram-sha-256`. If you're using the default password encryption, every role in a database's `database_users` will be automatically updated to `scram-sha-256` the next time you update that database. Roles created outside of `database_users` will need their passwords updated manually. To keep using `md5`, set `postgresql_conf.password_encryption` to `md5` in your database spec. + +### Fixed + +- Fixed an issue where resources pending recreation were not correctly planned for creation in the right reconciliation phase, causing reconciliation errors. +- Fixed Patroni rejecting connections from IPv4 addresses presented as IPv4-mapped IPv6 addresses (e.g. `::ffff:192.168.1.1`) on dual-stack hosts. +- Fixed rolling updates failing on multi-node databases with replica instances due to replication slot timing during instance initialization. +- Fixed an issue where services configured with `"version": "latest"` failed at runtime because `"latest"` was not registered in the version map. + +### Security + +- Update vulnerable dependencies (pgx v5.10.0, OpenTelemetry v1.44.0, golang.org/x/crypto v0.54.0, golang.org/x/net v0.57.0) and bump the Go toolchain to 1.26.5 to remediate Trivy-flagged CVEs in the control-plane image (PLAT-686). github.com/docker/docker CVE-2026-41567/CVE-2026-42306 have no fix in the v27.x line in use; risk-accepted in .trivy/pgedge-control-plane.trivyignore.yaml since the vulnerable docker-cp/archive-copy code paths are never invoked by this codebase. +- Fixed a SQL injection vulnerability in role attribute handling during database creation and updates. + ## v0.9.0 - 2026-06-16 ### Added diff --git a/api/apiv1/gen/control_plane/service.go b/api/apiv1/gen/control_plane/service.go index 633057cc..f9f6c622 100644 --- a/api/apiv1/gen/control_plane/service.go +++ b/api/apiv1/gen/control_plane/service.go @@ -86,7 +86,7 @@ type Service interface { const APIName = "control-plane" // APIVersion is the version of the API as defined in the design. -const APIVersion = "v0.9.0" +const APIVersion = "v0.10.0" // ServiceName is the name of the service as defined in the design. This is the // same value that is set in the endpoint request contexts under the ServiceKey diff --git a/api/apiv1/gen/http/openapi.json b/api/apiv1/gen/http/openapi.json index 2caf49c1..75659d89 100644 --- a/api/apiv1/gen/http/openapi.json +++ b/api/apiv1/gen/http/openapi.json @@ -3,7 +3,7 @@ "info": { "title": "pgEdge Control Plane v1 API", "description": "A distributed application that provides a declarative API to deploy and manage Postgres databases.", - "version": "v0.9.0" + "version": "v0.10.0" }, "host": "localhost:3000", "consumes": [ diff --git a/api/apiv1/gen/http/openapi.yaml b/api/apiv1/gen/http/openapi.yaml index aeedde4a..2c04ffd2 100644 --- a/api/apiv1/gen/http/openapi.yaml +++ b/api/apiv1/gen/http/openapi.yaml @@ -2,7 +2,7 @@ swagger: "2.0" info: title: pgEdge Control Plane v1 API description: A distributed application that provides a declarative API to deploy and manage Postgres databases. - version: v0.9.0 + version: v0.10.0 host: localhost:3000 consumes: - application/json diff --git a/api/apiv1/gen/http/openapi3.json b/api/apiv1/gen/http/openapi3.json index 7ec29cbd..b8803dc6 100644 --- a/api/apiv1/gen/http/openapi3.json +++ b/api/apiv1/gen/http/openapi3.json @@ -3,7 +3,7 @@ "info": { "title": "pgEdge Control Plane v1 API", "description": "A distributed application that provides a declarative API to deploy and manage Postgres databases.", - "version": "v0.9.0" + "version": "v0.10.0" }, "servers": [ { diff --git a/api/apiv1/gen/http/openapi3.yaml b/api/apiv1/gen/http/openapi3.yaml index c9e56044..f991894d 100644 --- a/api/apiv1/gen/http/openapi3.yaml +++ b/api/apiv1/gen/http/openapi3.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: pgEdge Control Plane v1 API description: A distributed application that provides a declarative API to deploy and manage Postgres databases. - version: v0.9.0 + version: v0.10.0 servers: - url: http://localhost:3000 paths: diff --git a/api/version.txt b/api/version.txt index 7965b36d..f78dc365 100644 --- a/api/version.txt +++ b/api/version.txt @@ -1 +1 @@ -v0.9.0 \ No newline at end of file +v0.10.0 \ No newline at end of file diff --git a/changes/unreleased/Added-20260625-000000.yaml b/changes/unreleased/Added-20260625-000000.yaml deleted file mode 100644 index cee4bad9..00000000 --- a/changes/unreleased/Added-20260625-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: The Control Plane now rejects database specs that remove `spock` from `postgresql_conf.shared_preload_libraries`, preventing accidental disabling of the replication extension. -time: 2026-06-25T00:00:00.000000+00:00 diff --git a/changes/unreleased/Added-20260701-000000.yaml b/changes/unreleased/Added-20260701-000000.yaml deleted file mode 100644 index e28ef106..00000000 --- a/changes/unreleased/Added-20260701-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: Added image upgrade support. Use `GET /v1/databases/{id}?include=available_upgrades` to list newer stable images within the same Postgres major and Spock major version bucket, and `POST /v1/databases/{id}/upgrade` to apply an upgrade without changing the Postgres major version. -time: 2026-07-01T00:00:00.000000+00:00 diff --git a/changes/unreleased/Added-20260701-000001.yaml b/changes/unreleased/Added-20260701-000001.yaml deleted file mode 100644 index c0a61d31..00000000 --- a/changes/unreleased/Added-20260701-000001.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: Added support for custom container image pinning per database or node via `orchestrator_opts.swarm.image`. pgEdge-formatted image tags are validated against the spec's declared versions; unrecognized tags are accepted without version checks. The Control Plane also persists the resolved image at creation time, preventing silent image changes during Control Plane upgrades. -time: 2026-07-01T00:00:01.000000+00:00 diff --git a/changes/unreleased/Added-20260707-000000.yaml b/changes/unreleased/Added-20260707-000000.yaml deleted file mode 100644 index 400cd267..00000000 --- a/changes/unreleased/Added-20260707-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: Version resolution is now fully manifest-driven. Supported versions update with manifest refreshes without requiring a Control Plane upgrade. -time: 2026-07-07T00:00:00.000000+00:00 diff --git a/changes/unreleased/Added-20260707-000001.yaml b/changes/unreleased/Added-20260707-000001.yaml deleted file mode 100644 index 3f71001c..00000000 --- a/changes/unreleased/Added-20260707-000001.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: The Control Plane now falls back to the first available IPv6 address when no IPv4 address is found during IP autodetection. -time: 2026-07-07T00:00:01.000000+00:00 diff --git a/changes/unreleased/Added-20260713-000000.yaml b/changes/unreleased/Added-20260713-000000.yaml deleted file mode 100644 index 19fa9d27..00000000 --- a/changes/unreleased/Added-20260713-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: Cancelling a task now propagates to any in-progress activities, interrupting long-running operations rather than waiting for them to complete. -time: 2026-07-13T00:00:00.000000+00:00 diff --git a/changes/unreleased/Added-20260723-000000.yaml b/changes/unreleased/Added-20260723-000000.yaml deleted file mode 100644 index 2e051a19..00000000 --- a/changes/unreleased/Added-20260723-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: RPM and DEB packages are now published to the pgEdge dnf and apt repositories on every release, enabling installation via `dnf` and `apt-get` in addition to the existing Docker and binary distribution methods. -time: 2026-07-23T00:00:00.00000+00:00 diff --git a/changes/unreleased/Added-20260724-000000.yaml b/changes/unreleased/Added-20260724-000000.yaml deleted file mode 100644 index 98222414..00000000 --- a/changes/unreleased/Added-20260724-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Added -body: Added support for Spock 5.0.10 on Postgres 16.14, 17.10, and 18.4. -time: 2026-07-24T00:00:00.000000+00:00 diff --git a/changes/unreleased/Changed-20260706-204431.yaml b/changes/unreleased/Changed-20260706-204431.yaml deleted file mode 100644 index 8bc7c4e1..00000000 --- a/changes/unreleased/Changed-20260706-204431.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Changed -body: '**Breaking:** Changed the default `password_encryption` from `md5` to `scram-sha-256`. If you''re using the default password encryption, every role in a database''s `database_users` will be automatically updated to `scram-sha-256` the next time you update that database. Roles created outside of `database_users` will need their passwords updated manually. To keep using `md5`, set `postgresql_conf.password_encryption` to `md5` in your database spec.' -time: 2026-07-06T20:44:31.76441+05:00 diff --git a/changes/unreleased/Fixed-20260706-000000.yaml b/changes/unreleased/Fixed-20260706-000000.yaml deleted file mode 100644 index ef654c9b..00000000 --- a/changes/unreleased/Fixed-20260706-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Fixed -body: Fixed an issue where resources pending recreation were not correctly planned for creation in the right reconciliation phase, causing reconciliation errors. -time: 2026-07-06T00:00:00.000000+00:00 diff --git a/changes/unreleased/Fixed-20260708-000000.yaml b/changes/unreleased/Fixed-20260708-000000.yaml deleted file mode 100644 index 7e1d7671..00000000 --- a/changes/unreleased/Fixed-20260708-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Fixed -body: Fixed Patroni rejecting connections from IPv4 addresses presented as IPv4-mapped IPv6 addresses (e.g. `::ffff:192.168.1.1`) on dual-stack hosts. -time: 2026-07-08T00:00:00.000000+00:00 diff --git a/changes/unreleased/Fixed-20260715-000001.yaml b/changes/unreleased/Fixed-20260715-000001.yaml deleted file mode 100644 index 657bae6d..00000000 --- a/changes/unreleased/Fixed-20260715-000001.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Fixed -body: Fixed rolling updates failing on multi-node databases with replica instances due to replication slot timing during instance initialization. -time: 2026-07-15T00:00:01.000000+00:00 diff --git a/changes/unreleased/Fixed-20260716-000000.yaml b/changes/unreleased/Fixed-20260716-000000.yaml deleted file mode 100644 index 7bb3201c..00000000 --- a/changes/unreleased/Fixed-20260716-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Fixed -body: 'Fixed an issue where services configured with `"version": "latest"` failed at runtime because `"latest"` was not registered in the version map.' -time: 2026-07-16T00:00:00.000000+00:00 diff --git a/changes/unreleased/Security-20260717-040124.yaml b/changes/unreleased/Security-20260717-040124.yaml deleted file mode 100644 index b3f4f672..00000000 --- a/changes/unreleased/Security-20260717-040124.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Security -body: Update vulnerable dependencies (pgx v5.10.0, OpenTelemetry v1.44.0, golang.org/x/crypto v0.54.0, golang.org/x/net v0.57.0) and bump the Go toolchain to 1.26.5 to remediate Trivy-flagged CVEs in the control-plane image (PLAT-686). github.com/docker/docker CVE-2026-41567/CVE-2026-42306 have no fix in the v27.x line in use; risk-accepted in .trivy/pgedge-control-plane.trivyignore.yaml since the vulnerable docker-cp/archive-copy code paths are never invoked by this codebase. -time: 2026-07-17T04:01:24.289511+05:00 diff --git a/changes/unreleased/Security-20260721-000000.yaml b/changes/unreleased/Security-20260721-000000.yaml deleted file mode 100644 index 694372e3..00000000 --- a/changes/unreleased/Security-20260721-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Security -body: Fixed a SQL injection vulnerability in role attribute handling during database creation and updates. -time: 2026-07-21T00:00:00.000000+00:00 diff --git a/changes/v0.10.0.md b/changes/v0.10.0.md new file mode 100644 index 00000000..9fcb01ba --- /dev/null +++ b/changes/v0.10.0.md @@ -0,0 +1,28 @@ +## v0.10.0 - 2026-07-24 + +### Added + +- The Control Plane now rejects database specs that remove `spock` from `postgresql_conf.shared_preload_libraries`, preventing accidental disabling of the replication extension. +- Added image upgrade support. Use `GET /v1/databases/{id}?include=available_upgrades` to list newer stable images within the same Postgres major and Spock major version bucket, and `POST /v1/databases/{id}/upgrade` to apply an upgrade without changing the Postgres major version. +- Added support for custom container image pinning per database or node via `orchestrator_opts.swarm.image`. pgEdge-formatted image tags are validated against the spec's declared versions; unrecognized tags are accepted without version checks. The Control Plane also persists the resolved image at creation time, preventing silent image changes during Control Plane upgrades. +- Version resolution is now fully manifest-driven. Supported versions update with manifest refreshes without requiring a Control Plane upgrade. +- The Control Plane now falls back to the first available IPv6 address when no IPv4 address is found during IP autodetection. +- Cancelling a task now propagates to any in-progress activities, interrupting long-running operations rather than waiting for them to complete. +- RPM and DEB packages are now published to the pgEdge dnf and apt repositories on every release, enabling installation via `dnf` and `apt-get` in addition to the existing Docker and binary distribution methods. +- Added support for Spock 5.0.10 on Postgres 16.14, 17.10, and 18.4. + +### Changed + +- **Breaking:** Changed the default `password_encryption` from `md5` to `scram-sha-256`. If you're using the default password encryption, every role in a database's `database_users` will be automatically updated to `scram-sha-256` the next time you update that database. Roles created outside of `database_users` will need their passwords updated manually. To keep using `md5`, set `postgresql_conf.password_encryption` to `md5` in your database spec. + +### Fixed + +- Fixed an issue where resources pending recreation were not correctly planned for creation in the right reconciliation phase, causing reconciliation errors. +- Fixed Patroni rejecting connections from IPv4 addresses presented as IPv4-mapped IPv6 addresses (e.g. `::ffff:192.168.1.1`) on dual-stack hosts. +- Fixed rolling updates failing on multi-node databases with replica instances due to replication slot timing during instance initialization. +- Fixed an issue where services configured with `"version": "latest"` failed at runtime because `"latest"` was not registered in the version map. + +### Security + +- Update vulnerable dependencies (pgx v5.10.0, OpenTelemetry v1.44.0, golang.org/x/crypto v0.54.0, golang.org/x/net v0.57.0) and bump the Go toolchain to 1.26.5 to remediate Trivy-flagged CVEs in the control-plane image (PLAT-686). github.com/docker/docker CVE-2026-41567/CVE-2026-42306 have no fix in the v27.x line in use; risk-accepted in .trivy/pgedge-control-plane.trivyignore.yaml since the vulnerable docker-cp/archive-copy code paths are never invoked by this codebase. +- Fixed a SQL injection vulnerability in role attribute handling during database creation and updates. diff --git a/docs/api/openapi.md b/docs/api/openapi.md index d2d53f54..64ceb812 100644 --- a/docs/api/openapi.md +++ b/docs/api/openapi.md @@ -7,7 +7,7 @@ The Control Plane server serves a JSON OpenAPI v3 specification from the You can also access offline copies of the OpenAPI specification in the pgEdge Control Plane repository. We generate a few versions of the specification to accommodate different tools and use cases: -- [OpenAPI v3 YAML](https://github.com/pgEdge/control-plane/blob/v0.9.0/api/apiv1/gen/http/openapi3.yaml) -- [OpenAPI v3 JSON](https://github.com/pgEdge/control-plane/blob/v0.9.0/api/apiv1/gen/http/openapi3.json) -- [OpenAPI v2 YAML](https://github.com/pgEdge/control-plane/blob/v0.9.0/api/apiv1/gen/http/openapi.yaml) -- [OpenAPI v2 JSON](https://github.com/pgEdge/control-plane/blob/v0.9.0/api/apiv1/gen/http/openapi.json) \ No newline at end of file +- [OpenAPI v3 YAML](https://github.com/pgEdge/control-plane/blob/v0.10.0/api/apiv1/gen/http/openapi3.yaml) +- [OpenAPI v3 JSON](https://github.com/pgEdge/control-plane/blob/v0.10.0/api/apiv1/gen/http/openapi3.json) +- [OpenAPI v2 YAML](https://github.com/pgEdge/control-plane/blob/v0.10.0/api/apiv1/gen/http/openapi.yaml) +- [OpenAPI v2 JSON](https://github.com/pgEdge/control-plane/blob/v0.10.0/api/apiv1/gen/http/openapi.json) \ No newline at end of file diff --git a/docs/api/reference.md b/docs/api/reference.md index 38508d1c..78cf3841 100644 --- a/docs/api/reference.md +++ b/docs/api/reference.md @@ -34,4 +34,4 @@ hide: - \ No newline at end of file + \ No newline at end of file diff --git a/docs/changelog.md b/docs/changelog.md index b32c62f5..474501b5 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -1,5 +1,34 @@ # Changelog +## v0.10.0 - 2026-07-24 + +### Added + +- The Control Plane now rejects database specs that remove `spock` from `postgresql_conf.shared_preload_libraries`, preventing accidental disabling of the replication extension. +- Added image upgrade support. Use `GET /v1/databases/{id}?include=available_upgrades` to list newer stable images within the same Postgres major and Spock major version bucket, and `POST /v1/databases/{id}/upgrade` to apply an upgrade without changing the Postgres major version. +- Added support for custom container image pinning per database or node via `orchestrator_opts.swarm.image`. pgEdge-formatted image tags are validated against the spec's declared versions; unrecognized tags are accepted without version checks. The Control Plane also persists the resolved image at creation time, preventing silent image changes during Control Plane upgrades. +- Version resolution is now fully manifest-driven. Supported versions update with manifest refreshes without requiring a Control Plane upgrade. +- The Control Plane now falls back to the first available IPv6 address when no IPv4 address is found during IP autodetection. +- Cancelling a task now propagates to any in-progress activities, interrupting long-running operations rather than waiting for them to complete. +- RPM and DEB packages are now published to the pgEdge dnf and apt repositories on every release, enabling installation via `dnf` and `apt-get` in addition to the existing Docker and binary distribution methods. +- Added support for Spock 5.0.10 on Postgres 16.14, 17.10, and 18.4. + +### Changed + +- **Breaking:** Changed the default `password_encryption` from `md5` to `scram-sha-256`. If you're using the default password encryption, every role in a database's `database_users` will be automatically updated to `scram-sha-256` the next time you update that database. Roles created outside of `database_users` will need their passwords updated manually. To keep using `md5`, set `postgresql_conf.password_encryption` to `md5` in your database spec. + +### Fixed + +- Fixed an issue where resources pending recreation were not correctly planned for creation in the right reconciliation phase, causing reconciliation errors. +- Fixed Patroni rejecting connections from IPv4 addresses presented as IPv4-mapped IPv6 addresses (e.g. `::ffff:192.168.1.1`) on dual-stack hosts. +- Fixed rolling updates failing on multi-node databases with replica instances due to replication slot timing during instance initialization. +- Fixed an issue where services configured with `"version": "latest"` failed at runtime because `"latest"` was not registered in the version map. + +### Security + +- Update vulnerable dependencies (pgx v5.10.0, OpenTelemetry v1.44.0, golang.org/x/crypto v0.54.0, golang.org/x/net v0.57.0) and bump the Go toolchain to 1.26.5 to remediate Trivy-flagged CVEs in the control-plane image (PLAT-686). github.com/docker/docker CVE-2026-41567/CVE-2026-42306 have no fix in the v27.x line in use; risk-accepted in .trivy/pgedge-control-plane.trivyignore.yaml since the vulnerable docker-cp/archive-copy code paths are never invoked by this codebase. +- Fixed a SQL injection vulnerability in role attribute handling during database creation and updates. + ## v0.9.0 - 2026-06-16 ### Added diff --git a/docs/development/e2e-tests.md b/docs/development/e2e-tests.md index 2f745cff..8826a5d5 100644 --- a/docs/development/e2e-tests.md +++ b/docs/development/e2e-tests.md @@ -395,7 +395,7 @@ specifying `FIXTURE_CONTROL_PLANE_IMAGE` with the `{deploy,update,reset}-{lima,ec2}-fixture` targets. For example: ```sh -make update-lima-fixture FIXTURE_CONTROL_PLANE_IMAGE='ghcr.io/pgedge/control-plane:v0.9.0-rc.1' +make update-lima-fixture FIXTURE_CONTROL_PLANE_IMAGE='ghcr.io/pgedge/control-plane:v0.10.0-rc.1' ``` ### Fixture variants diff --git a/docs/installation/mtls.md b/docs/installation/mtls.md index b1aed6be..ee3ef89e 100644 --- a/docs/installation/mtls.md +++ b/docs/installation/mtls.md @@ -65,7 +65,7 @@ For example, if you've placed the certificates in a `/opt/pgedge/control-plane` ```yaml services: host-1: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-1 @@ -225,7 +225,7 @@ Now that our certificates are available on each machine, we can update our stack ```yaml services: host-1: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-1 @@ -249,7 +249,7 @@ services: constraints: - node.id==81kw1zwmh9y8hk4rd7igylry0 host-2: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-2 @@ -270,7 +270,7 @@ services: constraints: - node.id==xz7069ytbdq7uzd2tvrj2wlf2 host-3: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-3 diff --git a/docs/installation/swarm-installation.md b/docs/installation/swarm-installation.md index 3fcf511d..60fb2f22 100644 --- a/docs/installation/swarm-installation.md +++ b/docs/installation/swarm-installation.md @@ -103,7 +103,7 @@ Given that output, the following stack definition file will deploy a single Cont ```yaml services: host-1: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-1 @@ -118,7 +118,7 @@ services: constraints: - node.id==vzou89zyd4n3xz6p6jvoohqxx host-2: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-2 @@ -133,7 +133,7 @@ services: constraints: - node.id==5sa7m11ub62t1n22feuhg0mbp host-3: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-3 @@ -196,7 +196,7 @@ For example: ```yaml host-4: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 command: run environment: - PGEDGE_HOST_ID=host-4 @@ -232,7 +232,7 @@ Paste the output below and click "Generate Stack." This generator is fully local - + ``` yaml {#global-output} # Once submitted, the generated stack will appear here. @@ -261,7 +261,7 @@ mounted file: ```yaml services: control-plane-host-1: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 environment: - PGEDGE_DOCKER_SWARM__MANIFEST_PATH=/etc/pgedge/version-manifest.json volumes: diff --git a/docs/installation/swarm-upgrading.md b/docs/installation/swarm-upgrading.md index b68113e1..33e8108c 100644 --- a/docs/installation/swarm-upgrading.md +++ b/docs/installation/swarm-upgrading.md @@ -5,11 +5,11 @@ Plane. The Control Plane version is specified in the image property of the [stac ```yaml services: host-1: - image: ghcr.io/pgedge/control-plane:v0.9.0 + image: ghcr.io/pgedge/control-plane:v0.10.0 ``` You can *pin* to a specific version by including a version in the `image` -fields in your service specification, such as `ghcr.io/pgedge/control-plane:v0.9.0`. +fields in your service specification, such as `ghcr.io/pgedge/control-plane:v0.10.0`. If you do not include a version, Docker will pull the `ghcr.io/pgedge/control-plane:latest` tag by default. diff --git a/docs/installation/systemd-installation.md b/docs/installation/systemd-installation.md index 402a4543..5caad967 100644 --- a/docs/installation/systemd-installation.md +++ b/docs/installation/systemd-installation.md @@ -130,7 +130,7 @@ Use the following commands to download and install the RPM: ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') # Set the version to install -VERSION="v0.9.0" +VERSION="v0.10.0" # Download the RPM curl -LO "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.rpm" @@ -148,7 +148,7 @@ Use the following commands to download and install the deb package: ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') # Set the version to install -VERSION="v0.9.0" +VERSION="v0.10.0" # Download the deb package curl -LO --output-dir /tmp "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.deb" diff --git a/docs/installation/systemd-upgrading.md b/docs/installation/systemd-upgrading.md index 5ec21059..1104aaf9 100644 --- a/docs/installation/systemd-upgrading.md +++ b/docs/installation/systemd-upgrading.md @@ -56,7 +56,7 @@ curl http://localhost:3000/v1/version ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') # Set the new version to install -VERSION="v0.9.0" +VERSION="v0.10.0" # Download the RPM curl -LO "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.rpm" @@ -80,7 +80,7 @@ curl http://localhost:3000/v1/version ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') # Set the new version to install -VERSION="v0.9.0" +VERSION="v0.10.0" # Download the deb package curl -LO --output-dir /tmp "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.deb" From e5c68fe68c047c531c5359580cabd278486e11e0 Mon Sep 17 00:00:00 2001 From: Zaid Date: Wed, 29 Jul 2026 20:51:33 +0500 Subject: [PATCH 2/6] fix: bundle README/LICENSE and set explicit file modes in rpm/deb packages and fix files permissions issue. (#447) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: bundle README and LICENSE in rpm/deb The rpm and deb packages built by goreleaser's `nfpms` block shipped only the binary, unit file, config, and SBOM. Install the project documentation and license alongside them: - `README.md` -> `/usr/share/doc/pgedge-control-plane/README.md` - `LICENSE.md` -> `/usr/share/licenses/pgedge-control-plane/LICENSE.md` * fix: set explicit file permissions in rpm/deb packages nfpm packages the mode of each source file as it exists on the builder when no `file_info.mode` is given. CI checks out with `umask 002`, so git created the files 0664 and that mode shipped in the packages: -rw-rw-r-- root root /usr/lib/systemd/system/pgedge-control-plane.service -rw-rw-r-- root root /etc/pgedge-control-plane/config.json Set `file_info.mode` on every `contents` entry so the packaged modes are deterministic regardless of the builder's umask. The unit file is 0644. config.json is 0640, since it may hold credentials and the service runs as root, so root-only read access is sufficient. The SBOM, README, and LICENSE entries are 0644, which they were already getting by accident. Verified by chmod'ing the sources to 0664 to reproduce the CI umask and rebuilding: `rpm -qlvp` on the el9 and el10 packages and `tar tzvf` on the noble deb all report 0644 for the unit and 0640 for config.json. Co-Authored-By: Claude Opus 5 (1M context) * docs: fix permissions wording in changelog entry `0664` is group-writable, not world-writable — the world bits are read-only. Correct the changelog entry to say so. --- .goreleaser.yaml | 40 +++++++++++++++++++ changes/unreleased/Fixed-20260728-000000.yaml | 3 ++ changes/unreleased/Fixed-20260729-000000.yaml | 3 ++ 3 files changed, 46 insertions(+) create mode 100644 changes/unreleased/Fixed-20260728-000000.yaml create mode 100644 changes/unreleased/Fixed-20260729-000000.yaml diff --git a/.goreleaser.yaml b/.goreleaser.yaml index b0ce03f7..5d870616 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -64,17 +64,57 @@ nfpms: scripts: postinstall: packaging/deb/postinstall.sh preremove: packaging/deb/preremove.sh + # Every entry sets file_info.mode explicitly. Without it nfpm packages the + # mode of the file as checked out on the builder, which is umask-dependent + # (CI runs with umask 002, so git creates 0664 and that mode shipped in the + # packages). config.json is 0640 because it may hold credentials; the unit + # runs as root, so root-only read access is sufficient. contents: - src: packaging/pgedge-control-plane.service dst: /usr/lib/systemd/system/pgedge-control-plane.service type: config + file_info: + mode: 0644 - src: packaging/config.json dst: /etc/pgedge-control-plane/config.json type: config|noreplace + file_info: + mode: 0640 - src: .sbom/sbom.json dst: /usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json + file_info: + mode: 0644 - src: ".sbom/sbom.{{ .Format }}.asc" dst: /usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json.asc + file_info: + mode: 0644 + # Docs and license, at the same paths for both formats. The 'doc' and + # 'license' types add the %doc/%license markers to the rpm spec, but nfpm + # drops content of those types from non-rpm packages, so the deb needs its + # own plain-file entries (scoped with `packager` so each format gets + # exactly one entry per path). + - src: README.md + dst: /usr/share/doc/pgedge-control-plane/README.md + type: doc + packager: rpm + file_info: + mode: 0644 + - src: README.md + dst: /usr/share/doc/pgedge-control-plane/README.md + packager: deb + file_info: + mode: 0644 + - src: LICENSE.md + dst: /usr/share/licenses/pgedge-control-plane/LICENSE.md + type: license + packager: rpm + file_info: + mode: 0644 + - src: LICENSE.md + dst: /usr/share/licenses/pgedge-control-plane/LICENSE.md + packager: deb + file_info: + mode: 0644 formats: [rpm] release: "1.el9" - <<: *nfpm_defaults diff --git a/changes/unreleased/Fixed-20260728-000000.yaml b/changes/unreleased/Fixed-20260728-000000.yaml new file mode 100644 index 00000000..7568290e --- /dev/null +++ b/changes/unreleased/Fixed-20260728-000000.yaml @@ -0,0 +1,3 @@ +kind: Fixed +body: The RPM and DEB packages now bundle the project documentation and license, installing `README.md` to `/usr/share/doc/pgedge-control-plane/` and `LICENSE.md` to `/usr/share/licenses/pgedge-control-plane/`. +time: 2026-07-28T00:00:00.000000+00:00 diff --git a/changes/unreleased/Fixed-20260729-000000.yaml b/changes/unreleased/Fixed-20260729-000000.yaml new file mode 100644 index 00000000..d37166df --- /dev/null +++ b/changes/unreleased/Fixed-20260729-000000.yaml @@ -0,0 +1,3 @@ +kind: Fixed +body: RPM and DEB packages now install files with explicit, deterministic permissions rather than inheriting the build machine's umask, which produced group-writable `0664` files. `/usr/lib/systemd/system/pgedge-control-plane.service` is now `0644` and `/etc/pgedge-control-plane/config.json` is now `0640`. +time: 2026-07-29T00:00:00.000000+00:00 From cb60852ab2a746202aae0f36ee5b04d8e382c724 Mon Sep 17 00:00:00 2001 From: Siva Date: Wed, 29 Jul 2026 21:47:17 +0530 Subject: [PATCH 3/6] docs: fold packaging fixes into pending v0.10.0 changelog --- CHANGELOG.md | 2 ++ changes/unreleased/Fixed-20260728-000000.yaml | 3 --- changes/unreleased/Fixed-20260729-000000.yaml | 3 --- changes/v0.10.0.md | 2 ++ 4 files changed, 4 insertions(+), 6 deletions(-) delete mode 100644 changes/unreleased/Fixed-20260728-000000.yaml delete mode 100644 changes/unreleased/Fixed-20260729-000000.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 474501b5..f81cffb4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,8 @@ - Fixed Patroni rejecting connections from IPv4 addresses presented as IPv4-mapped IPv6 addresses (e.g. `::ffff:192.168.1.1`) on dual-stack hosts. - Fixed rolling updates failing on multi-node databases with replica instances due to replication slot timing during instance initialization. - Fixed an issue where services configured with `"version": "latest"` failed at runtime because `"latest"` was not registered in the version map. +- The RPM and DEB packages now bundle the project documentation and license, installing `README.md` to `/usr/share/doc/pgedge-control-plane/` and `LICENSE.md` to `/usr/share/licenses/pgedge-control-plane/`. +- RPM and DEB packages now install files with explicit, deterministic permissions rather than inheriting the build machine's umask, which produced group-writable `0664` files. `/usr/lib/systemd/system/pgedge-control-plane.service` is now `0644` and `/etc/pgedge-control-plane/config.json` is now `0640`. ### Security diff --git a/changes/unreleased/Fixed-20260728-000000.yaml b/changes/unreleased/Fixed-20260728-000000.yaml deleted file mode 100644 index 7568290e..00000000 --- a/changes/unreleased/Fixed-20260728-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Fixed -body: The RPM and DEB packages now bundle the project documentation and license, installing `README.md` to `/usr/share/doc/pgedge-control-plane/` and `LICENSE.md` to `/usr/share/licenses/pgedge-control-plane/`. -time: 2026-07-28T00:00:00.000000+00:00 diff --git a/changes/unreleased/Fixed-20260729-000000.yaml b/changes/unreleased/Fixed-20260729-000000.yaml deleted file mode 100644 index d37166df..00000000 --- a/changes/unreleased/Fixed-20260729-000000.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: Fixed -body: RPM and DEB packages now install files with explicit, deterministic permissions rather than inheriting the build machine's umask, which produced group-writable `0664` files. `/usr/lib/systemd/system/pgedge-control-plane.service` is now `0644` and `/etc/pgedge-control-plane/config.json` is now `0640`. -time: 2026-07-29T00:00:00.000000+00:00 diff --git a/changes/v0.10.0.md b/changes/v0.10.0.md index 9fcb01ba..a147b15f 100644 --- a/changes/v0.10.0.md +++ b/changes/v0.10.0.md @@ -21,6 +21,8 @@ - Fixed Patroni rejecting connections from IPv4 addresses presented as IPv4-mapped IPv6 addresses (e.g. `::ffff:192.168.1.1`) on dual-stack hosts. - Fixed rolling updates failing on multi-node databases with replica instances due to replication slot timing during instance initialization. - Fixed an issue where services configured with `"version": "latest"` failed at runtime because `"latest"` was not registered in the version map. +- The RPM and DEB packages now bundle the project documentation and license, installing `README.md` to `/usr/share/doc/pgedge-control-plane/` and `LICENSE.md` to `/usr/share/licenses/pgedge-control-plane/`. +- RPM and DEB packages now install files with explicit, deterministic permissions rather than inheriting the build machine's umask, which produced group-writable `0664` files. `/usr/lib/systemd/system/pgedge-control-plane.service` is now `0644` and `/etc/pgedge-control-plane/config.json` is now `0640`. ### Security From d95ae68083e6bf554ec29d4a5492bd2fed83e85f Mon Sep 17 00:00:00 2001 From: Siva Date: Thu, 30 Jul 2026 00:31:54 +0530 Subject: [PATCH 4/6] addressing review comments --- .goreleaser.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 5d870616..0818cec6 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -64,22 +64,22 @@ nfpms: scripts: postinstall: packaging/deb/postinstall.sh preremove: packaging/deb/preremove.sh - # Every entry sets file_info.mode explicitly. Without it nfpm packages the - # mode of the file as checked out on the builder, which is umask-dependent - # (CI runs with umask 002, so git creates 0664 and that mode shipped in the - # packages). config.json is 0640 because it may hold credentials; the unit - # runs as root, so root-only read access is sufficient. + # Every entry sets file_info.mode explicitly. Without it, nfpm stats the + # source file as checked out on the builder and strips its own Umask + # (defaults to 0o02) from that mode, so whatever mode the file happened to + # have on the builder shipped in the packages (that's how group-writable + # 0664 files ended up in prior builds). config.json is 0600 because it may + # hold credentials and only the unit (which runs as root) needs to read it. contents: - src: packaging/pgedge-control-plane.service dst: /usr/lib/systemd/system/pgedge-control-plane.service - type: config file_info: mode: 0644 - src: packaging/config.json dst: /etc/pgedge-control-plane/config.json type: config|noreplace file_info: - mode: 0640 + mode: 0600 - src: .sbom/sbom.json dst: /usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json file_info: @@ -111,7 +111,7 @@ nfpms: file_info: mode: 0644 - src: LICENSE.md - dst: /usr/share/licenses/pgedge-control-plane/LICENSE.md + dst: /usr/share/doc/pgedge-control-plane/copyright packager: deb file_info: mode: 0644 From b69d705db62d8256e1cd82e7db301c11d3e9e0ea Mon Sep 17 00:00:00 2001 From: Siva Date: Thu, 30 Jul 2026 01:01:22 +0530 Subject: [PATCH 5/6] addressing review comments --- .goreleaser.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 0818cec6..7348da1a 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -88,7 +88,8 @@ nfpms: dst: /usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json.asc file_info: mode: 0644 - # Docs and license, at the same paths for both formats. The 'doc' and + # README shares the same path in both formats; LICENSE does not, since + # rpm and deb have different conventional license paths. The 'doc' and # 'license' types add the %doc/%license markers to the rpm spec, but nfpm # drops content of those types from non-rpm packages, so the deb needs its # own plain-file entries (scoped with `packager` so each format gets From 265e36aa51e8e873917aefabfae434c4a090f1aa Mon Sep 17 00:00:00 2001 From: Jason Lynch Date: Fri, 31 Jul 2026 07:37:05 -0400 Subject: [PATCH 6/6] docs: simplify systemd install instructions (#448) This commit condenses the dependency and pgedge-control-plane package installation instructions and removes the manual package installation instructions. We depend on packages from the pgEdge Enterprise Postgres repository, so installing the packages manually isn't a true alternative to our package repos. --- docs/installation/systemd-installation.md | 144 +++++++--------------- docs/installation/systemd-upgrading.md | 58 --------- 2 files changed, 46 insertions(+), 156 deletions(-) diff --git a/docs/installation/systemd-installation.md b/docs/installation/systemd-installation.md index 5caad967..4d316ac8 100644 --- a/docs/installation/systemd-installation.md +++ b/docs/installation/systemd-installation.md @@ -3,10 +3,7 @@ This guide covers installing the pgEdge Control Plane on Linux hosts that use the RPM Package Manager (RPM) package format (e.g., Red Hat Enterprise Linux (RHEL), Rocky Linux, AlmaLinux) or the Debian (deb) package format (e.g., -Ubuntu, Debian). We recommend installing from the pgEdge Enterprise package -repositories; package files are also attached to each [GitHub -release](https://github.com/pgedge/control-plane/releases) for hosts without -repository access. +Ubuntu, Debian). Unlike the Docker Swarm installation method, the system package installation runs the Control Plane directly on the host. The Control Plane uses systemd to @@ -25,24 +22,28 @@ current release. - All hosts in a cluster must use the same orchestrator (either `swarm` or `systemd`); the orchestrator must not change after the cluster is initialized. - We'd love your feedback - please share your experience in our [GitHub issues](https://github.com/pgedge/control-plane/issues) or join our [Discord](https://discord.com/invite/pgedge/login). +We'd love your feedback - please share your experience in our [GitHub issues](https://github.com/pgedge/control-plane/issues) +or join our [Discord](https://discord.com/invite/pgedge/login). -### Packages +## Installing the Control Plane -After creating hosts that [meet the prerequisites](../prerequisites/index.md), you are ready to install Postgress and it's supporting packages on each host. +After creating hosts that [meet the prerequisites](../prerequisites/index.md), +you are ready to install the Control Plane and its dependencies on each host. -#### RPM Packages +The pgEdge Control Plane packages are published for both `amd64` and `arm64` +architectures and distributed through the pgEdge Enterprise Postgres package +repositories. -Run the following commands on each RHEL-like host: +### RPM Packages -```sh -# Install prerequisites for the pgEdge Enterprise Postgres packages -sudo dnf install -y epel-release dnf -sudo dnf config-manager --set-enabled crb +Follow the instructions from the ["Configuring the Repository" page](https://docs.pgedge.com/enterprise/el/configure-repo/) +of the pgEdge Enterprise Postgres package repository documentation to install +the repository. -# Install the pgEdge Enterprise Postgres repository -sudo dnf install -y https://dnf.pgedge.com/reporpm/pgedge-release-latest.noarch.rpm +Then, use the following commands to install the Control Plane and its +dependencies: +```sh # Install the required packages for your Postgres version. We currently support # versions 16, 17, and 18. Set POSTGRES_MAJOR_VERSION to your desired version. POSTGRES_MAJOR_VERSION='<16|17|18>' @@ -51,21 +52,31 @@ sudo dnf install -y \ pgedge-spock50_${POSTGRES_MAJOR_VERSION} \ pgedge-postgresql${POSTGRES_MAJOR_VERSION}-contrib \ pgedge-pgbackrest \ - pgedge-patroni + pgedge-patroni \ + pgedge-control-plane ``` -#### Deb Packages +The `pgedge-control-plane` package will install the following files: -Run the following commands on each Debian-based host: +- `/etc/pgedge-control-plane/config.json` +- `/usr/lib/systemd/system/pgedge-control-plane.service` +- `/usr/sbin/pgedge-control-plane` +- `/usr/share/doc/pgedge-control-plane/README.md` +- `/usr/share/licenses/pgedge-control-plane/LICENSE.md` +- `/usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json` +- `/usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json.asc` -```sh -# Install prerequisites for the pgEdge Enterprise Postgres packages -sudo apt update -sudo apt install -y curl gnupg2 lsb-release +### Deb Packages -# Install the pgEdge Enterprise Postgres repository -curl -O --output-dir /tmp https://apt.pgedge.com/repodeb/pgedge-release_latest_all.deb -sudo apt install -y /tmp/pgedge-release_latest_all.deb +Follow the instructions from the ["Configuring the Repository" page](https://docs.pgedge.com/enterprise/debian/configure-repo/) +of the pgEdge Enterprise Postgres package repository documentation to install +the repository. + +Then, use the following commands to install the Control Plane and its +dependencies: + +```sh +# Update the local list of available packages sudo apt update # Install the required packages for your Postgres version. We currently support @@ -75,7 +86,8 @@ sudo apt install -y \ pgedge-postgresql-${POSTGRES_MAJOR_VERSION} \ pgedge-postgresql-${POSTGRES_MAJOR_VERSION}-spock50 \ pgedge-pgbackrest \ - pgedge-patroni + pgedge-patroni \ + pgedge-control-plane # The postgresql package will create and start a default database. We recommend # stopping and disabling that database to avoid confusion or port conflicts. @@ -83,79 +95,15 @@ sudo systemctl disable --now postgresql.service sudo systemctl disable --now postgresql@${POSTGRES_MAJOR_VERSION}-main.service ``` -## Installing the Control Plane - -The pgEdge Control Plane packages are published for both `amd64` and `arm64` -architectures. - -Every package will install the following files: - -- The Control Plane binary is installed at `/usr/sbin/pgedge-control-plane`. -- The systemd service unit is installed at `/usr/lib/systemd/system/pgedge-control-plane.service`. -- The default configuration file is installed at `/etc/pgedge-control-plane/config.json`. - -We recommend installing the Control Plane from the pgEdge Enterprise package -repositories you configured in the [Packages](#packages) section above. If you -don't have access to those repositories, see [Installing from GitHub -Releases](#installing-from-github-releases) below. - -### RPM Package - -Use the following command to install the Control Plane on RHEL-like hosts: - -```sh -sudo dnf install -y pgedge-control-plane -``` - -### Deb Package +The `pgedge-control-plane` package will install the following files: -Use the following command to install the Control Plane on Debian-based hosts: - -```sh -sudo apt install -y pgedge-control-plane -``` - -### Installing from GitHub Releases - -If you don't have access to the pgEdge Enterprise package repositories, you can -download and install packages directly from the [GitHub releases -page](https://github.com/pgedge/control-plane/releases). - -#### RPM Package - -Use the following commands to download and install the RPM: - -```sh -# Detect architecture -ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') - -# Set the version to install -VERSION="v0.10.0" - -# Download the RPM -curl -LO "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.rpm" - -# Install the RPM -sudo rpm -i pgedge-control-plane_${VERSION#v}_linux_${ARCH}.rpm -``` - -#### Deb Package - -Use the following commands to download and install the deb package: - -```sh -# Detect architecture -ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') - -# Set the version to install -VERSION="v0.10.0" - -# Download the deb package -curl -LO --output-dir /tmp "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.deb" - -# Install the deb package -sudo apt install /tmp/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.deb -``` +- `/etc/pgedge-control-plane/config.json` +- `/usr/lib/systemd/system/pgedge-control-plane.service` +- `/usr/sbin/pgedge-control-plane` +- `/usr/share/doc/pgedge-control-plane/README.md` +- `/usr/share/doc/pgedge-control-plane/copyright` +- `/usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json` +- `/usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json.asc` ## Configuration diff --git a/docs/installation/systemd-upgrading.md b/docs/installation/systemd-upgrading.md index 1104aaf9..cffcd287 100644 --- a/docs/installation/systemd-upgrading.md +++ b/docs/installation/systemd-upgrading.md @@ -6,11 +6,6 @@ automatically restart the Control Plane service after the update is complete. > The package upgrade will preserve any modifications to the configuration file > at `/etc/pgedge-control-plane/config.json`. -We recommend updating the Control Plane using the pgEdge Enterprise package -repositories you configured in the [Packages](systemd-installation.md#packages) -section. If you installed the Control Plane manually, see [Updating from -GitHub Releases](#updating-from-github-releases) below. - ## Updating the Control Plane ### RPM Package @@ -39,59 +34,6 @@ sudo apt install --only-upgrade -y pgedge-control-plane curl http://localhost:3000/v1/version ``` -### Updating from GitHub Releases - -If you installed the Control Plane manually from GitHub releases, download and -install the updated package version. - -#### RPM Package - -Use the following commands to download and install the updated RPM: - -```sh -# (Optional) print the current version via the API -curl http://localhost:3000/v1/version - -# Detect architecture -ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') - -# Set the new version to install -VERSION="v0.10.0" - -# Download the RPM -curl -LO "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.rpm" - -# Install the RPM with the 'upgrade' flag -sudo rpm -U pgedge-control-plane_${VERSION#v}_linux_${ARCH}.rpm - -# (Optional) print the updated version via the API -curl http://localhost:3000/v1/version -``` - -#### Deb Package - -Use the following commands to download and install the deb package: - -```sh -# (Optional) print the current version via the API -curl http://localhost:3000/v1/version - -# Detect architecture -ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') - -# Set the new version to install -VERSION="v0.10.0" - -# Download the deb package -curl -LO --output-dir /tmp "https://github.com/pgedge/control-plane/releases/download/${VERSION}/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.deb" - -# Install the deb package -sudo apt install /tmp/pgedge-control-plane_${VERSION#v}_linux_${ARCH}.deb - -# (Optional) print the updated version via the API -curl http://localhost:3000/v1/version -``` - ## Performing Postgres Minor Version Upgrades Database upgrades are not yet supported via the Control Plane API, but system