AlloyDB Omni K8s Operator 1.8.0 release

Security, Resiliency, and Low-Downtime Operations Reach General Availability

We are excited to announce the General Availability (GA) of the AlloyDB Omni Kubernetes Operator version 1.8.0!

This landmark release brings some of our most requested security and high-availability features to full GA, giving enterprise teams the tools they need to run mission-critical, heavily regulated PostgreSQL workloads in Kubernetes with confidence.

Here is an in-depth look at the major capabilities and enhancements packed into version 1.8.0.

1. Production-Ready Security: Transparent Data Encryption (TDE) is GA

Ensuring your data is completely secure at rest is non-negotiable for enterprise deployments. With this release, Transparent Data Encryption (TDE) is now Generally Available (GA).

TDE offers comprehensive, automated protection for your database at rest. It automatically encrypts:

Database files
Backups
Cache spillover to disk

By securing the storage layer seamlessly, TDE ensures you can meet strict data security policies and compliance mandates without sacrificing operational efficiency.

2. Seamless Updates: Low Downtime Maintenance (LDTM) is GA

Database maintenance has historically meant scheduling late-night maintenance windows and accepting system downtime. Not anymore.

With Low Downtime Maintenance (LDTM) reaching General Availability (GA), you can now run maintenance operations on highly available clusters with almost zero interruption to your application workloads.

Supported LDTM operations include:

Minor Version Upgrades
CPU and Memory Resource Scaling

The framework minimizes write unavailability and includes automatic rollback support. If a scaling or upgrade operation encounters an issue, the operator safely rolls back the cluster to its previous state, maintaining high availability throughout.

3. PostgreSQL 18.3 and Advanced Currency

We continue to keep pace with the broader PostgreSQL community so you can benefit from the latest performance improvements and database engines.

PostgreSQL 18.3 Support: AlloyDB Omni now supports PostgreSQL 18.3.

Minor Version Refreshes: This release introduces support for new PostgreSQL minor versions across all active tracks, ensuring stability and optimization:

PostgreSQL 17.9
PostgreSQL 16.13
PostgreSQL 15.17

4. Advanced Enterprise Compliance & Customizations

To support highly regulated government and corporate environments, 1.8.0 introduces key compliance foundations:

STIG and FIPS Compliance: This release embarks on a journey to compliance with Security Technical Implementation Guides (STIG) and Federal Information Processing Standards (FIPS), as well as pgAudit integration to ensure robust auditing and security postures. A full compliance is targeted for next release.
Custom Certificate Attributes: You can now specify custom certificate attributes directly inside the DBCluster custom resource specification. This lets you align database certificates perfectly with your organization's unique PKI and certificate policies.

5. Key Reliability Bug Fixes

We have addressed critical edge cases around certificate management to keep your control plane and database instances highly resilient:

Backup Certificate Rotations: Fixed an issue where rotating backup certificates could trigger an unexpected restart of the database server. Backup workloads now reload TLS configurations seamlessly without disruptions after a rotation. (Note: If you utilize backups, you must upgrade your AlloyDB Omni control plane to the latest versions).
Internal Certificate Rotations: Resolved an issue where rotating internal certificates could break TLS verification for database workloads and disrupt control plane functions. The operator now safely reloads TLS configurations automatically.

6. Deprecation of Legacy High Availability (HA)

As we modernize our architecture, the legacy HA implementation (in versions 15.7.0 and earlier) is officially deprecated. While legacy HA clusters remain supported until their future sunset date, we recommend migrating to the new, more resilient implementation.

There are no user-facing API changes when enabling or disabling HA. To check if your cluster is already running the modern HA architecture, verify if the dbcluster.dbadmin.goog/raasEnabled annotation exists on your database cluster custom resource.

If the annotation is missing, you can easily migrate with these steps:

Upgrade your control plane agents to version 15.7.1 or newer.
Disable HA on your cluster.
Wait for the operator to clean up existing standbys.
Re-enable HA on your cluster.

Conclusion and Next Steps

The AlloyDB Omni Kubernetes Operator 1.8.0 release represents a maturity milestone, bringing vital capabilities like TDE and LDTM into full general availability. It makes running enterprise-grade, secure, and self-healing databases on Kubernetes easier and safer than ever before.

More information is in the release notes here.

Ready to upgrade?

Check this page for instructions on how to upgrade your operator

AlloyDB Omni K8s Operator 1.8.0 release was originally published in Google Cloud – Community on Medium, where people are continuing the conversation by highlighting and responding to this story.

Source Credit: https://medium.com/google-cloud/alloydb-omni-k8s-operator-1-8-0-release-a1d18dde61b3?source=rss—-e52cf94d98af—4