[jacobecox]

Work item 5376 (10-22 vulnerability scan). Hold for the joint review with the maintainer before merge.

Review diff (everything after the verbatim copy): git diff 5b6a3bea..HEAD -- postgres-highly-available/versions/2.8.1/ briefings/postgres-highly-available.md

1. pgvector CVE-2026-103484

• image → controlplanecorporation/patroni-postgres:0.8. The rebuilt image upgrades PGDG postgresql-{13..17}-pgvector 0.8.0 → 0.8.7, along with refreshed ca-certificates/curl. User, entrypoint and command are unchanged. appVersion stays 17.
• pg-ha.validateImage refuses controlplanecorporation/patroni-postgres tags 0.1–0.7 (an optional docker.io/ prefix and an optional patch number are accepted). It is mirrored by a wizard rule. It exists because the Console wizard stores image in release values, so a helm upgrade -f would otherwise keep the vulnerable image.
• README "Upgrading from 2.8.0 or earlier": the fix applies when the members restart during the upgrade. \dx keeps reporting the old version until you run ALTER EXTENSION vector UPDATE;.

2. Chart upgrades no longer cost ~2 minutes of refused writes (HAProxy startup)

Through 2.8.0, the proxy's start script waited for every Patroni member to answer :8008, and the proxy workload had no readiness probe. A chart upgrade redeploys the proxy while Patroni is rolling. The platform therefore counted the new proxies ready and retired the old ones, while the new ones were still waiting: 125.6 s of refused writes, with the leader untouched. The fix is copied from shipped pgedge 3.0.0:

• The start script waits at most 60 s for any member, then starts.
• HAProxy re-resolves server names at runtime (resolvers mesh).
• readinessProbe on /stats :8405, true once HAProxy is listening. An upgrade keeps the old proxies serving until a new one is up.

The first version used /healthz :8404, which is true only while a leader is routable. In hang-failover tests the platform then restarted proxy replicas once the leaderless window ended (timescaledb-highly-available: 155 s instead of 70 s), so readiness uses /stats.

Testing (test-gvc-3, aws-us-west-2)

Image change (10-23):

• Data and both vector indexes survived and are used.
• ALTER EXTENSION vector UPDATE replicates.
• The guard refuses 0.7 live, and nothing on the release changes.

Proxy fix, final version (10-26, test-gvc-2; the first version was tested in test-gvc-3). Writes ran continuously; 0 acknowledged writes lost in every row:

Row	Result
Upgrade 2.8.0 → 2.8.1	3.2 s + 2.4 s (planned switchover only; was 125.6 s). Old proxies were retired only after a new one was ready. No gap between a new proxy becoming ready and its leader being UP. Afterwards: 3/3 members, 2 streaming, lag 0, etcd healthy
Upgrade rolling both Patroni and the proxy (first version)	3.9 s + 5.7 s (two handovers)
Proxy redeploy while a member is hung (the old gate's worst case)	0 s
3 failovers by hanging the leader	70.5 / 75.4 / 71.4 s: Patroni's 45 s lease plus loop timing. The proxy adds < 1 s. 0 proxy restarts
Fresh install with PgBouncer	proxy ready ≤ 5 s after HAProxy starts; writes and reads through HAProxy and PgBouncer
haproxy -c, resolver warnings	valid, none
Teardown	janitor clean ✓

Drift: the proxy workload is clean. The Patroni workload drifts on six probe fields, which is pre-existing (2.8.0 has the same) and deferred with the rest of the drift work.

Placeholder addresses, the problem the old gate (#309) guarded against: the replica-N names resolve to stable per-replica mesh VIPs. On a cold install the mesh can briefly answer with a placeholder address; runtime DNS replaced it with the real address in 32 s, with no restart (measured on timescaledb-highly-available).

Gates: tw lint → 0 errors, 0 warnings, 62/62 leaves covered; the default render passes.

Pre-existing: tw check-docs reports a missing anchor, #wal-level-and-logical-replication.

Same proxy fix in #664 (timescaledb-highly-available 1.2.1) and #665 (postgres-multi-location 2.0.1). The 14 templates that bundle this chart adopt 2.8.1 in a later 5376 batch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WZ5WWhTn9mEkPY7cLt1cr4

[github-actions]

Template e2e tests

⚠️ mariadb/1.4.1 — 28/32 passed, 4 warnings (8.7 min, aws-us-east-1)

Scenario	Check	Result
install 1.4.1	install + every workload ready	pass
install 1.4.1	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb10-maria spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb10-maria spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb10-maria spec.defaultOptions.autoscaling.target: stored 95, chart omits it
install 1.4.1	write-read	pass
install 1.4.1	root-login	pass
install 1.4.1	rejects-bad-password	pass
install 1.4.1	data-survives-upgrade	pass
install 1.4.1	no-op upgrade ×2 (no churn)	pass
install 1.4.1	uninstall removes everything	pass
upgrade 1.3.2 → 1.4.1 (new values)	install 1.3.2 (starting point)	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	write-read	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	root-login	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	rejects-bad-password	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	data-survives-upgrade	pass
upgrade 1.3.2 → 1.4.1 (new values)	upgrade to 1.4.1 + every workload ready	pass
upgrade 1.3.2 → 1.4.1 (new values)	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb10u132-maria spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb10u132-maria spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb10u132-maria spec.defaultOptions.autoscaling.target: stored 95, chart omits it
upgrade 1.3.2 → 1.4.1 (new values)	write-read	pass
upgrade 1.3.2 → 1.4.1 (new values)	root-login	pass
upgrade 1.3.2 → 1.4.1 (new values)	rejects-bad-password	pass
upgrade 1.3.2 → 1.4.1 (new values)	data-survives-upgrade	pass
upgrade 1.3.2 → 1.4.1 (new values)	uninstall removes everything	pass
upgrade 1.0.0 → 1.4.1 (new values)	install 1.0.0 (starting point)	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	write-read	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	root-login	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	rejects-bad-password	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	data-survives-upgrade	pass
upgrade 1.0.0 → 1.4.1 (new values)	upgrade to 1.4.1 + every workload ready	pass
upgrade 1.0.0 → 1.4.1 (new values)	rendered == stored (Console Drift tab)	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-maria-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | workload/e2eikn7ewb10u100-maria spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2e
upgrade 1.0.0 → 1.4.1 (new values)	write-read	pass
upgrade 1.0.0 → 1.4.1 (new values)	root-login	pass
upgrade 1.0.0 → 1.4.1 (new values)	rejects-bad-password	pass
upgrade 1.0.0 → 1.4.1 (new values)	data-survives-upgrade	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-maria-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | stdout did not match /^PERSISTED$/ (attempt 6/6): MISSING (rows for 1.0.0: 0) WARNING: option --ssl-verify-server-cert
upgrade 1.0.0 → 1.4.1 (new values)	uninstall removes everything	pass

⚠️ mongodb/1.4.1 — 23/27 passed, 4 warnings (6.8 min, aws-us-east-1)

Scenario	Check	Result
install 1.4.1	install + every workload ready	pass
install 1.4.1	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb11-mongo spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb11-mongo spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb11-mongo spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb11-mongo spec.defaultOptions.timeoutSeconds: stored 5, chart omits it
install 1.4.1	write-read	pass
install 1.4.1	rejects-bad-password	pass
install 1.4.1	data-survives-upgrade	pass
install 1.4.1	no-op upgrade ×2 (no churn)	pass
install 1.4.1	uninstall removes everything	pass
upgrade 1.3.2 → 1.4.1 (new values)	install 1.3.2 (starting point)	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	write-read	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	rejects-bad-password	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	data-survives-upgrade	pass
upgrade 1.3.2 → 1.4.1 (new values)	upgrade to 1.4.1 + every workload ready	pass
upgrade 1.3.2 → 1.4.1 (new values)	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb11u132-mongo spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb11u132-mongo spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb11u132-mongo spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb11u132-mongo spec.defaultOptions.timeoutSeconds: stored 5, char
upgrade 1.3.2 → 1.4.1 (new values)	write-read	pass
upgrade 1.3.2 → 1.4.1 (new values)	rejects-bad-password	pass
upgrade 1.3.2 → 1.4.1 (new values)	data-survives-upgrade	pass
upgrade 1.3.2 → 1.4.1 (new values)	uninstall removes everything	pass
upgrade 1.0.0 → 1.4.1 (new values)	install 1.0.0 (starting point)	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	write-read	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	rejects-bad-password	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	data-survives-upgrade	pass
upgrade 1.0.0 → 1.4.1 (new values)	upgrade to 1.4.1 + every workload ready	pass
upgrade 1.0.0 → 1.4.1 (new values)	rendered == stored (Console Drift tab)	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-mongo-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | workload/e2eikn7ewb11u100-mongo spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2e
upgrade 1.0.0 → 1.4.1 (new values)	write-read	pass
upgrade 1.0.0 → 1.4.1 (new values)	rejects-bad-password	pass
upgrade 1.0.0 → 1.4.1 (new values)	data-survives-upgrade	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-mongo-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | stdout did not match /^PERSISTED$/ (attempt 6/6): MISSING (documents for 1.0.0: 0)
upgrade 1.0.0 → 1.4.1 (new values)	uninstall removes everything	pass

⚠️ mysql/1.5.2 — 31/32 passed, 1 warning (7.3 min, aws-us-east-1)

Scenario	Check	Result
install 1.5.2	install + every workload ready	pass
install 1.5.2	rendered == stored (Console Drift tab)	pass
install 1.5.2	write-read	pass
install 1.5.2	root-login	pass
install 1.5.2	rejects-bad-password	pass
install 1.5.2	data-survives-upgrade	pass
install 1.5.2	no-op upgrade ×2 (no churn)	pass
install 1.5.2	uninstall removes everything	pass
upgrade 1.4.0 → 1.5.2 (new values)	install 1.4.0 (starting point)	pass
upgrade 1.4.0 → 1.5.2 (new values) [before, on 1.4.0]	write-read	pass
upgrade 1.4.0 → 1.5.2 (new values) [before, on 1.4.0]	root-login	pass
upgrade 1.4.0 → 1.5.2 (new values) [before, on 1.4.0]	rejects-bad-password	pass
upgrade 1.4.0 → 1.5.2 (new values) [before, on 1.4.0]	data-survives-upgrade	pass
upgrade 1.4.0 → 1.5.2 (new values)	upgrade to 1.5.2 + every workload ready	pass
upgrade 1.4.0 → 1.5.2 (new values)	rendered == stored (Console Drift tab)	pass
upgrade 1.4.0 → 1.5.2 (new values)	write-read	pass
upgrade 1.4.0 → 1.5.2 (new values)	root-login	pass
upgrade 1.4.0 → 1.5.2 (new values)	rejects-bad-password	pass
upgrade 1.4.0 → 1.5.2 (new values)	data-survives-upgrade	pass
upgrade 1.4.0 → 1.5.2 (new values)	uninstall removes everything	pass
upgrade 1.0.0 → 1.5.2 (new values)	install 1.0.0 (starting point)	pass
upgrade 1.0.0 → 1.5.2 (new values) [before, on 1.0.0]	write-read	pass
upgrade 1.0.0 → 1.5.2 (new values) [before, on 1.0.0]	root-login	pass
upgrade 1.0.0 → 1.5.2 (new values) [before, on 1.0.0]	rejects-bad-password	pass
upgrade 1.0.0 → 1.5.2 (new values) [before, on 1.0.0]	data-survives-upgrade	pass
upgrade 1.0.0 → 1.5.2 (new values)	upgrade to 1.5.2 + every workload ready	pass
upgrade 1.0.0 → 1.5.2 (new values)	rendered == stored (Console Drift tab)	pass
upgrade 1.0.0 → 1.5.2 (new values)	write-read	pass
upgrade 1.0.0 → 1.5.2 (new values)	root-login	pass
upgrade 1.0.0 → 1.5.2 (new values)	rejects-bad-password	pass
upgrade 1.0.0 → 1.5.2 (new values)	data-survives-upgrade	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-mysql-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | stdout did not match /^PERSISTED$/ (attempt 6/6): MISSING (rows for 1.0.0: 0)
upgrade 1.0.0 → 1.5.2 (new values)	uninstall removes everything	pass

⚠️ pgvector/1.0.0 — 7/8 passed, 1 warning (1.7 min, aws-us-east-1)

Scenario	Check	Result
install 1.0.0	install + every workload ready	pass
install 1.0.0	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb13-pgvector spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb13-pgvector spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb13-pgvector spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb13-pgvector spec.defaultOptions.timeoutSeconds: stored 5, chart om
install 1.0.0	write-read	pass
install 1.0.0	extension-works	pass
install 1.0.0	rejects-bad-password	pass
install 1.0.0	data-survives-upgrade	pass
install 1.0.0	no-op upgrade ×2 (no churn)	pass
install 1.0.0	uninstall removes everything	pass

⚠️ postgis/1.4.1 — 28/32 passed, 4 warnings (4.9 min, aws-us-east-1)

Scenario	Check	Result
install 1.4.1	install + every workload ready	pass
install 1.4.1	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb14-postgis spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb14-postgis spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb14-postgis spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb14-postgis spec.defaultOptions.timeoutSeconds: stored 5, chart omits
install 1.4.1	write-read	pass
install 1.4.1	extension-works	pass
install 1.4.1	rejects-bad-password	pass
install 1.4.1	data-survives-upgrade	pass
install 1.4.1	no-op upgrade ×2 (no churn)	pass
install 1.4.1	uninstall removes everything	pass
upgrade 1.3.2 → 1.4.1 (new values)	install 1.3.2 (starting point)	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	write-read	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	extension-works	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	rejects-bad-password	pass
upgrade 1.3.2 → 1.4.1 (new values) [before, on 1.3.2]	data-survives-upgrade	pass
upgrade 1.3.2 → 1.4.1 (new values)	upgrade to 1.4.1 + every workload ready	pass
upgrade 1.3.2 → 1.4.1 (new values)	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb14u132-postgis spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb14u132-postgis spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb14u132-postgis spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb14u132-postgis spec.defaultOptions.timeoutSeconds: stored
upgrade 1.3.2 → 1.4.1 (new values)	write-read	pass
upgrade 1.3.2 → 1.4.1 (new values)	extension-works	pass
upgrade 1.3.2 → 1.4.1 (new values)	rejects-bad-password	pass
upgrade 1.3.2 → 1.4.1 (new values)	data-survives-upgrade	pass
upgrade 1.3.2 → 1.4.1 (new values)	uninstall removes everything	pass
upgrade 1.0.0 → 1.4.1 (new values)	install 1.0.0 (starting point)	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	write-read	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	extension-works	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	rejects-bad-password	pass
upgrade 1.0.0 → 1.4.1 (new values) [before, on 1.0.0]	data-survives-upgrade	pass
upgrade 1.0.0 → 1.4.1 (new values)	upgrade to 1.4.1 + every workload ready	pass
upgrade 1.0.0 → 1.4.1 (new values)	rendered == stored (Console Drift tab)	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-postgis-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | workload/e2eikn7ewb14u100-postgis spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload
upgrade 1.0.0 → 1.4.1 (new values)	write-read	pass
upgrade 1.0.0 → 1.4.1 (new values)	extension-works	pass
upgrade 1.0.0 → 1.4.1 (new values)	rejects-bad-password	pass
upgrade 1.0.0 → 1.4.1 (new values)	data-survives-upgrade	warn — known issue: 1.2.0 renamed the workload and volume set ({release} → {release}-postgis-vs), so upgrading from 1.1.x or older starts on a new, empty volume and the data written on 1.0.0 is gone. Left as is by maintainer ruling 2026-10-26; the README says not to upgrade in place. | stdout did not match /^PERSISTED$/ (attempt 3/3): MISSING (rows for 1.0.0: 0)
upgrade 1.0.0 → 1.4.1 (new values)	uninstall removes everything	pass

⚠️ postgres-highly-available/2.8.0 — 18/20 passed, 2 warnings (12.1 min, aws-us-east-1)

Scenario	Check	Result
install 2.8.0	install + every workload ready	pass
install 2.8.0	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb15-postgres-ha spec.containers[0].livenessProbe.httpGet.scheme: stored "HTTP", chart omits it; workload/e2eikn7ewb15-postgres-ha spec.containers[0].livenessProbe.initialDelaySeconds: stored 60, chart omits it; workload/e2eikn7ewb15-postgres-ha spec.containers[0].livenessProbe.successThreshold: stored 1, chart omits it; workload/e2eikn7ewb15-postgres-ha spec.containers[0].read
install 2.8.0	cluster-healthy	pass
install 2.8.0	write-read-via-proxy	pass
install 2.8.0	rejects-bad-password	pass
install 2.8.0	data-survives-upgrade	pass
install 2.8.0	no-op upgrade ×2 (no churn)	pass
install 2.8.0	uninstall removes everything	pass
upgrade 2.4.1 → 2.8.0 (new values)	install 2.4.1 (starting point)	pass
upgrade 2.4.1 → 2.8.0 (new values) [before, on 2.4.1]	cluster-healthy	pass
upgrade 2.4.1 → 2.8.0 (new values) [before, on 2.4.1]	write-read-via-proxy	pass
upgrade 2.4.1 → 2.8.0 (new values) [before, on 2.4.1]	rejects-bad-password	pass
upgrade 2.4.1 → 2.8.0 (new values) [before, on 2.4.1]	data-survives-upgrade	pass
upgrade 2.4.1 → 2.8.0 (new values)	upgrade to 2.8.0 + every workload ready	pass
upgrade 2.4.1 → 2.8.0 (new values)	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb15u241-postgres-ha spec.containers[0].livenessProbe.httpGet.scheme: stored "HTTP", chart omits it; workload/e2eikn7ewb15u241-postgres-ha spec.containers[0].livenessProbe.initialDelaySeconds: stored 60, chart omits it; workload/e2eikn7ewb15u241-postgres-ha spec.containers[0].livenessProbe.successThreshold: stored 1, chart omits it; workload/e2eikn7ewb15u241-postgres-ha spec.co
upgrade 2.4.1 → 2.8.0 (new values)	cluster-healthy	pass
upgrade 2.4.1 → 2.8.0 (new values)	write-read-via-proxy	pass
upgrade 2.4.1 → 2.8.0 (new values)	rejects-bad-password	pass
upgrade 2.4.1 → 2.8.0 (new values)	data-survives-upgrade	pass
upgrade 2.4.1 → 2.8.0 (new values)	uninstall removes everything	pass

⚠️ redis-cluster/1.7.0 — 18/20 passed, 2 warnings (9.7 min, aws-us-east-1)

Scenario	Check	Result
install 1.7.0	install + every workload ready	pass
install 1.7.0	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb16-redis-cluster spec.rolloutOptions.maxUnavailableReplicas: chart sends "1", API did not keep it; workload/e2eikn7ewb16-redis-cluster spec.rolloutOptions.terminationGracePeriodSeconds: stored 90, chart omits it
install 1.7.0	cluster-healthy	pass
install 1.7.0	write-read	pass
install 1.7.0	rejects-bad-password	pass
install 1.7.0	data-survives-upgrade	pass
install 1.7.0	no-op upgrade ×2 (no churn)	pass
install 1.7.0	uninstall removes everything	pass
upgrade 1.4.3 → 1.7.0 (new values)	install 1.4.3 (starting point)	pass
upgrade 1.4.3 → 1.7.0 (new values) [before, on 1.4.3]	cluster-healthy	pass
upgrade 1.4.3 → 1.7.0 (new values) [before, on 1.4.3]	write-read	pass
upgrade 1.4.3 → 1.7.0 (new values) [before, on 1.4.3]	rejects-bad-password	pass
upgrade 1.4.3 → 1.7.0 (new values) [before, on 1.4.3]	data-survives-upgrade	pass
upgrade 1.4.3 → 1.7.0 (new values)	upgrade to 1.7.0 + every workload ready	pass
upgrade 1.4.3 → 1.7.0 (new values)	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb16u143-redis-cluster spec.rolloutOptions.maxUnavailableReplicas: chart sends "1", API did not keep it; workload/e2eikn7ewb16u143-redis-cluster spec.rolloutOptions.terminationGracePeriodSeconds: stored 90, chart omits it
upgrade 1.4.3 → 1.7.0 (new values)	cluster-healthy	pass
upgrade 1.4.3 → 1.7.0 (new values)	write-read	pass
upgrade 1.4.3 → 1.7.0 (new values)	rejects-bad-password	pass
upgrade 1.4.3 → 1.7.0 (new values)	data-survives-upgrade	pass
upgrade 1.4.3 → 1.7.0 (new values)	uninstall removes everything	pass

✅ tidb/2.2.0 — 10/10 passed (5.6 min, aws-us-east-1, aws-us-east-2, aws-us-west-2)

Scenario	Check	Result
install 2.2.0	install + every workload ready	pass
install 2.2.0	rendered == stored (Console Drift tab)	pass
install 2.2.0	stores-up	pass
install 2.2.0	write-read-via-server	pass
install 2.2.0	write-read-via-proxysql	pass
install 2.2.0	root-password-set	pass
install 2.2.0	rejects-bad-password	pass
install 2.2.0	data-survives-upgrade	pass
install 2.2.0	no-op upgrade ×2 (no churn)	pass
install 2.2.0	uninstall removes everything	pass

⚠️ timescaledb/1.2.0 — 18/20 passed, 2 warnings (3.2 min, aws-us-east-1)

Scenario	Check	Result
install 1.2.0	install + every workload ready	pass
install 1.2.0	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb18-timescaledb spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb18-timescaledb spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb18-timescaledb spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb18-timescaledb spec.defaultOptions.timeoutSeconds: stored
install 1.2.0	write-read	pass
install 1.2.0	extension-works	pass
install 1.2.0	rejects-bad-password	pass
install 1.2.0	data-survives-upgrade	pass
install 1.2.0	no-op upgrade ×2 (no churn)	pass
install 1.2.0	uninstall removes everything	pass
upgrade 1.1.1 → 1.2.0	install 1.1.1 (starting point)	pass
upgrade 1.1.1 → 1.2.0 [before, on 1.1.1]	write-read	pass
upgrade 1.1.1 → 1.2.0 [before, on 1.1.1]	extension-works	pass
upgrade 1.1.1 → 1.2.0 [before, on 1.1.1]	rejects-bad-password	pass
upgrade 1.1.1 → 1.2.0 [before, on 1.1.1]	data-survives-upgrade	pass
upgrade 1.1.1 → 1.2.0	upgrade to 1.2.0 + every workload ready	pass
upgrade 1.1.1 → 1.2.0	rendered == stored (Console Drift tab)	warn — workload/e2eikn7ewb18u111-timescaledb spec.defaultOptions.autoscaling.maxConcurrency: stored 0, chart omits it; workload/e2eikn7ewb18u111-timescaledb spec.defaultOptions.autoscaling.scaleToZeroDelay: stored 300, chart omits it; workload/e2eikn7ewb18u111-timescaledb spec.defaultOptions.autoscaling.target: stored 95, chart omits it; workload/e2eikn7ewb18u111-timescaledb spec.defaultOptions.timeou
upgrade 1.1.1 → 1.2.0	write-read	pass
upgrade 1.1.1 → 1.2.0	extension-works	pass
upgrade 1.1.1 → 1.2.0	rejects-bad-password	pass
upgrade 1.1.1 → 1.2.0	data-survives-upgrade	pass
upgrade 1.1.1 → 1.2.0	uninstall removes everything	pass

Run logs

[jacobecox]

Combined into #685 so work item 5376 is one merge (maintainer request). This branch is merged into it unchanged; the write-up and test evidence above stay the reference for this template.