[Bug]: Failover quorum check can use outdated metadata

Is there an existing issue already for this bug?

• I have searched for an existing issue, and could not find anything. I believe this is a new bug.

I have read the troubleshooting guide

• I have read the troubleshooting guide and I think this is a new bug.

I am running a supported version of CloudNativePG

• I have read the troubleshooting guide and I think this is a new bug.

Version

trunk (main), checked at d2c5ccdc.

What version of Kubernetes are you using?

1.36

What is your Kubernetes environment?

Self-managed: kind (evaluation)

How did you install the operator?

YAML manifest

What happened?

With synchronous replication and failover quorum enabled, evaluateQuorumCheck reads FailoverQuorum from the controller cache.

After synchronous replication settings change, the cache can still hold old quorum metadata. The check can then allow a promotion that the current metadata in Kubernetes would reject. This could allow a replica to become primary without having all the writes already acknowledged to clients.

The quorum check should use current metadata when deciding whether to allow promotion.

I’ve prepared a fix with regression tests and would like to open a PR.

This finding came from Specula. I'm part of the team.

Reproduction script and steps

Code of Conduct

• I agree to follow this project's Code of Conduct