docs: import CloudNativePG main

Author: cnpg-bot

website/docs/installation_upgrade.md

@@ -399,23 +399,14 @@ sensitive endpoints of the instance manager's status port (backup,
 `pg_controldata`, partial WAL archive, and instance-manager upgrade) by pinning
 an in-memory client certificate. This is enabled automatically and requires no
 configuration. Status, health, and probe endpoints remain unauthenticated.
-This hardening is not backported; on releases earlier than 1.30.0, continue to
-restrict the status port (TCP 8000) with a `NetworkPolicy`, which remains its
-security boundary there. See
+This protection has a hard requirement: the status port **must** be served
+over TLS, which has been the default since v1.24. This hardening is not
+backported; on releases earlier than 1.30.0, continue to restrict the status
+port (TCP 8000) with a `NetworkPolicy`, which remains its security boundary
+there. See
 [Operator-to-instance authentication](security.md#operator-to-instance-authentication)
 for details.
 
-:::warning
-This protection has a hard requirement: the status port **must** be served over
-TLS, which has been the default since v1.24. Instances created by an operator
-older than v1.24 serve the status port over plain HTTP; once their instance
-manager is upgraded to 1.30.0 the operator can no longer authenticate to them
-and every call to the protected endpoints is **permanently** rejected with
-`401 Unauthorized`. If you still run such instances, perform a rolling update so
-their Pods are recreated with a TLS-enabled status port. Instances created by
-v1.24 or later are unaffected.
-:::
-
 #### Metrics exporter privilege separation (`CVE-2026-44477`)
 
 This applies only if you are upgrading from a release **older than 1.29.1 or

website/docs/security.md

@@ -895,23 +895,9 @@ unauthenticated.
 The certificate is never written to disk and is regenerated on every operator
 restart, so trust derives from fingerprint pinning rather than CA validation.
 
-This protection has a hard requirement: the status port **must** be served over
-TLS, which has been the default since v1.24. A client certificate can only be
-presented over a TLS connection, so the protected endpoints are reachable by the
-operator only when the status port uses TLS.
-
-:::warning
-If the status port is not served over TLS, the instance manager cannot
-authenticate the operator and **permanently** rejects every call to its
-protected endpoints (backup, `pg_controldata`, partial WAL archive, and
-instance-manager upgrade) with `401 Unauthorized`. This is not a transient
-condition and will not resolve on its own. It can affect instances created by an
-operator older than v1.24 (whose status port serves plain HTTP) once their
-instance manager is upgraded to a version that enforces this authentication: such
-instances must be rolled out so their Pods are recreated with a TLS-enabled status
-port. Newly created instances always enable TLS on the status port and are
-unaffected.
-:::
+A client certificate can only be presented over a TLS connection, and the
+instance manager always serves the status port over TLS, so this protection is
+unconditional.
 
 ### PostgreSQL