Avoid reconcile loop in netpol peer list (#73)

jackkleeman · web-flow · commit 22efaf01a4da · 2025-12-15T10:09:56.000Z
* Fix #72: Avoid reconcile loop in netpol peer list * Release 1.9.2
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "restate-operator"
-version = "1.9.1"
+version = "1.9.2"
 authors = ["restate.dev"]
 edition = "2021"
 rust-version = "1.86"
diff --git a/charts/restate-operator-helm/Chart.yaml b/charts/restate-operator-helm/Chart.yaml
@@ -2,4 +2,4 @@ apiVersion: v2
 name: restate-operator-helm
 description: An operator for Restate clusters
 type: application
-version: "1.9.1"
+version: "1.9.2"
diff --git a/src/controllers/restatecluster/reconcilers/network_policies.rs b/src/controllers/restatecluster/reconcilers/network_policies.rs
@@ -172,7 +172,9 @@ fn allow_access(
             policy_types: Some(vec!["Ingress".into()]),
             ingress: peers.map(|peers| {
                 vec![NetworkPolicyIngressRule {
-                    from: Some(peers),
+                    // 'If this field is empty or missing, this rule matches all sources (traffic not restricted by source)'
+                    // Empty array is normalised by apiserver -> missing array, so to avoid a reconcile loop we do that here
+                    from: if peers.is_empty() { None } else { Some(peers) },
                     ports: Some(vec![NetworkPolicyPort {
                         protocol: Some("TCP".into()),
                         port: Some(IntOrString::Int(port)),
