Emit resourceRef.apiVersion on restate-workload-identity IAMPolicyMember#136
Open
pcholakov wants to merge 1 commit into
Open
Emit resourceRef.apiVersion on restate-workload-identity IAMPolicyMember#136pcholakov wants to merge 1 commit into
pcholakov wants to merge 1 commit into
Conversation
The operator's server-side apply of restate-workload-identity IAMPolicyMember was stripping resourceRef.apiVersion from the existing CR (which Config Connector defaults at creation), triggering the deny-immutable-field-updates webhook on every reconcile after the initial create. Wedges the operator on any RestateCluster update. Add apiVersion to IAMPolicyMemberResourceRef and set it to iam.cnrm.cloud.google.com/v1beta1 when constructing the workload- identity binding, since the referenced resource is always an IAMServiceAccount. The webhook only fires on changes to immutable fields; emitting the same value CC defaulted is a no-op there. Surfaced by restatedev/restate-cloud#833 during dev canary validation of per-environment GCP service account identity.
Contributor
Author
|
Tested by switching to the PR docker image, and that fixed the issue I was seeing, btw! |
lukebond
approved these changes
May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The operator's server-side apply of the
restate-workload-identityIAMPolicyMemberCR was sendingspec.resourceRefwithoutapiVersion. Config Connector defaults that field at creation, but SSA's atomic-struct semantics strip the defaulted value on every subsequent apply, and CC'sdeny-immutable-field-updateswebhook then denies the change with:Reconcile loops on this and blocks any unrelated
RestateClusterupdate (e.g. image overrides) from propagating.This change adds
apiVersiontoIAMPolicyMemberResourceRefand sets it toiam.cnrm.cloud.google.com/v1beta1when constructing the workload-identity binding (the referenced resource is always anIAMServiceAccount). The webhook only fires on changes to immutable fields, and the value the operator now emits matches what Config Connector defaulted at create time, so the apply becomes a no-op for that field.Related: restatedev/restate-cloud#833
Quality gates
All green inside the workspace:
cargo check: passescargo nextest run --all-features: 48 passed, 1 skippedcargo fmt --all -- --check: clean for files touched by this PR (a pre-existing fmt diff insrc/resources/restatedeployments.rs:375is onmainand out of scope here)cargo clippy --all-features --all-targets -- -D warnings: cleanRollout note
This needs an operator chart version bump and a Nuon roll to land on existing BYOC installs that are wedged on the immutability webhook.
Test plan
IAMPolicyMemberreconciles cleanly and the wedge clearsRestateClusterimage override applies without retriggering the webhookIAMPolicyMemberis created and reachesReady=True