Kubernetes Operator changelog

​

Restate Operator v2.5.1 Release Notes

​

Highlights

• Fix: Knative deployments now work with Restate Cloud — The Knative reconciler was passing raw in-cluster Route URLs to the Restate admin API, which Restate Cloud cannot reach. Service URLs are now routed through the cloud tunnel, matching the existing ReplicaSet behavior.

​

Bug Fixes

​

Knative service URLs not tunneled for Restate Cloud

• Knative + Restate Cloud deployments: This was broken; it now works.
• Knative + non-Cloud deployments: No change; maybe_tunnel_url is a no-op when cloud is not set.
• ReplicaSet deployments: No change. The internal refactoring of service_url_for_deployment() is equivalent to the previous behavior.

​

Upgrading

helm upgrade restate-operator restatedev/restate-operator --version 2.5.1

​

Restate Operator v2.5.0 Release Notes

​

Highlights

• Custom pod annotations and labels — RestateCluster now supports spec.compute.annotations and spec.compute.labels, enabling integrations that require pod-level metadata (GKE ComputeClass, Vault agent injection, Prometheus scraping, etc.).
• Default canary image changed to alpine:3.21 — Fixes trustedCaCerts (introduced in v2.4.0), which required a CA bundle that the previous busybox:uclibc default did not ship.
• Default tunnel client image bumped to 0.6.0 — Picks up the latest restate-cloud-tunnel-client release for new RestateCloudEnvironment deployments.

​

New Features

​

Custom pod annotations and labels

• Existing deployments: No impact, both fields are optional.
• New deployments: Can now set annotations and labels for integrations that require them on the pod template.

spec:
  compute:
    annotations:
      cloud.google.com/compute-class: "restate-workload"
    labels:
      team: "platform"

​

Bug Fixes

​

Default canary image now ships a CA bundle

cat: can't open '/etc/ssl/certs/ca-certificates.crt': No such file or directory

• Existing deployments using trustedCaCerts: Will work after upgrading. If you previously worked around this by setting canaryImage to an image with a CA bundle, you can remove that override.
• Existing deployments not using trustedCaCerts: No impact. The canary image is also used for Pod Identity and Workload Identity canary jobs, which do not depend on the CA bundle and will continue to work with alpine:3.21.
• Custom canaryImage overrides: If you use a custom canary image, ensure it includes a CA bundle at /etc/ssl/certs/ca-certificates.crt if you plan to use trustedCaCerts.

# Image must have /etc/ssl/certs/ca-certificates.crt and provide cat, grep, wget
canaryImage: my-registry.example.com/alpine:3.21

​

Improvements

​

Default tunnel client image bumped to 0.6.0

• Existing deployments pinning their own tunnel client image: no impact.
• Deployments relying on the operator default: will pick up 0.6.0 on the next reconcile after upgrade.

​

Upgrading

kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restateclusters.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restatedeployments.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restatecloudenvironments.yaml

helm upgrade restate-operator restatedev/restate-operator --version 2.5.0

​

Restate Operator v2.4.0 Release Notes

​

Highlights

• Trusted CA certificates - RestateCluster now supports custom trusted CA certificates via spec.security.trustedCaCerts, removing the need for custom Restate images when using internal CAs.
• Configurable canary image - The canary job image is now configurable via Helm, supporting air-gapped and restricted registry environments.
• IPv6 support - The operator now binds to a dual-stack address, fixing readiness probe failures on IPv6-only clusters.
• Faster drain cleanup - Old deployment versions are now polled every 10 seconds during drain, instead of waiting up to 5 minutes.

​

New Features

​

Trusted CA certificates

spec:
  security:
    trustedCaCerts:
      - secretName: internal-ca
        key: ca.pem

​

Configurable canary image

canaryImage: my-registry.example.com/busybox:uclibc

docker pull busybox:uclibc
docker tag busybox:uclibc my-registry.example.com/busybox:uclibc
docker push my-registry.example.com/busybox:uclibc

​

Bug Fixes

​

IPv6 dual-stack support

​

Faster drain cleanup polling

​

Upgrading

kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.4.0/restateclusters.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.4.0/restatedeployments.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.4.0/restatecloudenvironments.yaml

helm upgrade restate-operator restatedev/restate-operator --version 2.4.0

​

Restate Operator v2.3.1 Release Notes

​

Highlights

• Fix: GCP Workload Identity now requires explicit opt-in via gcpWorkloadIdentity: true Helm value, fixing a 403 error loop on non-GCP clusters introduced in v2.3.0.

​

Bug Fixes

​

IAMPolicyMember cleanup causes 403 on non-GCP clusters

• Non-GCP clusters: The 403 reconcile loop is fixed. No action needed.
• GCP clusters using Workload Identity: You must now set gcpWorkloadIdentity: true in your Helm values.

gcpWorkloadIdentity: true

​

Upgrading

helm upgrade restate-operator restatedev/restate-operator --version 2.3.1

​

Restate Operator v2.3.0

​

✨ New Features

• GCP Workload Identity via Config Connector — The operator now automatically creates IAMPolicyMember resources to bind Kubernetes service accounts to GCP service accounts via Workload Identity. This is triggered when a RestateCluster has iam.gke.io/gcp-service-account in serviceAccountAnnotations. The GCP project ID is extracted from the service account email, so no additional configuration is needed beyond the annotation. A canary job validates that credentials are available before the StatefulSet proceeds. This mirrors the existing AWS Pod Identity Association pattern and requires Config Connector to be installed on the GKE cluster.
• Configurable cluster DNS suffix — The operator now supports configuring the Kubernetes cluster DNS suffix via the --cluster-dns CLI flag, CLUSTER_DNS environment variable, or Helm clusterDns value. Previously cluster.local was hardcoded in all internal service URLs. This is needed for multi-cluster setups, federated environments, and clusters with custom DNS naming.
• Configurable drain delay — Added drainDelaySeconds to the RestateDeployment CRD’s spec.restate section. This controls how long the operator waits after a deployment is drained before removing the old version. Default remains 300 seconds (5 minutes). (https://github.com/restatedev/restate-operator/pull/96)

​

🐛 Bug Fixes

• Improved admin API error messages — When a deployment registration is rejected by the admin API (e.g. breaking changes without --force), the error message now includes the response from Restate and is logged and emitted as a Kubernetes event, making failures much easier to diagnose. (#100)
• Fixed canary job completion detection — Fixed a bug where a completed canary job was treated as still pending, causing the operator to loop indefinitely with a NotReady status condition. (#102)

​

⚙️ Configuration Changes

• New Helm value clusterDns for configuring the cluster DNS suffix (default: cluster.local)
• Conditional RBAC for IAMPolicyMember CRDs when GCP Workload Identity is enabled

​

⚠️ Upgrading Notes

kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.3.0/restateclusters.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.3.0/restatedeployments.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.3.0/restatecloudenvironments.yaml

helm upgrade restate-operator restatedev/restate-operator --version 2.3.0

​

Restate Operator v2.2.0

​

✨ New Features

• Knative Serving deployment mode — RestateDeployment now supports Knative Serving as an alternative to traditional ReplicaSets. This enables:
  • Scale-to-zero: Services automatically scale down when idle, saving resources
  • Automatic scaling: Replicas scale based on concurrent request load
  • In-place updates: Update service implementation without changing Restate deployment identity
  • Tag-based identity: Control versioning behavior with the tag field — same tag means in-place update, changed tag means versioned update, no tag means auto-versioning
  See the Knative Serving Mode documentation for details. (https://github.com/restatedev/restate-operator/pull/64)

​

🐛 Bug Fixes

• Fix DNS network policy for NodeLocal DNSCache — The operator now creates DNS egress policies that work with both traditional kube-dns and NodeLocal DNSCache (169.254.20.10). This fixes DNS resolution issues on GKE Autopilot and other Kubernetes environments using node-local DNS caching. (https://github.com/restatedev/restate-operator/pull/88)

​

⚙️ Configuration Changes

• Default partitions increased to 24 — The default number of partitions is now 24 (previously lower), providing better parallelism for most workloads. (https://github.com/restatedev/restate-operator/pull/84)

​

📝 Documentation

• Added dedicated Knative Serving mode section to README with examples and tag-based versioning guide
• Added troubleshooting section for DNS resolution issues
• Updated RocksDB memory documentation (https://github.com/restatedev/restate-operator/pull/82)

​

⚠️ Upgrading Notes

kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.2.0/restateclusters.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.2.0/restatedeployments.yaml
kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.2.0/restatecloudenvironments.yaml

Note: The restatedeployments CRD update is especially important for this release as it includes the new Knative Serving deployment mode fields.

helm upgrade restate-operator restatedev/restate-operator --version 2.2.0

​

New Contributors

• @AhmedSoliman made their first contribution in https://github.com/restatedev/restate-operator/pull/82

​

✨ New Features

• Operator-driven cluster provisioning - Added support for automatic cluster provisioning via the new spec.cluster.autoProvision field. When enabled, the operator will automatically provision the Restate cluster by calling the gRPC ProvisionCluster API after pods are running. This is particularly useful for multi-node clusters where manual provisioning was previously required. The provisioning status is tracked in status.provisioned to prevent repeated provisioning attempts. (#55)

  ⚠️ Important: When using cluster.autoProvision: true, you must set auto-provision = false in your Restate config to avoid split brain situations.

  🎯 cluster.autoProvision: true is the recommended approach for provisioning Restate clusters.

​

🔧 Improvements

• Simplified example configurations by removing default values that are no longer needed (replicated loglet and replicated metadata server are now defaults)

​

🏗️ CRD Changes

• Added spec.cluster.autoProvision field to enable operator-managed cluster provisioning
• Added status.provisioned field to track provisioning state

​

⬆️ Upgrading

kubectl apply -f https://github.com/restatedev/restate-operator/releases/download/v2.1.0/restateclusters.yaml
kubectl apply -f https://github.com/restatedev/restate-operator/releases/download/v2.1.0/restatedeployments.yaml
kubectl apply -f https://github.com/restatedev/restate-operator/releases/download/v2.1.0/restatecloudenvironments.yaml

​

What’s Changed

• Update default tunnel client version by @jackkleeman in https://github.com/restatedev/restate-operator/pull/81

​

What’s Changed

• Avoid reconcile loop in netpol peer list by @jackkleeman in https://github.com/restatedev/restate-operator/pull/73

​

What’s Changed

• Ignore completed invs when determining active invocations by @jackkleeman in https://github.com/restatedev/restate-operator/pull/71

​

What’s Changed

• [Security] Update assorted dependencies by @pcholakov in https://github.com/restatedev/restate-operator/pull/69
• Support existing namespaces by @jackkleeman in https://github.com/restatedev/restate-operator/pull/70

​

What’s Changed

• Add priorityClassName to restatecluster by @pcholakov in https://github.com/restatedev/restate-operator/pull/63
• Release v1.8.4 by @pcholakov in https://github.com/restatedev/restate-operator/pull/66

​

What’s Changed

• Add service path parameter by @krisztiansala in https://github.com/restatedev/restate-operator/pull/56
• feat: Add topology spread constraints support to RestateCluster by @EronWright in https://github.com/restatedev/restate-operator/pull/60
• Delete jobs on immutable conflict by @jackkleeman in https://github.com/restatedev/restate-operator/pull/61
• Release v1.8.3 by @pcholakov in https://github.com/restatedev/restate-operator/pull/62

​

New Contributors

• @EronWright made their first contribution in https://github.com/restatedev/restate-operator/pull/60

​

What’s Changed

• Allow cleaning up old replicasets while the new one is not ready by @jackkleeman in https://github.com/restatedev/restate-operator/pull/59

​

What’s Changed

• Support registering at a subpath by @jackkleeman in https://github.com/restatedev/restate-operator/pull/37
• Allow setting the http1.1 flag from the restate operator by @damianr13 in https://github.com/restatedev/restate-operator/pull/38
• Fix cleanup replicasets to only look at those in this ns by @jackkleeman in https://github.com/restatedev/restate-operator/pull/41
• Add RestateCluster compute spec imagePullSecrets property by @pcholakov in https://github.com/restatedev/restate-operator/pull/39
• Add volumeAttributesClassName by @jackkleeman in https://github.com/restatedev/restate-operator/pull/42
• Add support for custom restate entrypoint/args by @pcholakov in https://github.com/restatedev/restate-operator/pull/43

​

New Contributors

• @damianr13 made their first contribution in https://github.com/restatedev/restate-operator/pull/38

​

What’s Changed

• fix: Honor use_http11 flag by @krisztiansala in https://github.com/restatedev/restate-operator/pull/52
• fix: Add restatecloudenvironment crd to the helm chart

​

New Contributors

• @krisztiansala made their first contribution in https://github.com/restatedev/restate-operator/pull/52

​

What’s Changed

• Add initial readiness delay by @jackkleeman in https://github.com/restatedev/restate-operator/pull/44
• Add RestateCloudEnvironment by @jackkleeman in https://github.com/restatedev/restate-operator/pull/40
• Don’t propagate last applied configuration annotation by @jackkleeman in https://github.com/restatedev/restate-operator/pull/46
• Add warnings about minio by @jackkleeman in https://github.com/restatedev/restate-operator/pull/47

​

What’s Changed

• Fix: add missing patch events to RBAC config by @2snEM6 in https://github.com/restatedev/restate-operator/pull/35

​

New Contributors

• @2snEM6 made their first contribution in https://github.com/restatedev/restate-operator/pull/35

​

What’s Changed

• Document all of operator CRD by @haf in https://github.com/restatedev/restate-operator/pull/30
• Split out minio docs and document network isolation by @jackkleeman in https://github.com/restatedev/restate-operator/pull/33

​

New Contributors

• @haf made their first contribution in https://github.com/restatedev/restate-operator/pull/30

​

What’s Changed

• Netpol fixes by @jackkleeman in https://github.com/restatedev/restate-operator/pull/28

​

What’s Changed

• Allow restate clusters to talk to themselves by @jackkleeman in https://github.com/restatedev/restate-operator/pull/26
• Document cluster better by @jackkleeman in https://github.com/restatedev/restate-operator/pull/27

​

What’s Changed

• Add RestateDeployment v1beta1 crd by @jackkleeman in https://github.com/restatedev/restate-operator/pull/20
• Create pdb for clusters by @jackkleeman in https://github.com/restatedev/restate-operator/pull/25

​

What’s Changed

• Set RESTATE_NODE_NAME to POD_NAME by default by @tillrohrmann in https://github.com/restatedev/restate-operator/pull/21
• Set pod management policy to parallel by @tillrohrmann in https://github.com/restatedev/restate-operator/pull/23

​

What’s Changed

• Add CLA automation by @tillrohrmann in https://github.com/restatedev/restate-operator/pull/18
• Make it easier to run a multinode cluster with the operator by @jackkleeman in https://github.com/restatedev/restate-operator/pull/19

​

New Contributors

• @tillrohrmann made their first contribution in https://github.com/restatedev/restate-operator/pull/18

​

What’s Changed

• Added affinity to restate operator by @kumorikarasu in https://github.com/restatedev/restate-operator/pull/17

​

New Contributors

• @kumorikarasu made their first contribution in https://github.com/restatedev/restate-operator/pull/17

​

What’s Changed

• Fix papercuts by @jackkleeman in https://github.com/restatedev/restate-operator/pull/16

​

What’s Changed

• Use predicates to dedupe changes to cm, svc, ss, job by @jackkleeman in https://github.com/restatedev/restate-operator/pull/13

​

What’s Changed

• Node selector support by @jackkleeman in https://github.com/restatedev/restate-operator/pull/12

​

What’s Changed

• Add support for specifying restate pod tolerations by @pcholakov in https://github.com/restatedev/restate-operator/pull/11

​

New Contributors

• @pcholakov made their first contribution in https://github.com/restatedev/restate-operator/pull/11

​

What’s Changed

• Add config file support by @jackkleeman in https://github.com/restatedev/restate-operator/pull/10

​

What’s Changed

• Bump rustls from 0.21.10 to 0.21.12 by @dependabot in https://github.com/restatedev/restate-operator/pull/9
• Bump h2 from 0.3.24 to 0.3.26 by @dependabot in https://github.com/restatedev/restate-operator/pull/8
• RUST_LOG is no longer set to debug; uses Restate default of info. Set the environment variable in the RestateCluster object to override.

​

What’s Changed

• Canary pods need to be created via Jobs by @jackkleeman in https://github.com/restatedev/restate-operator/pull/7

​

What’s Changed

• Signing key integration by @jackkleeman in https://github.com/restatedev/restate-operator/pull/6

​

What’s Changed

• Avoid apply loops with predicate filters by @jackkleeman in https://github.com/restatedev/restate-operator/pull/5

​

What’s Changed

• Bump mio from 0.8.10 to 0.8.11 by @dependabot in https://github.com/restatedev/restate-operator/pull/4

​

New Contributors

• @dependabot made their first contribution in https://github.com/restatedev/restate-operator/pull/4

​

What’s Changed

• Propagate labels and annotations into all created objects by @jackkleeman in https://github.com/restatedev/restate-operator/pull/3

​

What’s Changed

• SecurityGroupPolicy support by @jackkleeman in https://github.com/restatedev/restate-operator/pull/2