[25.x] Use hashed properties rather than version (#922)

* use hashed pro
perties rather than version

* add changelog

* Add regression test

(cherry picked from commit ce69bb3)

Author: andrewstucki

.changes/unreleased/operator-Fixed-20250617-113325.yaml

@@ -0,0 +1,4 @@
+project: operator
+kind: Fixed
+body: Fixed a bug where pods would be restarted indefinitely in the case of config version changes when syncing cluster configuration.
+time: 2025-06-17T11:33:25.480184-04:00

operator/CHANGELOG.md

@@ -98,6 +98,7 @@ This is required to ensure that a pre-existing sts can roll over to new configur
 * `get` permissions on `Node` resources is now correctly configured by default.
 
    `--set rbac.createAdditionalControllerCRs=true` is no longer required for rackawareness to work.
+* Fixed a bug where pods would be restarted indefinitely in the case of config version changes when syncing cluster configuration.
 
 ## [v25.1.1-beta3](https://github.com/redpanda-data/redpanda-operator/releases/tag/operator%2Fv25.1.1-beta3) - 2025-05-07
 ### Added

operator/internal/controller/redpanda/redpanda_controller.go

@@ -14,7 +14,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"strconv"
 	"strings"
 	"time"
 
@@ -584,8 +583,7 @@ func (r *RedpandaReconciler) reconcileClusterConfig(ctx context.Context, admin *
 		return "", false, errors.WithStack(err)
 	}
 
-	// TODO: this needs to be updated when the hashing code lands
-	return strconv.FormatInt(configStatus.Version, 10), configStatus.NeedsRestart, nil
+	return configStatus.PropertiesThatNeedRestartHash, configStatus.NeedsRestart, nil
 }
 
 func (r *RedpandaReconciler) configSyncMode(ctx context.Context, rp *redpandav1alpha2.Redpanda) syncclusterconfig.SyncerMode {

operator/internal/controller/redpanda/redpanda_controller_test.go

@@ -414,6 +414,44 @@ func (s *RedpandaControllerSuite) TestClusterSettings() {
 	s.deleteAndWait(rp)
 }
 
+func (s *RedpandaControllerSuite) TestClusterSettingsRegressionSuperusers() {
+	rp := s.minimalRP()
+	rp.Annotations[redpanda.RestartClusterOnConfigChangeKey] = "true"
+
+	// Ensure that some superusers exist.
+	rp.Spec.ClusterSpec.Auth = &redpandav1alpha2.Auth{
+		SASL: &redpandav1alpha2.SASL{
+			Enabled: ptr.To(true),
+			Users: []redpandav1alpha2.UsersItems{
+				{Name: ptr.To("bob"), Password: ptr.To("bobert")},
+				{Name: ptr.To("alice"), Password: ptr.To("alicert")},
+			},
+		},
+	}
+
+	s.applyAndWait(rp)
+
+	initialVersion := rp.Status.ConfigVersion
+
+	// Add a superuser and ensure we don't change the config version (since we now hash).
+	rp.Spec.ClusterSpec.Auth = &redpandav1alpha2.Auth{
+		SASL: &redpandav1alpha2.SASL{
+			Enabled: ptr.To(true),
+			Users: []redpandav1alpha2.UsersItems{
+				{Name: ptr.To("bob"), Password: ptr.To("bobert")},
+				{Name: ptr.To("alice"), Password: ptr.To("alicert")},
+				{Name: ptr.To("ted"), Password: ptr.To("tedrt")},
+			},
+		},
+	}
+
+	s.applyAndWait(rp)
+
+	s.Require().Equal(initialVersion, rp.Status.ConfigVersion)
+
+	s.deleteAndWait(rp)
+}
+
 func (s *RedpandaControllerSuite) TestLicenseReal() {
 	const (
 		LicenseEnvVar             = "REDPANDA_SAMPLE_LICENSE"