Properly overwrite empty allowed source ranges for load balancers

pkg/cluster/k8sres.go

@@ -961,13 +961,15 @@ func (c *Cluster) generateService(role PostgresRole, spec *acidv1.PostgresSpec)
 		// safe default value: lock load balancer to only local address unless overridden explicitly.
 		sourceRanges := []string{localHost}
 
-		allowedSourceRanges := spec.AllowedSourceRanges
-		if len(allowedSourceRanges) >= 0 {
-			sourceRanges = allowedSourceRanges
+		// spec.AllowedSourceRanges evaluates to the empty slice of zero length
+		// when omitted or set to 'null'/empty sequence in the PG manifest
+		if len(spec.AllowedSourceRanges) > 0 {
+			sourceRanges = spec.AllowedSourceRanges
 		}
 
 		serviceSpec.Type = v1.ServiceTypeLoadBalancer
 		serviceSpec.LoadBalancerSourceRanges = sourceRanges
+		c.logger.Debugf("final load balancer source ranges as seen in a service spec (not necessarily applied): %q", serviceSpec.LoadBalancerSourceRanges)
 
 		annotations = map[string]string{
 			constants.ZalandoDNSNameAnnotation: dnsName,