ServiceAccount annotations are not preserved during CSV update #3607
Description
Currently, when a ClusterServiceVersion (CSV) is updated, the EnsureServiceAccount function in pkg/controller/operators/catalog/step_ensurer.go reconciles the associated ServiceAccount.
The problem is that this function does not preserve existing annotations on the ServiceAccount. It retrieves the old ServiceAccount but only carries over the Secrets and OwnerReferences, overwriting any other metadata like annotations. This can lead to the loss of important annotations that may have been added by users or other controllers.
To address this, I propose modifying the EnsureServiceAccount function to merge the existing annotations from the old ServiceAccount with the annotations from the new ServiceAccount object. The new annotations should take precedence in case of conflicts.
Here is the proposed code change:
// EnsureServiceAccount writes the specified ServiceAccount object to the cluster.
func (o *StepEnsurer) EnsureServiceAccount(namespace string, sa *corev1.ServiceAccount) (status v1alpha1.StepStatus, err error) {
_, createErr := o.kubeClient.KubernetesInterface().CoreV1().ServiceAccounts(namespace).Create(context.TODO(), sa, metav1.CreateOptions{})
if createErr == nil {
status = v1alpha1.StepStatusCreated
return
}
if !apierrors.IsAlreadyExists(createErr) {
err = errorswrap.Wrapf(createErr, "error creating service account: %s", sa.GetName())
return
}
- // Carrying secrets through the service account update.
+ // Carrying secrets and annotations through the service account update.
preSA, getErr := o.kubeClient.KubernetesInterface().CoreV1().ServiceAccounts(namespace).Get(context.TODO(),
sa.Name,
metav1.GetOptions{})
if getErr != nil {
err = errorswrap.Wrapf(getErr, "error getting older version of service account: %s", sa.GetName())
return
}
sa.Secrets = preSA.Secrets
sa.OwnerReferences = mergedOwnerReferences(preSA.OwnerReferences, sa.OwnerReferences)
+ // Merge annotations, giving precedence to the new ones.
+ if sa.Annotations == nil {
+ sa.Annotations = make(map[string]string)
+ }
+ for k, v := range preSA.Annotations {
+ if _, ok := sa.Annotations[k]; !ok {
+ sa.Annotations[k] = v
+ }
+ }
+
sa.SetNamespace(namespace)
// Use DeepDerivative to check if new SA is the same as the old SA. If no field is changed, we skip the update call.
if !apiequality.Semantic.DeepDerivative(sa, preSA) {
if _, updateErr := o.kubeClient.UpdateServiceAccount(sa); updateErr != nil {
err = errorswrap.Wrapf(updateErr, "error updating service account: %s", sa.GetName())
return
}
}
status = v1alpha1.StepStatusPresent
return
}This change will ensure that annotations on ServiceAccounts are preserved across CSV updates.