ServiceAccount annotations are not preserved during CSV update

[kaovilai]

Currently, when a ClusterServiceVersion (CSV) is updated, the EnsureServiceAccount function in pkg/controller/operators/catalog/step_ensurer.go reconciles the associated ServiceAccount.

The problem is that this function does not preserve existing annotations on the ServiceAccount. It retrieves the old ServiceAccount but only carries over the Secrets and OwnerReferences, overwriting any other metadata like annotations. This can lead to the loss of important annotations that may have been added by users or other controllers.

To address this, I propose modifying the EnsureServiceAccount function to merge the existing annotations from the old ServiceAccount with the annotations from the new ServiceAccount object. The new annotations should take precedence in case of conflicts.

Here is the proposed code change:

// EnsureServiceAccount writes the specified ServiceAccount object to the cluster.
func (o *StepEnsurer) EnsureServiceAccount(namespace string, sa *corev1.ServiceAccount) (status v1alpha1.StepStatus, err error) {
	_, createErr := o.kubeClient.KubernetesInterface().CoreV1().ServiceAccounts(namespace).Create(context.TODO(), sa, metav1.CreateOptions{})
	if createErr == nil {
		status = v1alpha1.StepStatusCreated
		return
	}

	if !apierrors.IsAlreadyExists(createErr) {
		err = errorswrap.Wrapf(createErr, "error creating service account: %s", sa.GetName())
		return
	}

-	// Carrying secrets through the service account update.
+	// Carrying secrets and annotations through the service account update.
	preSA, getErr := o.kubeClient.KubernetesInterface().CoreV1().ServiceAccounts(namespace).Get(context.TODO(),
		sa.Name,
		metav1.GetOptions{})
	if getErr != nil {
		err = errorswrap.Wrapf(getErr, "error getting older version of service account: %s", sa.GetName())
		return
	}
	sa.Secrets = preSA.Secrets
	sa.OwnerReferences = mergedOwnerReferences(preSA.OwnerReferences, sa.OwnerReferences)

+	// Merge annotations, giving precedence to the new ones.
+	if sa.Annotations == nil {
+		sa.Annotations = make(map[string]string)
+	}
+	for k, v := range preSA.Annotations {
+		if _, ok := sa.Annotations[k]; !ok {
+			sa.Annotations[k] = v
+		}
+	}
+
	sa.SetNamespace(namespace)

	// Use DeepDerivative to check if new SA is the same as the old SA. If no field is changed, we skip the update call.
	if !apiequality.Semantic.DeepDerivative(sa, preSA) {
		if _, updateErr := o.kubeClient.UpdateServiceAccount(sa); updateErr != nil {
			err = errorswrap.Wrapf(updateErr, "error updating service account: %s", sa.GetName())
			return
		}
	}

	status = v1alpha1.StepStatusPresent
	return
}

This change will ensure that annotations on ServiceAccounts are preserved across CSV updates.