stacklok / toolhive / 21758345730

61%

Build Type

push

github

Committed by web-flow

Commit Message

Fix ServiceAccount secret accumulation on OpenShift (#3627)

On OpenShift/OKD, the openshift-controller-manager automatically manages
the Secrets and ImagePullSecrets fields on ServiceAccounts by creating
kubernetes.io/service-account-token and kubernetes.io/dockercfg secrets.

Previously, the operator's upsertServiceAccount function unconditionally
overwrote these fields with nil during reconciliation. This caused
OpenShift to detect the SA as "missing dockercfg" and create new secrets,
while the old ones became orphaned. Over time, this led to unbounded
secret accumulation (~90 orphaned secret pairs/day).

This fix preserves existing Secrets and ImagePullSecrets fields when the
desired values are nil, following the pattern recommended in:
https://github.com/operator-framework/operator-sdk/issues/6494

The fix is safe for standard Kubernetes clusters where these fields are
typically empty anyway.

Fixes #3622

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Don Browne <dmjb@users.noreply.github.com>

Run Details

12 of 12 new or added lines in 1 file covered. (100.0%)

4 existing lines in 2 files now uncovered.

41704 of 68245 relevant lines covered (61.11%)

78.0 hits per line