1
61%
main: 61%

Ran 06 Feb 2026 04:51PM UTC

Files 507

Run time 16s

Badge

Embed ▾

Committed 06 Feb 2026 04:43PM UTC coverage: 61.109% (+0.02%) from 61.094%

Job # 21758345730.1

Build Type

push

github

Committed by

web-flow

Commit Message

Fix ServiceAccount secret accumulation on OpenShift (#3627)

On OpenShift/OKD, the openshift-controller-manager automatically manages
the Secrets and ImagePullSecrets fields on ServiceAccounts by creating
kubernetes.io/service-account-token and kubernetes.io/dockercfg secrets.

Previously, the operator's upsertServiceAccount function unconditionally
overwrote these fields with nil during reconciliation. This caused
OpenShift to detect the SA as "missing dockercfg" and create new secrets,
while the old ones became orphaned. Over time, this led to unbounded
secret accumulation (~90 orphaned secret pairs/day).

This fix preserves existing Secrets and ImagePullSecrets fields when the
desired values are nil, following the pattern recommended in:
https://github.com/operator-framework/operator-sdk/issues/6494

The fix is safe for standard Kubernetes clusters where these fields are
typically empty anyway.

Fixes #3622

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Don Browne <dmjb@users.noreply.github.com>

Run Details

41704 of 68245 relevant lines covered (61.11%)

78.0 hits per line

stacklok / toolhive / 21758345730 / 1
61%
main: 61%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21758345730.1

stacklok / toolhive / 21758345730 / 1 61% main: 61%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21758345730.1

stacklok / toolhive / 21758345730 / 1
61%
main: 61%

README BADGES
x