[oadp-1.4] OADP-8452: Reconciling the ServiceAccount

[NicholasYancey]

Why the changes were made

The CLI server's dedicated ServiceAccount was only created when missing and if it already existed with token automounting enabled, wrong labels, or no owner reference, the operator never fixed it. This backports the same reconciliation fix already merged to oadp-dev (#2318), so existing 1.4 clusters get corrected on upgrade instead of staying out of compliance.

How to test the changes made

Run the unit test that verifies an existing ServiceAccount gets reconciled to the desired state:

go test ./internal/controller/... -run 'TestReconcileCLIResources_ReconcilesExistingServiceAccount' -v

Then confirm on a running cluster that the ServiceAccount has token automounting disabled:

oc get sa -n openshift-adp openshift-adp-cli-server \
  -o jsonpath='{.automountServiceAccountToken}{"\n"}'

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c5d732a8-65a2-4a07-9804-69c0aa630bbc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@NicholasYancey: This pull request references OADP-8452 which is a valid jira issue.

Details

In response to this:

Why the changes were made

The CLI server's dedicated ServiceAccount was only created when missing and if it already existed with token automounting enabled, wrong labels, or no owner reference, the operator never fixed it. This backports the same reconciliation fix already merged to oadp-dev (#2318), so existing 1.4 clusters get corrected on upgrade instead of staying out of compliance.

How to test the changes made

Run the unit test that verifies an existing ServiceAccount gets reconciled to the desired state:

go test ./internal/controller/... -run 'TestReconcileCLIResources_ReconcilesExistingServiceAccount' -v

Then confirm on a running cluster that the ServiceAccount has token automounting disabled:

oc get sa -n openshift-adp openshift-adp-cli-server \
 -o jsonpath='{.automountServiceAccountToken}{"\n"}'

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 62.22222% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.82%. Comparing base (a1eedd6) to head (7ed62d5).

⚠️ Current head 7ed62d5 differs from pull request most recent head d235126

Please upload reports for the commit d235126 to get more accurate results.

Files with missing lines	Patch %	Lines
controllers/cli_download_controller.go	62.22%	13 Missing and 4 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           oadp-1.4    #2322      +/-   ##
============================================
+ Coverage     32.15%   36.82%   +4.67%     
============================================
  Files            30       30              
  Lines          4933     4975      +42     
============================================
+ Hits           1586     1832     +246     
+ Misses         3172     2954     -218     
- Partials        175      189      +14     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[NicholasYancey]

/retest

[openshift-ci]

@NicholasYancey: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Joeavaikath, NicholasYancey, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Joeavaikath,sseago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment