🐛 cmd/Sync: remove serviceaccounts from default resource list

[jmprusi]

Summary

Serviceaccounts are currently synced by default, but this shouldn't be the case as it will cause issue overriding downstream SAs.

Fixes #2146

[sttts]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/cliplugins/OWNERS [sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jmprusi]

/cherrypick release-0.9

[openshift-cherrypick-robot]

@jmprusi: new pull request created: #2151

In response to this:

/cherrypick release-0.9
/cherrypick release-0.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jmprusi]

/cherrypick release-0.8

[openshift-cherrypick-robot]

@jmprusi: #2150 failed to apply on top of branch "release-0.8":

Applying: cmd/Sync: remove serviceaccounts from default resource list
Using index info to reconstruct a base tree...
M	pkg/cliplugins/workload/plugin/sync.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/cliplugins/workload/plugin/sync.go
CONFLICT (content): Merge conflict in pkg/cliplugins/workload/plugin/sync.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 cmd/Sync: remove serviceaccounts from default resource list
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherrypick release-0.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[stevekuznetsov]

@jmprusi can we please remember to link to the issues we're fixing with

Fixes #2146

[ncdc]

FYI the Fixes text must be in the PR description. It will not be inspected in comments.

[ncdc]

No need to pick back to 0.8. We do not maintain multiple previous versions - only the most recent.

[kasturinarra]

@kasturinarra can you please help verify this ?

[kasturinarra]

/label qe-approved

[openshift-ci]

@kasturinarra: The label(s) qe-approved cannot be applied, because the repository doesn't have them.

In response to this:

/label qe-approved

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kasturinarra]

Detailed steps followed to verify the bug:

1. Login to kcp env
2. Go to home workspace using command 'kubectl kcp ws'
3. create a worksapce using the command 'kubectl ws create qetest1'
4. Now run the command 'kubectl kcp workload sync qecluster1 --syncer-image ghcr.io/kcp-dev/kcp/syncer:v0.9.1 -o - | KUBECONFIG=/home/knarra/Downloads/kubeconfig kubectl apply -f -' to add synctarget .
5. Now check the secret and sa in the default namespace by running the commands below
   kubectl get sa -n default
   kubectl get secret -n default
6. Verify that the default-token-* is synced to the compute cluster kcp-* namespace in compute cluster with a name called kcp-default-token-*
7. Verify that the sa is not synced to the compute cluster kcp-* namespace in compute cluster and what ever default sa seen their is a different one. Plan is to not sync any sa downstream and dev has plans to remove these default ones as well.

However i do see that the syncer.yaml has --resources in the args as well as the syncer pod. will file a separate bug for this issue.