Fix Template Annotations on Webhooks/API Service CSVs

Problem: OLM replaces existing pod template annotations on CSVs
that include Webhooks or API Services.

Solution: If the pod template includes annotations simply append the
Webhook/API Service annotation to the template.

Author: awgreene

staging/operator-lifecycle-manager/pkg/controller/install/certresources.go

@@ -505,11 +505,18 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
 
 	// Setting the olm hash label forces a rollout and ensures that the new secret
 	// is used by the apiserver if not hot reloading.
-	depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{OLMCAHashAnnotationKey: caHash})
-
+	SetCAAnnotation(&depSpec, caHash)
 	return &depSpec, caPEM, nil
 }
 
+func SetCAAnnotation(depSpec *appsv1.DeploymentSpec, caHash string) {
+	if len(depSpec.Template.ObjectMeta.GetAnnotations()) == 0 {
+		depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{OLMCAHashAnnotationKey: caHash})
+	} else {
+		depSpec.Template.Annotations[OLMCAHashAnnotationKey] = caHash
+	}
+}
+
 // AddDefaultCertVolumeAndVolumeMounts mounts the CA Cert generated by OLM to the location that OLM expects
 // APIService certs to be as well as the location that the Operator-SDK and Kubebuilder expect webhook
 // certs to be.

staging/operator-lifecycle-manager/pkg/controller/install/certresources_test.go

@@ -310,14 +310,21 @@ func TestInstallCertRequirementsForDeployment(t *testing.T) {
 						Spec: corev1.PodSpec{
 							ServiceAccountName: "test-sa",
 						},
+						ObjectMeta: metav1.ObjectMeta{
+							Annotations: map[string]string{
+								"foo": "bar",
+							},
+						},
 					},
 				},
 			},
 			want: &appsv1.DeploymentSpec{
 				Selector: selector(t, "test=label"),
 				Template: corev1.PodTemplateSpec{
 					ObjectMeta: metav1.ObjectMeta{
-						Annotations: map[string]string{OLMCAHashAnnotationKey: caHash},
+						Annotations: map[string]string{
+							"foo":                  "bar",
+							OLMCAHashAnnotationKey: caHash},
 					},
 					Spec: corev1.PodSpec{
 						ServiceAccountName: "test-sa",

staging/operator-lifecycle-manager/pkg/controller/operators/olm/apiservices.go

@@ -349,7 +349,7 @@ func (a *Operator) updateDeploymentSpecsWithApiServiceData(csv *v1alpha1.Cluster
 		}
 
 		install.AddDefaultCertVolumeAndVolumeMounts(&depSpec, secret.GetName())
-		depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{install.OLMCAHashAnnotationKey: caHash})
+		install.SetCAAnnotation(&depSpec, caHash)
 		depSpecs[desc.DeploymentName] = depSpec
 	}
 
@@ -376,7 +376,7 @@ func (a *Operator) updateDeploymentSpecsWithApiServiceData(csv *v1alpha1.Cluster
 		}
 		install.AddDefaultCertVolumeAndVolumeMounts(&depSpec, secret.GetName())
 
-		depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{install.OLMCAHashAnnotationKey: caHash})
+		install.SetCAAnnotation(&depSpec, caHash)
 		depSpecs[desc.DeploymentName] = depSpec
 	}