fix: detach managed serviceaccounts by owner

Author: ThomasK33

internal/controller/codercontrolplane_controller.go

@@ -534,9 +534,8 @@ func (r *CoderControlPlaneReconciler) detachManagedServiceAccounts(
 		ctx,
 		serviceAccounts,
 		client.InNamespace(coderControlPlane.Namespace),
-		client.MatchingLabels(controlPlaneLabels(coderControlPlane.Name)),
 	); err != nil {
-		return fmt.Errorf("list managed service accounts: %w", err)
+		return fmt.Errorf("list service accounts for detachment: %w", err)
 	}
 
 	for i := range serviceAccounts.Items {

internal/controller/codercontrolplane_controller_test.go

@@ -2258,6 +2258,9 @@ func TestReconcile_ServiceAccount(t *testing.T) {
 				Image: "test-serviceaccount:latest",
 				ServiceAccount: coderv1alpha1.ServiceAccountSpec{
 					Name: "test-serviceaccount-disable-detach-sa",
+					Labels: map[string]string{
+						"app.kubernetes.io/instance": "custom-instance-label",
+					},
 				},
 			},
 		}
@@ -2279,6 +2282,9 @@ func TestReconcile_ServiceAccount(t *testing.T) {
 		if err := k8sClient.Get(ctx, types.NamespacedName{Name: serviceAccountName, Namespace: cp.Namespace}, serviceAccount); err != nil {
 			t.Fatalf("get managed service account: %v", err)
 		}
+		if got := serviceAccount.Labels["app.kubernetes.io/instance"]; got != "custom-instance-label" {
+			t.Fatalf("expected reserved instance label override to be applied, got %q", got)
+		}
 		ownerReference := metav1.GetControllerOf(serviceAccount)
 		if ownerReference == nil || ownerReference.UID != cp.UID {
 			t.Fatalf("expected service account to be controller-owned before disableCreate=true, got %#v", ownerReference)