fix: clear proxy vars from containers removed from inject-proxy annotation

The previous fix only cleaned up stale proxy env vars when the annotation
was entirely removed. If the annotation changed from "manager,sidecar" to
"manager", the sidecar container kept HTTP_PROXY/HTTPS_PROXY/NO_PROXY owned
by capi-operator-proxy indefinitely.

Now for each workload we split containers into two groups:
- Containers named in the annotation: proxy vars applied (or refreshed)
- Containers in the spec but NOT in the annotation: empty env applied,
  removing our SSA field-manager ownership of any proxy vars we set before

This covers three cases cleanly:
- Annotation absent: all containers cleared (existing behaviour)
- Annotation present, unchanged: annotated get vars, non-annotated get
  cleared (no-op if we never owned their env vars)
- Annotation shrinks: dropped containers get cleared, remaining get vars

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Todd Short <tshort@redhat.com>

Author: tmshort

pkg/controllers/installer/proxy_controller.go

@@ -173,21 +173,40 @@ func (c *ProxyController) applyToAllWorkloads(ctx context.Context, proxyVars []c
 	var errs []error
 
 	for _, item := range items {
-		var containers []string
+		allContainers := containerNamesFromSpec(item.containers)
+		annotation, hasAnnotation := item.podAnnotations[ProxyInjectAnnotation]
 
-		effectiveVars := proxyVars
+		if !hasAnnotation {
+			// No annotation: clear any stale proxy env vars from all containers.
+			if err := c.applyProxyVars(ctx, item.apiVersion, item.kind, item.name, item.namespace, allContainers, nil); err != nil {
+				errs = append(errs, err)
+			}
 
-		annotation, hasAnnotation := item.podAnnotations[ProxyInjectAnnotation]
-		if hasAnnotation {
-			containers = containerNamesFromAnnotation(annotation)
-		} else {
-			// No annotation: clear any stale proxy env vars we previously owned
-			// so that opting out removes the env vars instead of leaving them.
-			containers = containerNamesFromSpec(item.containers)
-			effectiveVars = nil
+			continue
+		}
+
+		// Apply proxy vars to the containers named in the annotation.
+		targets := containerNamesFromAnnotation(annotation)
+		if err := c.applyProxyVars(ctx, item.apiVersion, item.kind, item.name, item.namespace, targets, proxyVars); err != nil {
+			errs = append(errs, err)
+		}
+
+		// Clear proxy vars from containers that were removed from the annotation
+		// (e.g. annotation changed from "manager,sidecar" to "manager").
+		targetSet := make(map[string]struct{}, len(targets))
+		for _, name := range targets {
+			targetSet[name] = struct{}{}
+		}
+
+		var stale []string
+
+		for _, name := range allContainers {
+			if _, ok := targetSet[name]; !ok {
+				stale = append(stale, name)
+			}
 		}
 
-		if err := c.applyProxyVars(ctx, item.apiVersion, item.kind, item.name, item.namespace, containers, effectiveVars); err != nil {
+		if err := c.applyProxyVars(ctx, item.apiVersion, item.kind, item.name, item.namespace, stale, nil); err != nil {
 			errs = append(errs, err)
 		}
 	}