chore: use service account name instead of resource

Author: maltesander

rust/operator-binary/src/controller.rs

@@ -10,6 +10,7 @@ use stackable_operator::{
     cluster_resources::ClusterResourceApplyStrategy,
     commons::rbac::build_rbac_resources,
     kube::{
+        ResourceExt,
         core::{DeserializeGuard, error_boundary},
         runtime::controller::Action,
     },
@@ -213,9 +214,13 @@ pub async fn reconcile_druid(
             .context(GetRequiredLabelsSnafu)?,
     )
     .context(BuildRbacResourcesSnafu)?;
+
+    // The ServiceAccount name is deterministic on the built object, so the StatefulSet builder only
+    // needs the name and does not depend on the applied ServiceAccount.
+    let service_account_name = rbac_sa.name_any();
+
     cluster_resources
-        // We clone rbac_sa because we need to reuse it below
-        .add(client, rbac_sa.clone())
+        .add(client, rbac_sa)
         .await
         .context(ApplyServiceAccountSnafu)?;
     cluster_resources
@@ -250,7 +255,7 @@ pub async fn reconcile_druid(
                 druid_role,
                 rolegroup_name,
                 rg,
-                &rbac_sa,
+                &service_account_name,
             )
             .context(BuildRoleGroupStatefulSetSnafu)?;
 

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -16,11 +16,10 @@ use stackable_operator::{
         DeepMerge,
         api::{
             apps::v1::{StatefulSet, StatefulSetSpec},
-            core::v1::{EnvVar, PersistentVolumeClaim, ServiceAccount},
+            core::v1::{EnvVar, PersistentVolumeClaim},
         },
         apimachinery::pkg::apis::meta::v1::LabelSelector,
     },
-    kube::ResourceExt,
     product_logging,
     v2::{
         builder::pod::container::{EnvVarSet, new_container_builder},
@@ -114,7 +113,7 @@ pub fn build_rolegroup_statefulset(
     role: &DruidRole,
     role_group_name: &RoleGroupName,
     rg: &DruidRoleGroupConfig,
-    service_account: &ServiceAccount,
+    service_account_name: &str,
 ) -> Result<StatefulSet> {
     let merged_rolegroup_config = &rg.config;
     let resource_names = cluster.resource_names(role, role_group_name);
@@ -322,7 +321,7 @@ pub fn build_rolegroup_statefulset(
         .add_init_container(cb_prepare.build())
         .add_container(cb_druid.build())
         .metadata(metadata)
-        .service_account_name(service_account.name_any())
+        .service_account_name(service_account_name)
         .security_context(PodSecurityContextBuilder::new().fs_group(1000).build());
 
     // The Vector agent reads the static `vector.yaml` (added to the rolegroup ConfigMap) from the