Repository: operator-framework/operator-lifecycle-manager
Pull request #1123 (2019-11-12 22:33:48)

Bug 1769030: Replacing operator creates duplicate secrets
Cause:
OLM catalog ensurer EnsureServiceAccount makes sure the service account
is updated when a new version of an operator is present. This
happens during ExecutePlan applying InstallPlan to a namespace.
If it is an update, fields of service account are updated but the
references to older secrets are dropped.

Consequence:
This process of dereferencing secret fails to clean up the older
secrets and result in the secrets pilling up as the operator upgrades.
Eventually, there will be too many old secrets laying around and only
getting cleaned up when the operator is uninstalled.

Fix:
We carry over older secrets through updating the service account.

Result:
Older secretes are again referred in the updated SA.



openshift-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#" title="Author self-approved">Bowenislandsong</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **njhale**
You can assign the PR to them by writing `/assign @njhale` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=operator-framework%2Foperator-lifecycle-manager).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/operator-framework/operator-lifecycle-manager/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["njhale"]} -->
Bowenislandsong: e2e test inprog
openshift-ci-robot: @Bowenislandsong: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/unit | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2757) | `/test unit`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/unit | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2757) | `/test unit`
ci/prow/e2e-gcp-upgrade | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/154) | `/test e2e-gcp-upgrade`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/unit | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2757) | `/test unit`
ci/prow/e2e-gcp-upgrade | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/154) | `/test e2e-gcp-upgrade`
ci/prow/e2e-aws-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3350) | `/test e2e-aws-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/unit | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2757) | `/test unit`
ci/prow/e2e-gcp-upgrade | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/154) | `/test e2e-gcp-upgrade`
ci/prow/e2e-aws-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3350) | `/test e2e-aws-olm`
ci/prow/e2e-aws-console-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-console-olm/1429) | `/test e2e-aws-console-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-gcp-upgrade | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/154) | `/test e2e-gcp-upgrade`
ci/prow/e2e-aws-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3350) | `/test e2e-aws-olm`
ci/prow/e2e-aws-console-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-console-olm/1429) | `/test e2e-aws-console-olm`
ci/prow/unit | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2759) | `/test unit`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3350) | `/test e2e-aws-olm`
ci/prow/e2e-aws-console-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-console-olm/1429) | `/test e2e-aws-console-olm`
ci/prow/unit | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2759) | `/test unit`
ci/prow/e2e-gcp-upgrade | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/156) | `/test e2e-gcp-upgrade`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3350) | `/test e2e-aws-olm`
ci/prow/unit | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2759) | `/test unit`
ci/prow/e2e-gcp-upgrade | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/156) | `/test e2e-gcp-upgrade`
ci/prow/e2e-aws-console-olm | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-console-olm/1431) | `/test e2e-aws-console-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | aec56a84781f382271aaa044eec7e31b8e998028 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3350) | `/test e2e-aws-olm`
ci/prow/unit | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2759) | `/test unit`
ci/prow/e2e-gcp-upgrade | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/156) | `/test e2e-gcp-upgrade`
ci/prow/e2e-aws-console-olm | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-console-olm/1431) | `/test e2e-aws-console-olm`
ci/prow/e2e-gcp | 4979beee5b870876c786189f2b7a18c20f656844 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/157) | `/test e2e-gcp`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
h777xx: https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#discussion_r346065906
JHrefiD: #1123 
JHrefiD: > [#1123 (comment)](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#discussion_r346065906)

Thank you.
openshift-ci-robot: @Bowenislandsong: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | fcb72c0c90bd7cb36fcd8de100160bf174785583 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3368) | `/test e2e-aws-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | fcb72c0c90bd7cb36fcd8de100160bf174785583 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3368) | `/test e2e-aws-olm`
ci/prow/unit | cadbe2df57fb286421ec7b2b74165652957bac49 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2780) | `/test unit`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/unit | cadbe2df57fb286421ec7b2b74165652957bac49 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2780) | `/test unit`
ci/prow/e2e-aws-olm | cadbe2df57fb286421ec7b2b74165652957bac49 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3377) | `/test e2e-aws-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
Bowenislandsong: /hold 
E2e test includes pulling quay image. This should be removed before merging.
Bowenislandsong: /bugzilla refresh
openshift-ci-robot: @Bowenislandsong: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with <code>/bugzilla refresh</code>.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-555647726):

>/bugzilla refresh


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
openshift-ci-robot: @Bowenislandsong: This pull request references [Bugzilla bug 1769030](https://bugzilla.redhat.com/show_bug.cgi?id=1769030), which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123):

>Bug 1769030: Replacing operator creates duplicate secrets


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
Bowenislandsong: /hold cancel
Bowenislandsong: It seems like the reason that the Kubernetes Token Controller is not cleaning up the dereferenced secrets is that the design does not cover the scenario. The Kubernetes design doc https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#token-controller states that `TokenController observes secret deletion and removes a reference from the corresponding ServiceAccount if needed.` There is no scenario for deleting secret when it is dereferenced by the ServiceAccount.
openshift-ci-robot: @Bowenislandsong: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-gcp | 2fc7268e99587a6a0ec658a38ba244aa524ffffa | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/196) | `/test e2e-gcp`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
Bowenislandsong: /test e2e-gcp
Bowenislandsong: /cherry-pick release-4.1
openshift-cherrypick-robot: @Bowenislandsong: once the present PR merges, I will cherry-pick it on top of release-4.1 in a new PR and assign it to you.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-557253805):

>/cherry-pick release-4.1


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
Bowenislandsong: /cherry-pick release-4.2
openshift-cherrypick-robot: @Bowenislandsong: once the present PR merges, I will cherry-pick it on top of release-4.2 in a new PR and assign it to you.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-557253837):

>/cherry-pick release-4.2


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
Bowenislandsong: /cherry-pick release-4.3
openshift-cherrypick-robot: @Bowenislandsong: once the present PR merges, I will cherry-pick it on top of release-4.3 in a new PR and assign it to you.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-557659646):

>/cherry-pick release-4.3


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
Bowenislandsong: /cherry-pick release-4.2 cancel
openshift-cherrypick-robot: @Bowenislandsong: once the present PR merges, I will cherry-pick it on top of release-4.2 cancel in a new PR and assign it to you.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-557714186):

>/cherry-pick release-4.2 cancel


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
openshift-ci-robot: @Bowenislandsong: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3415) | `/test e2e-aws-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3415) | `/test e2e-aws-olm`
ci/prow/e2e-gcp-upgrade | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/214) | `/test e2e-gcp-upgrade`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3415) | `/test e2e-aws-olm`
ci/prow/e2e-gcp-upgrade | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/214) | `/test e2e-gcp-upgrade`
ci/prow/e2e-gcp | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/225) | `/test e2e-gcp`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: This pull request references [Bugzilla bug 1769030](https://bugzilla.redhat.com/show_bug.cgi?id=1769030), which is invalid:
 - expected the bug to target the "4.4.0" release, but it targets "4.3.0" instead

Comment <code>/bugzilla refresh</code> to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123):

>Bug 1769030: Replacing operator creates duplicate secrets


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
Bowenislandsong: /test e2e-gcp
Bowenislandsong: /bugzilla refresh
openshift-ci-robot: @Bowenislandsong: This pull request references [Bugzilla bug 1769030](https://bugzilla.redhat.com/show_bug.cgi?id=1769030), which is valid.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-558352448):

>/bugzilla refresh


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
Bowenislandsong: @ecordell The easy approach is commited. 
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3415) | `/test e2e-aws-olm`
ci/prow/e2e-gcp-upgrade | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/214) | `/test e2e-gcp-upgrade`
ci/prow/e2e-gcp | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/226) | `/test e2e-gcp`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-gcp-upgrade | 04b1234858320fb8ba9244e91e4c5dd7247933ab | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp-upgrade/214) | `/test e2e-gcp-upgrade`
ci/prow/e2e-gcp | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/226) | `/test e2e-gcp`
ci/prow/e2e-aws-olm | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3421) | `/test e2e-aws-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
Bowenislandsong: /retest
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-gcp | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/226) | `/test e2e-gcp`
ci/prow/e2e-aws-olm | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3423) | `/test e2e-aws-olm`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3423) | `/test e2e-aws-olm`
ci/prow/e2e-gcp | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/228) | `/test e2e-gcp`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
Bowenislandsong: /test ci/prow/e2e-aws-olm
/test ci/prow/e2e-gcp
Bowenislandsong: /test e2e-aws-olm
/test e2e-gcp
openshift-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#pullrequestreview-323061999" title="Approved">awgreene</a>*, *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#" title="Author self-approved">Bowenislandsong</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **njhale**
You can assign the PR to them by writing `/assign @njhale` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=operator-framework%2Foperator-lifecycle-manager).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/operator-framework/operator-lifecycle-manager/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["njhale"]} -->
openshift-ci-robot: @Bowenislandsong: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/e2e-aws-olm | a8587dd26a8a7f69ed7b9d4fde1bf1a002014e67 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-aws-olm/3423) | `/test e2e-aws-olm`
ci/prow/e2e-gcp | cd0b5b793f1512e7ed64b574115cf8732bce5d8c | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-e2e-gcp/231) | `/test e2e-gcp`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
Bowenislandsong: /test e2e-gcp
awgreene: @Bowenislandsong you may want to use deepderivative to compare the objects.
ecordell: /bugzilla refresh

openshift-ci-robot: @ecordell: This pull request references [Bugzilla bug 1769030](https://bugzilla.redhat.com/show_bug.cgi?id=1769030), which is valid.

<details>

In response to [this](https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-559269933):

>/bugzilla refresh
>


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
ecordell: /lgtm
openshift-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#pullrequestreview-323061999" title="Approved">awgreene</a>*, *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#" title="Author self-approved">Bowenislandsong</a>*, *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-559270170" title="LGTM">ecordell</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=operator-framework%2Foperator-lifecycle-manager).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/operator-framework/operator-lifecycle-manager/blob/master/OWNERS)~~ [ecordell]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
openshift-ci-robot: New changes are detected. LGTM label has been removed.
Bowenislandsong: /cc @ecordell @awgreene added DeepDerivative check to save API calls if updated SA has the exact same field.
ecordell: /lgtm
openshift-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#pullrequestreview-323061999" title="Approved">awgreene</a>*, *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#" title="Author self-approved">Bowenislandsong</a>*, *<a href="https://github.com/operator-framework/operator-lifecycle-manager/pull/1123#issuecomment-559274365" title="LGTM">ecordell</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=operator-framework%2Foperator-lifecycle-manager).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/operator-framework/operator-lifecycle-manager/blob/master/OWNERS)~~ [ecordell]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
openshift-ci-robot: @Bowenislandsong: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
ci/prow/unit | f3d47813acc6bf5950db90de9f79592034103e83 | [link](https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/pr-logs/pull/operator-framework_operator-lifecycle-manager/1123/pull-ci-operator-framework-operator-lifecycle-manager-master-unit/2831) | `/test unit`

[Full PR test history](https://prow.svc.ci.openshift.org/pr-history?org=operator-framework&repo=operator-lifecycle-manager&pr=1123). [Your PR dashboard](https://prow.svc.ci.openshift.org/pr?query=is:pr+state:open+author:Bowenislandsong). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/operator-framework/operator-lifecycle-manager/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/pkg/controller/operators/catalog/step_ensurer.go b/pkg/controller/operators/catalog/step_ensurer.go
index eeccb9a42..32fae5182 100644
--- a/pkg/controller/operators/catalog/step_ensurer.go
+++ b/pkg/controller/operators/catalog/step_ensurer.go
@@ -3,15 +3,17 @@ package catalog
 import (
 	"fmt"
 
-	"github.com/operator-framework/operator-lifecycle-manager/pkg/api/apis/operators/v1alpha1"
-	"github.com/operator-framework/operator-lifecycle-manager/pkg/api/client/clientset/versioned"
-	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
-	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil"
 	errorwrap "github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/api/apis/operators/v1alpha1"
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/api/client/clientset/versioned"
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil"
 )
 
 func newStepEnsurer(kubeClient operatorclient.ClientInterface, crClient versioned.Interface) *StepEnsurer {
@@ -116,11 +118,24 @@ func (o *StepEnsurer) EnsureServiceAccount(namespace string, sa *corev1.ServiceA
 		return
 	}
 
-	sa.SetNamespace(namespace)
-	if _, updateErr := o.kubeClient.UpdateServiceAccount(sa); updateErr != nil {
-		err = errorwrap.Wrapf(updateErr, "error updating service account: %s", sa.GetName())
+	// Carrying secrets through the service account update.
+	preSa, getErr := o.kubeClient.KubernetesInterface().CoreV1().ServiceAccounts(namespace).Get(sa.Name,
+		metav1.GetOptions{})
+	if getErr != nil {
+		err = errorwrap.Wrapf(getErr, "error getting older version of service account: %s", sa.GetName())
 		return
 	}
+	sa.Secrets = preSa.Secrets
+
+	sa.SetNamespace(namespace)
+
+	// Use DeepDerivative to check if new SA is the same as the old SA. If no field is changed, we skip the update call.
+	if !apiequality.Semantic.DeepDerivative(sa, preSa) {
+		if _, updateErr := o.kubeClient.UpdateServiceAccount(sa); updateErr != nil {
+			err = errorwrap.Wrapf(updateErr, "error updating service account: %s", sa.GetName())
+			return
+		}
+	}
 
 	status = v1alpha1.StepStatusPresent
 	return


Test patch:
diff --git a/pkg/controller/operators/catalog/operator_test.go b/pkg/controller/operators/catalog/operator_test.go
index 0a3f2b627..20c61aec3 100644
--- a/pkg/controller/operators/catalog/operator_test.go
+++ b/pkg/controller/operators/catalog/operator_test.go
@@ -382,6 +382,96 @@ func TestExecutePlan(t *testing.T) {
 			want: []runtime.Object{service("service", namespace), csv("csv", namespace, nil, nil)},
 			err:  nil,
 		},
+		{
+			testName: "CreateServiceAccount",
+			in: withSteps(installPlan("p", namespace, v1alpha1.InstallPlanPhaseInstalling, "csv"),
+				[]*v1alpha1.Step{
+					{
+						Resource: v1alpha1.StepResource{
+							CatalogSource:          "catalog",
+							CatalogSourceNamespace: namespace,
+							Group:                  "",
+							Version:                "v1",
+							Kind:                   "ServiceAccount",
+							Name:                   "sa",
+							Manifest: toManifest(serviceAccount("sa", namespace, "",
+								objectReference("init secret"))),
+						},
+						Status: v1alpha1.StepStatusUnknown,
+					},
+				},
+			),
+			want: []runtime.Object{serviceAccount("sa", namespace, "", objectReference("init secret"))},
+			err:  nil,
+		},
+		{
+			testName: "UpdateServiceAccountWithSameFields",
+			in: withSteps(installPlan("p", namespace, v1alpha1.InstallPlanPhaseInstalling, "csv"),
+				[]*v1alpha1.Step{
+					{
+						Resource: v1alpha1.StepResource{
+							CatalogSource:          "catalog",
+							CatalogSourceNamespace: namespace,
+							Group:                  "",
+							Version:                "v1",
+							Kind:                   "ServiceAccount",
+							Name:                   "sa",
+							Manifest: toManifest(serviceAccount("sa", namespace, "name",
+								objectReference("init secret"))),
+						},
+						Status: v1alpha1.StepStatusUnknown,
+					},
+					{
+						Resource: v1alpha1.StepResource{
+							CatalogSource:          "catalog",
+							CatalogSourceNamespace: namespace,
+							Group:                  "",
+							Version:                "v1",
+							Kind:                   "ServiceAccount",
+							Name:                   "sa",
+							Manifest:               toManifest(serviceAccount("sa", namespace, "name", nil)),
+						},
+						Status: v1alpha1.StepStatusUnknown,
+					},
+				},
+			),
+			want: []runtime.Object{serviceAccount("sa", namespace, "name", objectReference("init secret"))},
+			err:  nil,
+		},
+		{
+			testName: "UpdateServiceAccountWithDiffFields",
+			in: withSteps(installPlan("p", namespace, v1alpha1.InstallPlanPhaseInstalling, "csv"),
+				[]*v1alpha1.Step{
+					{
+						Resource: v1alpha1.StepResource{
+							CatalogSource:          "catalog",
+							CatalogSourceNamespace: namespace,
+							Group:                  "",
+							Version:                "v1",
+							Kind:                   "ServiceAccount",
+							Name:                   "sa",
+							Manifest: toManifest(serviceAccount("sa", namespace, "old_name",
+								objectReference("init secret"))),
+						},
+						Status: v1alpha1.StepStatusUnknown,
+					},
+					{
+						Resource: v1alpha1.StepResource{
+							CatalogSource:          "catalog",
+							CatalogSourceNamespace: namespace,
+							Group:                  "",
+							Version:                "v1",
+							Kind:                   "ServiceAccount",
+							Name:                   "sa",
+							Manifest:               toManifest(serviceAccount("sa", namespace, "new_name", nil)),
+						},
+						Status: v1alpha1.StepStatusUnknown,
+					},
+				},
+			),
+			want: []runtime.Object{serviceAccount("sa", namespace, "new_name", objectReference("init secret"))},
+			err:  nil,
+		},
 	}
 
 	for _, tt := range tests {
@@ -411,6 +501,8 @@ func TestExecutePlan(t *testing.T) {
 					fetched, err = op.opClient.GetRoleBinding(namespace, o.GetName())
 				case *corev1.ServiceAccount:
 					fetched, err = op.opClient.GetServiceAccount(namespace, o.GetName())
+				case *corev1.Secret:
+					fetched, err = op.opClient.GetSecret(namespace, o.GetName())
 				case *corev1.Service:
 					fetched, err = op.opClient.GetService(namespace, o.GetName())
 				case *v1alpha1.ClusterServiceVersion:
@@ -1010,6 +1102,25 @@ func service(name, namespace string) *corev1.Service {
 	}
 }
 
+func serviceAccount(name, namespace, generateName string, secretRef *corev1.ObjectReference) *corev1.ServiceAccount {
+	if secretRef == nil {
+		return &corev1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace, GenerateName: generateName},
+		}
+	}
+	return &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace, GenerateName: generateName},
+		Secrets:    []corev1.ObjectReference{*secretRef},
+	}
+}
+
+func objectReference(name string) *corev1.ObjectReference {
+	if name == "" {
+		return &corev1.ObjectReference{}
+	}
+	return &corev1.ObjectReference{Name: name}
+}
+
 func toManifest(obj runtime.Object) string {
 	raw, _ := json.Marshal(obj)
 	return string(raw)
diff --git a/test/e2e/installplan_e2e_test.go b/test/e2e/installplan_e2e_test.go
index fa6940b79..f907b8492 100644
--- a/test/e2e/installplan_e2e_test.go
+++ b/test/e2e/installplan_e2e_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/blang/semver"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	appsv1 "k8s.io/api/apps/v1"
 	authorizationv1 "k8s.io/api/authorization/v1"
@@ -1610,6 +1611,9 @@ func TestUpdateCatalogForSubscription(t *testing.T) {
 			},
 		}
 
+		oldSecrets, err := c.KubernetesInterface().CoreV1().Secrets(testNamespace).List(metav1.ListOptions{})
+		require.NoError(t, err, "error listing secrets")
+
 		// Create the catalog sources
 		updatedNamedStrategy := newNginxInstallStrategy(genName("dep-"), updatedPermissions, updatedClusterPermissions)
 		updatedCSV := newCSV(mainPackageStable+"-next", testNamespace, mainCSV.GetName(), semver.MustParse("0.2.0"), []apiextensions.CustomResourceDefinition{mainCRD}, nil, updatedNamedStrategy)
@@ -1640,6 +1644,13 @@ func TestUpdateCatalogForSubscription(t *testing.T) {
 		_, err = awaitCSV(t, crc, testNamespace, updatedCSV.GetName(), csvSucceededChecker)
 		require.NoError(t, err)
 
+		newSecrets, err := c.KubernetesInterface().CoreV1().Secrets(testNamespace).List(metav1.ListOptions{})
+		require.NoError(t, err, "error listing secrets")
+		// Assert that the number of secrets is not increased from updating service account as part of the install plan,
+		assert.EqualValues(t, len(oldSecrets.Items), len(newSecrets.Items))
+		// And that the secret list is indeed updated.
+		assert.Equal(t, oldSecrets.Items, newSecrets.Items)
+
 		// Wait for ServiceAccount to not have access anymore
 		err = wait.Poll(pollInterval, pollDuration, func() (bool, error) {
 			res, err := c.KubernetesInterface().AuthorizationV1().SubjectAccessReviews().Create(&authorizationv1.SubjectAccessReview{