Bug 2094303

Description of problem:
If og is configured with sa, operator installation will be failed.
error message is:
time="2022-06-07T08:41:00Z" level=warning msg="skipping secret scoped-dockercfg-hnxmp - <nil>" mode=scoped namespace=test-41174 sa=scoped
time="2022-06-07T08:41:00Z" level=error msg="failed to get a client for plan execution: the service account does not have any API secret sa=test-41174/scoped"
E0607 08:41:00.302468       1 queueinformer_operator.go:290] sync {"update" "test-41174/install-pqslc"} failed: the service account does not have any API secret sa=test-41174/scoped


Version-Release number of selected component (if applicable):
zhaoxia@xzha-mac operator-framework-olm % oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.11.0-0.nightly-2022-06-06-025509   True        False         11h     Cluster version is 4.11.0-0.nightly-2022-06-06-025509
zhaoxia@xzha-mac operator-framework-olm % oc adm release info registry.ci.openshift.org/ocp/release:4.11.0-0.nightly-2022-06-06-025509 --commits|grep operator-lifecycle-manager
  operator-lifecycle-manager                     https://github.com/openshift/operator-framework-olm                         7f8ad598528b2d029fac23dac6d860c433cbf962


How reproducible:
always

Steps to Reproduce:
1.install og with sa
zhaoxia@xzha-mac OCP-41174 % oc new-project test-41174
zhaoxia@xzha-mac OCP-41174 % oc apply ogwithsa.yaml
zhaoxia@xzha-mac OCP-41174 % cat ogwithsa.yaml 
kind: OperatorGroup
apiVersion: operators.coreos.com/v1
metadata:
  name: og
  namespace: test-41174
spec:
  serviceAccountName: "scoped"
  targetNamespaces:
  - test-41174
2.create sa, Role, RoleBinding
zhaoxia@xzha-mac OCP-41174 % oc create sa scoped -n test-41174
zhaoxia@xzha-mac OCP-41174 % oc apply -f role.yaml
zhaoxia@xzha-mac OCP-41174 % cat role.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: scoped
  namespace: test-41174
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"] 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: scoped-bindings
  namespace: test-41174
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: scoped
subjects:
- kind: ServiceAccount
  name: scoped
  namespace: test-41174

3.create sub
zhaoxia@xzha-mac OCP-41174 % oc apply -f sub.yaml 
zhaoxia@xzha-mac OCP-41174 % cat sub.yaml                     
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: etcd-operator
  namespace: test-41174
spec:
  channel: singlenamespace-alpha
  installPlanApproval: Automatic
  name: etcd
  source: community-operators
  sourceNamespace: openshift-marketplace

4. check status

zhaoxia@xzha-mac OCP-41174 % oc get og -o yaml
apiVersion: v1
items:
- apiVersion: operators.coreos.com/v1
  kind: OperatorGroup
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"operators.coreos.com/v1","kind":"OperatorGroup","metadata":{"annotations":{},"name":"og","namespace":"test-41174"},"spec":{"serviceAccountName":"scoped","targetNamespaces":["test-41174"]}}
    creationTimestamp: "2022-06-07T08:32:12Z"
    generation: 1
    name: og
    namespace: test-41174
    resourceVersion: "397517"
    uid: e5b265ff-8057-433e-ad3c-f7b1bcb0f15d
  spec:
    serviceAccountName: scoped
    targetNamespaces:
    - test-41174
    upgradeStrategy: Default
  status:
    lastUpdated: "2022-06-07T08:32:12Z"
    namespaces:
    - test-41174
    serviceAccountRef:
      apiVersion: v1
      kind: ServiceAccount
      name: scoped
      namespace: test-41174
      resourceVersion: "397228"
      uid: ec2d6394-dd34-45d1-8ad5-26f8dacacba1
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

zhaoxia@xzha-mac OCP-41174 % oc get sa scoped -o yaml
apiVersion: v1
imagePullSecrets:
- name: scoped-dockercfg-hnxmp
kind: ServiceAccount
metadata:
  creationTimestamp: "2022-06-07T08:32:02Z"
  name: scoped
  namespace: test-41174
  resourceVersion: "397228"
  uid: ec2d6394-dd34-45d1-8ad5-26f8dacacba1
secrets:
- name: scoped-dockercfg-hnxmp

zhaoxia@xzha-mac OCP-41174 % oc get secrets scoped-dockercfg-hnxmp -o yaml
apiVersion: v1
...
metadata:
  annotations:
    kubernetes.io/service-account.name: scoped
    kubernetes.io/service-account.uid: ec2d6394-dd34-45d1-8ad5-26f8dacacba1
    openshift.io/token-secret.name: scoped-token-dl7pq
    ...
  creationTimestamp: "2022-06-07T08:32:02Z"
  name: scoped-dockercfg-hnxmp
  namespace: test-41174
  ownerReferences:
  - apiVersion: v1
    blockOwnerDeletion: false
    controller: true
    kind: Secret
    name: scoped-token-dl7pq
    uid: a35309d3-56c6-4214-98ef-847b7af811f4
  resourceVersion: "397226"
  uid: 9a006918-bb37-4e73-8c6c-46e9883875dc
type: kubernetes.io/dockercfg


zhaoxia@xzha-mac OCP-41174 % oc get secrets
NAME                       TYPE                                  DATA   AGE
builder-dockercfg-klq9f    kubernetes.io/dockercfg               1      167m
builder-token-xfjvf        kubernetes.io/service-account-token   4      167m
default-dockercfg-7kjcj    kubernetes.io/dockercfg               1      167m
default-token-hqxrk        kubernetes.io/service-account-token   4      167m
deployer-dockercfg-j8j8l   kubernetes.io/dockercfg               1      167m
deployer-token-nfwws       kubernetes.io/service-account-token   4      167m
scoped-dockercfg-hnxmp     kubernetes.io/dockercfg               1      167m
scoped-token-dl7pq         kubernetes.io/service-account-token   4      167m

zhaoxia@xzha-mac OCP-41174 % oc get ip -o yaml
conditions:
    - lastTransitionTime: "2022-06-07T08:33:21Z"
      lastUpdateTime: "2022-06-07T11:02:13Z"
      message: the service account does not have any API secret sa=test-41174/scoped
      reason: InstallComponentFailed
      status: "False"
      type: Installed
    message: the service account does not have any API secret sa=test-41174/scoped
    phase: Failed


Actual results:
installplan failed due to "the service account does not have any API secret"

Expected results:
installplan success.

Additional info:

catalog:
time="2022-06-07T08:41:00Z" level=warning msg="skipping secret scoped-dockercfg-hnxmp - <nil>" mode=scoped namespace=test-41174 sa=scoped
time="2022-06-07T08:41:00Z" level=error msg="failed to get a client for plan execution: the service account does not have any API secret sa=test-41174/scoped"
E0607 08:41:00.302468       1 queueinformer_operator.go:290] sync {"update" "test-41174/install-pqslc"} failed: the service account does not have any API secret sa=test-41174/scoped