[BUG]KB reconciles ServiceAccount even it's user provided

[lancelot1989]

Describe the bug
KB reconciles ServiceAccount even it's user provided.

Some SA may contains other credentials like imagePullSecrets, which is used by many cloud providers for pulling images from a Container Registry instance without using a secret. If KB reconciles and removed this credentials, pods may be failed finally for lack of some neccesary credentials.

ACK(https://www.alibabacloud.com/help/zh/ack/ack-managed-and-ack-dedicated/user-guide/non-secret-pulling-container-image)

TKE(https://cloud.tencent.com/document/product/1141/48184)

To Reproduce
Steps to reproduce the behavior, likes screenshot below

Desktop (please complete the following information):

• KubeBlocks 1.0

[shanshanying]

Hi @lancelot1989
have you ever reproduce it on your local env ?

1. prepare as SA with imagePullSecrets
2. create a cluster and explicitly set servcieAccountName to the one create in step 1
3. check if SA has all the imagePullSecrets

[shanshanying]

cannot reproduce on ack (creat cluster specifying serviceAccountName as 'default', which is the default serviceaccount configured in acr-configuration.

[lancelot1989]

Searching k8s audit log we found that it's dataprotection doing sa’s patch. Which is because error setting of dataprotection likes below.

After recovering dataprotection's config, everything comes good.

[lancelot1989]

/reopen

[shanshanying]

/cc @wangyelei DataProtection should not touch the SA set by user ( leave the secret/impullsecret fields as it is ). could you please check how to improve the case ?