Update existing ServiceAccount if some Role/RoleBinding was changed

[svor]

Is your task related to a problem? Please describe.

In case if Roles or RoleBindings were changed (updated/removed/added), existing workspace ServiceAccount doesn't apply such updates.
It would be nice to have a mechanism to apply diffs of Role/RoleBindings.

Additional context

This issue was caused by #19651

[tolusha]

In other words if roles exist then they are supposed to be updated, right?

[tolusha]

Why not fixed it in context of #19651 ?

[svor]

@tolusha even if a new role was added, existing SA should be updated. #19651 was created to add a new role to get metrics information but updating existing SA is another problem as for me

[l0rd]

I am trying to understand the impact of this issue and when users would be impacted by this issue. Why Role/RoleBindings should be updated? When does a user face this issue?

[l0rd]

After @skabashnyuk comment I now understand that this issue is reproduced whenever Che is updated from v7.29 (or CRW 2.8) or lower. And that the consequence is that existing users won't be able to start workspaces. But then I am not sure how QE hasn't found this problem earlier cc @dmytro-ndp?

[mshaposhnik]

@tolusha for correct implementation of that, we need to add at least update role right for che SA in user namespace. Any concerns?

[tolusha]

no concerns from my side.