fix(apps): allow unpinned referenced account secrets (#10810)

Author: leon-ape

controllers/apps/component/transformer_component_account.go

@@ -200,7 +200,8 @@ func (t *componentAccountTransformer) getPasswordFromSecret(transCtx *componentT
 	if err := transCtx.GetClient().Get(transCtx.GetContext(), secretKey, secret); err != nil {
 		return nil, err
 	}
-	if revision, ok := secret.Annotations[constant.SecretRevisionAnnotationKey]; ok && revision != account.SecretRefRevision {
+	if revision, ok := secret.Annotations[constant.SecretRevisionAnnotationKey]; ok &&
+		account.SecretRefRevision != "" && revision != account.SecretRefRevision {
 		return nil, ctrlutil.NewRequeueError(time.Second,
 			fmt.Sprintf("wait for referenced account secret %s/%s revision %s",
 				secret.Namespace, secret.Name, account.SecretRefRevision))

controllers/apps/component/transformer_component_account_test.go

@@ -186,6 +186,12 @@ func TestBuildAccountSecretRevisionContract(t *testing.T) {
 	if err = fakeClient.Update(context.Background(), referenced); err != nil {
 		t.Fatalf("update referenced Secret revision: %v", err)
 	}
+	unversionedAccount := account
+	unversionedAccount.SecretRefRevision = ""
+	if _, err = (&componentAccountTransformer{}).buildAccountSecret(transCtx, unversionedAccount); err != nil {
+		t.Fatalf("a managed Secret should be read when no revision is requested: %v", err)
+	}
+
 	if _, err = (&componentAccountTransformer{}).buildAccountSecret(transCtx, account); !intctrlutil.IsRequeueError(err) || intctrlutil.IsDelayedRequeueError(err) {
 		t.Fatalf("a managed Secret with a mismatched revision should stop and requeue, got %v", err)
 	}