[tier0] MTA-801: Stateful app migration golden-file diff mismatch (redis)

[midays]

Summary

[MTA-801] Migrate all of PVCs that are associated with quiesced resource (tier0, pvc-transfer) failed during the "Compare YAML semantic diff of golden and actual export files" step for the redis app.

Test: crane/e2e-tests/tests/tier0/mta_801_stateful_migration_test.go:69
Jenkins run: https://jenkins-csb-migrationqe-main.dno.corp.redhat.com/job/mta/job/crane-ocp-tests-runner/350/testReport/

Failure details

The exported resource set does not match the golden file. The actual export contains extra resources that the golden file doesn't expect:

• RoleBindings: system:deployers, system:image-builders, system:image-pullers (present in both authorization.openshift.io/v1 and rbac.authorization.k8s.io/v1)
• ServiceAccounts: builder, deployer (golden only expects default)
• Secrets: dockercfg:builder, dockercfg:default, dockercfg:deployer
• ConfigMap: openshift-service-ca.crt

resource identity sets differ between golden and got directories:
[apps/v1|Deployment|redis|redis apps/v1|ReplicaSet|redis|owner:redis discovery.k8s.io/v1|EndpointSlice|redis|service:redis v1|ConfigMap|redis|kube-root-ca.crt v1|Endpoints|redis|redis v1|PersistentVolumeClaim|redis|redis-data v1|Secret|redis|redis v1|ServiceAccount|redis|default v1|Service|redis|redis]
vs
[apps/v1|Deployment|redis|redis apps/v1|ReplicaSet|redis|owner:redis authorization.openshift.io/v1|RoleBinding|redis|system:deployers authorization.openshift.io/v1|RoleBinding|redis|system:image-builders authorization.openshift.io/v1|RoleBinding|redis|system:image-pullers discovery.k8s.io/v1|EndpointSlice|redis|service:redis rbac.authorization.k8s.io/v1|RoleBinding|redis|system:deployers rbac.authorization.k8s.io/v1|RoleBinding|redis|system:image-builders rbac.authorization.k8s.io/v1|RoleBinding|redis|system:image-pullers v1|ConfigMap|redis|kube-root-ca.crt v1|ConfigMap|redis|openshift-service-ca.crt v1|Endpoints|redis|redis v1|PersistentVolumeClaim|redis|redis-data v1|Secret|redis|dockercfg:builder v1|Secret|redis|dockercfg:default v1|Secret|redis|dockercfg:deployer v1|Secret|redis|redis v1|ServiceAccount|redis|builder v1|ServiceAccount|redis|default v1|ServiceAccount|redis|deployer v1|Service|redis|redis]

Suggested fix

These extra objects (builder/deployer/image-puller RoleBindings, ServiceAccounts, and their dockercfg Secrets, plus openshift-service-ca.crt) are OpenShift's own auto-provisioned per-namespace objects, not resources the user created. Two options:

1. If crane's default export scope is expected to skip these auto-generated objects, update crane's default ignore/skip-resource list to filter them out at export time (they'd be regenerated by OpenShift on the target namespace anyway).
2. If the test cluster's default behavior changed (e.g. newer OpenShift version injects openshift-service-ca.crt and additional RBAC bindings by default), update the golden fixture file for this test to include the newly expected objects.

Recommend checking whether other tier0 golden-file tests exhibit the same drift — if so, this is likely an OpenShift version upgrade on the test cluster (migqe-*) rather than a one-off, and the fix should be applied consistently (ignore-list vs. golden update) across all affected goldens.