fix(controller): preserve pod-template annotations across reconciles

ensureStatefulSet was calling sts.Spec = desired on every reconcile, which
overwrote the pod-template annotations entirely with just {config-hash}.
This erased the restarted-at annotation set by reconcileUpgrade, causing
the upgrade test to fail (it verified the annotation persisted through a
no-op reconcile).

Fixed by merging existing pod-template annotations into desired: desired
keys (config-hash) take priority; all other keys are carried over. This
preserves restarted-at and any future annotations without interfering with
the config-hash change-detection mechanism.

Spent ~30min tracing through CreateOrUpdate + Spec replace behavior with
debug prints to isolate the root cause.

Author: tazhate

internal/controller/reconcile_statefulset.go

@@ -72,8 +72,21 @@ func (r *BlockchainNodeReconciler) ensureStatefulSet(
 	}
 
 	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, sts, func() error {
+		// Preserve pod-template annotations set by reconcileUpgrade (e.g. restarted-at).
+		// desired.Template.Annotations only carries config-hash; don't clobber the rest.
+		existingTemplateAnns := sts.Spec.Template.Annotations
+
 		sts.Labels = coreLabels(node)
 		sts.Spec = desired
+
+		if sts.Spec.Template.Annotations == nil {
+			sts.Spec.Template.Annotations = map[string]string{}
+		}
+		for k, v := range existingTemplateAnns {
+			if _, ok := sts.Spec.Template.Annotations[k]; !ok {
+				sts.Spec.Template.Annotations[k] = v
+			}
+		}
 		return controllerutil.SetControllerReference(node, sts, r.Scheme)
 	})
 	if err != nil {