Upgrade resources in-place, causing 1-1 mapping between autoscaling runner set and ephemeral runner set (#4516)

config/crd/bases/actions.github.com_ephemeralrunnersets.yaml

@@ -59,7 +59,10 @@ spec:
               description: EphemeralRunnerSetSpec defines the desired state of EphemeralRunnerSet
               properties:
                 ephemeralRunnerMetadata:
-                  description: ResourceMeta carries metadata common to all internal resources
+                  description: |-
+                    EphemeralRunnerMetadata is the metadata to be applied to all ephemeral runners created by this set.
+                    If the EphemeralRunnerMetadata is updated, the update applies to new ephemeral runners created after the update,
+                    but does not apply to existing ephemeral runners.
                   properties:
                     annotations:
                       additionalProperties:

config/rbac/role.yaml

@@ -46,22 +46,13 @@ rules:
   - ""
   resources:
   - secrets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
   - serviceaccounts
   verbs:
   - create
   - delete
   - get
   - list
+  - update
   - watch
 - apiGroups:
   - actions.github.com
@@ -170,15 +161,6 @@ rules:
   - rbac.authorization.k8s.io
   resources:
   - rolebindings
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
   - roles
   verbs:
   - create