GKE workload identity

Expected Behavior

allow add annotation to ksa tekton-pipelines-controller

Actual Behavior

tekton-operator will create ksa tekton-pipelines-controller and even if you annotate it with google service account, reconciler will remove the annotation

Steps to Reproduce the Problem

1. install tekton-pipelines with tekton-operator
2. try to run PipelineRun with pipelineRef: bundle:
3. get error

CouldntGetTask
Pipeline tekton/kubernetes-sanity can't be Run; it contains Tasks that don't exist: Couldn't retrieve Task "kustomize-lint": GET https://us-east4-docker.pkg.dev/v2/token?scope=repository%3Agcp-project%2Ftekton-catalog%2Ftask%2Fkustomize-lint%3Apull&service=us-east4-docker.pkg.dev: DENIED: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/GCP-project/locations/us-east1/repositories/tekton-catalog" (or it may not exist)

broken in releases higher then https://storage.googleapis.com/tekton-releases/operator/previous/v0.54.0/release.yaml

No source file or test is named. Inspect the tekton-operator reconciliation that creates the tekton-pipelines-controller KSA, then compare release.yaml from v0.54.0 with a later release. Done means the Google service account annotation survives reconciliation and the reported PipelineRun can retrieve its bundled Task.