From 6c886748d785d05dfdb632214cdc1837daf0b789 Mon Sep 17 00:00:00 2001
From: Christoph Barbian <christoph.barbian@sap.com>
Date: Tue, 18 Aug 2026 10:32:18 +0200
Subject: [PATCH 1/2] refine default weak apply/delete orders for rbac
 resources

---
 pkg/reconciler/util.go | 26 ++++++++++++++++----------
 pkg/types/funcmap.go   | 10 ++++++++++
 2 files changed, 26 insertions(+), 10 deletions(-)
 create mode 100644 pkg/types/funcmap.go

diff --git a/pkg/reconciler/util.go b/pkg/reconciler/util.go
index 00cec0c9..acce7d87 100644
--- a/pkg/reconciler/util.go
+++ b/pkg/reconciler/util.go
@@ -237,12 +237,13 @@ func sortObjectsForApply[T client.Object](s []T, orderFunc func(client.Object) i
 		"RuntimeClass.node.k8s.io":                                    -2,
 		"PriorityClass.scheduling.k8s.io":                             -2,
 		"StorageClass.storage.k8s.io":                                 -2,
-		"ConfigMap":                                                   -1,
-		"Secret":                                                      -1,
+		"ServiceAccount":                                              -2,
 		"ClusterRole.rbac.authorization.k8s.io":                       -2,
 		"Role.rbac.authorization.k8s.io":                              -2,
 		"ClusterRoleBinding.rbac.authorization.k8s.io":                -1,
 		"RoleBinding.rbac.authorization.k8s.io":                       -1,
+		"ConfigMap":                                                   -1,
+		"Secret":                                                      -1,
 		"APIService.apiregistration.k8s.io":                           1,
 	}
 	f := func(x T, y T) bool {
@@ -262,14 +263,19 @@ func sortObjectsForDelete(inventory []*InventoryItem) []*InventoryItem {
 		// TODO: should webhook configurations be deleted before order-zero objects?
 		"ValidatingWebhookConfiguration.admissionregistration.k8s.io": 1,
 		"MutatingWebhookConfiguration.admissionregistration.k8s.io":   1,
-		"Service":                         2,
-		"ConfigMap":                       2,
-		"Secret":                          2,
-		"Namespace":                       3,
-		"IngressClass.networking.k8s.io":  4,
-		"RuntimeClass.node.k8s.io":        4,
-		"PriorityClass.scheduling.k8s.io": 4,
-		"StorageClass.storage.k8s.io":     4,
+		"Service":                               2,
+		"ConfigMap":                             2,
+		"Secret":                                2,
+		"ServiceAccount":                        2,
+		"ClusterRole.rbac.authorization.k8s.io": 2,
+		"Role.rbac.authorization.k8s.io":        2,
+		"ClusterRoleBinding.rbac.authorization.k8s.io": 2,
+		"RoleBinding.rbac.authorization.k8s.io":        2,
+		"Namespace":                                    3,
+		"IngressClass.networking.k8s.io":               4,
+		"RuntimeClass.node.k8s.io":                     4,
+		"PriorityClass.scheduling.k8s.io":              4,
+		"StorageClass.storage.k8s.io":                  4,
 	}
 	f := func(x *InventoryItem, y *InventoryItem) bool {
 		orderx := x.DeleteOrder
diff --git a/pkg/types/funcmap.go b/pkg/types/funcmap.go
new file mode 100644
index 00000000..fa34a7dd
--- /dev/null
+++ b/pkg/types/funcmap.go
@@ -0,0 +1,10 @@
+/*
+SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and component-operator-runtime contributors
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package types
+
+// FuncMapBuilder interface.
+type FuncMapBuilder interface {
+}

From aa91ba467613322cbf18cae20202cdfb4876fd07 Mon Sep 17 00:00:00 2001
From: Christoph Barbian <christoph.barbian@sap.com>
Date: Tue, 18 Aug 2026 10:36:13 +0200
Subject: [PATCH 2/2] cleanup

---
 pkg/types/funcmap.go | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 pkg/types/funcmap.go

diff --git a/pkg/types/funcmap.go b/pkg/types/funcmap.go
deleted file mode 100644
index fa34a7dd..00000000
--- a/pkg/types/funcmap.go
+++ /dev/null
@@ -1,10 +0,0 @@
-/*
-SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and component-operator-runtime contributors
-SPDX-License-Identifier: Apache-2.0
-*/
-
-package types
-
-// FuncMapBuilder interface.
-type FuncMapBuilder interface {
-}