fix the bug

Author: FxKu

pkg/cluster/cluster.go

@@ -1037,16 +1037,15 @@ func (c *Cluster) Update(oldSpec, newSpec *acidv1.Postgresql) error {
 		annotationsChanged, _ := c.compareAnnotations(oldSpec.Annotations, newSpec.Annotations, nil)
 
 		initUsers := !sameUsers || !sameRotatedUsers || needPoolerUser || needStreamUser
-		if initUsers {
+		if initUsers || annotationsChanged {
 			c.logger.Debug("initialize users")
 			if err := c.initUsers(); err != nil {
 				c.logger.Errorf("could not init users - skipping sync of secrets and databases: %v", err)
 				userInitFailed = true
 				updateFailed = true
 				return
 			}
-		}
-		if initUsers || annotationsChanged {
+
 			c.logger.Debug("syncing secrets")
 			//TODO: mind the secrets of the deleted/new users
 			if err := c.syncSecrets(); err != nil {

pkg/cluster/k8sres.go

@@ -1900,12 +1900,7 @@ func (c *Cluster) generateUserSecrets() map[string]*v1.Secret {
 }
 
 func (c *Cluster) generateSingleUserSecret(pgUser spec.PgUser) *v1.Secret {
-	// skip rotation users (not now to check if e2e test fails)
-	//if pgUser.Rotated {
-	//	return nil
-	//}
-
-	// skip users with no password i.e. human users (they'll be authenticated using pam)
+	//Skip users with no password i.e. human users (they'll be authenticated using pam)
 	if pgUser.Password == "" {
 		if pgUser.Origin != spec.RoleOriginTeamsAPI {
 			c.logger.Warningf("could not generate secret for a non-teamsAPI role %q: role has no password",
@@ -1914,7 +1909,7 @@ func (c *Cluster) generateSingleUserSecret(pgUser spec.PgUser) *v1.Secret {
 		return nil
 	}
 
-	// skip NOLOGIN users
+	//skip NOLOGIN users
 	for _, flag := range pgUser.Flags {
 		if flag == constants.RoleFlagNoLogin {
 			return nil