Goal: 

• Most service operators in openstack-k8s-operators have code in them to create restricted service accounts (SAs) used to deploy the openstack services themselves. These service accounts have ownership set on them
  to the CRDs themselves and this is versioned. If you are upgrading a CRD which has ownership set on an old version you will need to patch the SA to the new version and/or recreate the service accounts
  as part of the conversion logic in your controller.

Acceptance Criteria:

• Conversion webhook updates work and any required changes to service account ownership (which may be owned by older versioned CRDs) get automatically configured during reconciliation