Ensure array contains element (aka kubectl patch -p)

[ChapChap]

Hi you,

I am using yedit to do a patch like operation on a kube ServiceAccount.
Command :
kubectl patch serviceaccount default -n monitoring -p '{"imagePullSecrets": [{"name": "monitoring-de-icr-io"}]}'

When I run this twice, it tells me no change and I have what I aim for which means

kubectl get sa test -n monitoring -o yaml
apiVersion: v1
imagePullSecrets:
- name: monitoring-de-icr-io
kind: ServiceAccount
metadata:
  creationTimestamp: "2020-05-20T15:25:38Z"
  name: test
  namespace: monitoring
  resourceVersion: "876792"
  selfLink: /api/v1/namespaces/monitoring/serviceaccounts/test
  uid: 48eedc79-3751-49e4-a519-7be8cea59ea2
secrets:
- name: test-token-8v5v8

Now what am I doing with yedit is :

    - name: Patch service account to use the image pull secret - Patch
      yedit:
        content: "{{ monitoring_sa.resources[0] }}"
        key: imagePullSecrets
        value: "name: monitoring-de-icr-io"
        append: true
      register: msg

The whole ope is

    - name: Patch service account to use the image pull secret - Get
      k8s_info:
        api_version: v1
        kind: ServiceAccount
        name: test
        namespace: monitoring
      register: monitoring_sa
    - debug: var=monitoring_sa
    - name: Patch service account to use the image pull secret - Patch
      yedit:
        content: "{{ monitoring_sa.resources[0] }}"
        key: imagePullSecrets
        value: "name: monitoring-de-icr-io"
        append: true
      register: msg
    - debug: var=msg.result[0].edit
    - name: Patch service account to use the image pull secret - Apply
      k8s:
        state: present
        definition: "{{ msg.result[0].edit }}"

But runing it twice gives me

kubectl get sa test -n monitoring -o yaml
apiVersion: v1
imagePullSecrets:
- name: monitoring-de-icr-io
- name: monitoring-de-icr-io
kind: ServiceAccount
metadata:
  creationTimestamp: "2020-05-20T15:25:38Z"
  name: test
  namespace: monitoring
  resourceVersion: "876792"
  selfLink: /api/v1/namespaces/monitoring/serviceaccounts/test
  uid: 48eedc79-3751-49e4-a519-7be8cea59ea2
secrets:
- name: test-token-8v5v8

the use of update gives empty result.

What is the best way to get this done please?