serviceaccounts.yml

# Apply this after applying `catalogSource.yml`, and after the various
# resources created by the latter have stabilized. This will make
# the **already-existing** `isas-fsd-catalog` ServiceAccount
# capable of pulling from quay-its.epfl.ch, pending resolution of
# https://go.epfl.ch/INC0674050 ; and thereby fix its `ErrImagePull` /
# `ImagePullBackoff` status.
#
# **DO NOT** do this too soon! The catalog operator doesn't believe in
# service accounts that it did not create itself! (As seen in
# https://github.com/operator-framework/operator-lifecycle-manager/blob/1c097187b00d13741b4f4904a89cfecdf0c087fc/pkg/controller/registry/reconciler/grpc.go#L119
# , itself called by `CheckRegistryServer`). The symptom will be that
# your CatalogSource will be marked as “unhealthy” from the Events of
# the consuming `Subscription` (despite that info being poised to move
# into CatalogSource:
# https://github.com/operator-framework/operator-lifecycle-manager/blob/1c097187b00d13741b4f4904a89cfecdf0c087fc/pkg/controller/operators/catalog/operator.go#L1005C1-L1005C71
# but I digress)
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: isas-fsd-catalog
  namespace: openshift-marketplace
imagePullSecrets:
- name: svc0041-rke2-puller-pull-secret

---
# Same story, (different image) but for the “operator's operator” (controller pod)
# that pops up when you set up your first `NfsSubdirProvisioner` object.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: openshift-marketplace
imagePullSecrets:
- name: svc0041-rke2-puller-pull-secret