The feature implemented in LOG-2228 (followed-up by LOG-2679) uses the ImageStream`openshift/oauth-proxy` to select an image to use for the proxy used in the Kibana deployment.

Currently this implementation uses our own heuristic to select whether to use the internal registry or the public image reference. While this works in most cases, including our test cases for disconnected clusters, it turns out that the current implementation is not suitable for all environments.

The ImageStream CRD contains a property referencePolicy (docs) which determines which reference should be used for the image.

The code in elasticsearch-operator should be updated to either make use of the referencePolicy attribute. Alternatively we could switch to using the ImageStreamTag resource instead which has a dockerImageReference property, which is updated automatically to contain the correct image reference based on the referencePolicy of the associated ImageStream.