Docs [1] list steps to overwrite namespace annotations which define to-be-used UIDs/GIDs:

> Edit the default user ID (UID) and group ID (GID) range

This poses multiple problems/risks:

- Containers not supposed to be run in Linux user namespaces run in the defined UID range anyway
- Predefining `openshift.io/sa.*` annotations leads to unusable namespaces (see https://issues.redhat.com/browse/OCPBUGS-74643), so not really GitOps-friendly

[1]: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/nodes/working-with-pods#nodes-pods-user-namespaces-configuring_nodes-pods-user-namespaces