After the one-bundle refactor, openstack-operator creates the controller-manager and other deployments that used to be part of the CSVs belonging to other operators.

At least some of the image pullspecs needed by those deployments aren't exposed by the openstack-operator CSV, so there is no way for downstream builds to replace them with downstream values.

The one instance we've detected is kube-rbac-proxy. There may or may not be others.