Ideally the updateOauthProxyConfig should run on every reconcile loop to ensure the correct (mirrored) oauth-proxy image is eventually detected.

But as per code when image stream is not pulled at start-up, it won't be reconciled later.

link