With the registry secret in the global pull secret ( oc get secret/pull-secret -n openshift-config ), an ordinary Pod deploys, while a ksvc will fail with

 Unable to fetch image "registry-mirror.apps.example.com/helloworld-go": failed to resolve image to digest: HEAD https://registry-mirror.apps.example.com/v2/helloworld-go/manifests/latest: unexpected status code 401 Unauthorized (HEAD responses have no body, use GET for details) 

(see https://docs.openshift.com/container-platform/4.8/openshift_images/managing_images/using-image-pull-secrets.html#images-update-global-pull-secret_using-image-pull-secrets )

Similarly how the Serverless Operator copy the CA configmaps, the operator could perhaps also be watching/copying the global pull secret and Serving would be configured to use it as an additional pull secret