Needed so we can provide this workflow to customers following the proposal at https://github.com/openshift/enhancements/pull/1583

Reference https://issues.redhat.com/browse/WRKLDS-1015

image-registry pods are created by code residing in controllers provided by the image-registry operator. So changes are required in that repo to add a toleration to the node-role.kubernetes.io/control-plane:NoExecute taint. 

https://github.com/openshift/cluster-image-registry-operator/blob/5361c582b6d5fa44418e5748948f2af75956c716/bindata/nodecadaemon.yaml#L4 

The operator itself does not run in the control-plane nodes (not even the main app operand, only the node-ca Daemonset), so only node-ca DS needs updating