I did some search in this repo and seems the current observatorium operator can not config the imagepullsecret in the CR, so if I have my private image registry and already have mirrored the required images from public repo, I need to config a global pull secret to make it run or add the pull secret in each of serviceaccount created by observatorium operator, but actually I did not want to create the global imagepullsecret since I did not want all of namespaces share the same permission to access my private repo.