imagepullsecrets for postgres clusters in other namespaces than the operator

Please, answer some short questions which should help us to understand your problem / question better?

• Which image of the operator are you using? ghcr.io/zalando/postgres-operator:v1.12.2
• Where do you run it - cloud or metal? Kubernetes or OpenShift? AWS K8s/EKS
• Are you running Postgres Operator in production? yes
• Type of issue? feature request

Some general remarks when posting a bug report:

• Please, check the operator, pod (Patroni) and postgresql logs first. When copy-pasting many log lines please do it in a separate GitHub gist together with your Postgres CRD and configuration manifest.
• If you feel this issue might be more related to the Spilo docker image or Patroni, consider opening issues in the respective repos.

We are pulling all docker images through our own registry, which requires imagepullsecrets.
I was able to successfully do this by creating a ServiceAccount with the needed imagepullsecrets and referencing it in the helm values under podServiceAccount.name.
However, this only works as long as you create postgres-clusters in the same namespace as your operator.
When creating a cluster in a different namespace, it is not able to retrieve the correct imagepullsecrets.

It would make things a lot easier if we had the possibility to provide imagepullsecrets in the postgres-cluster manifest instead, which will then be used in all the relevant pods.

Our idea was:
Have one general postgres-operator in its own postgres-operator namespace.
Have clusters related to a project in the projects namespace (so that the application can directly access the cluster's secrets to get login creds to the database, as secrets cannot be accessed across namespaces)

If anyone has a workaround, this is welcome as well.
Let me know what you think. Thanks!

Start by tracing how podServiceAccount.name and the postgres-cluster manifest are handled when clusters are reconciled in another namespace. Check how imagePullSecrets reach the relevant cluster pods; done means a cluster manifest can provide secrets that are used successfully for its images outside the operator namespace.