patch-operator VS egressip-ipam-operator

TitanSoft's imagepullsecret-patcher is a single-binary solution to replicating and using an image pull secret across all namespaces. It is not actively maintained, but the tool is simple enough that a small team should be able to patch and maintain a fork if needed. If you want to stick to other maintained open source tools, a reasonable solution can also be put together using external secrets operator. If you are operating a cluster at scale, you may already be using this. Red Hat's patch-operator can be used to attach the imported secrets to your service accounts across all namespaces, though there are some quirks to be wary of, due to the lack of a defined patch strategy for imagePullSecrets on service accounts.

HOWEVER, when we use EgressIPs (https://github.com/redhat-cop/egressip-ipam-operator) for our customers running on it, the pods have very different behavior. The pods can no longer hit the ingress VIP (LB) and just time out, but they can hit the API (LB) and some things allowed by the NSG. I've confirmed the pods using EgressIPs do leave the node that has the EgressIP assigned and can hit the nodes running the routers just fine (targeting port and spoofing DNS as seen in access logs).