Use dedicated service account

[jflowers]

Create a dedicated ServiceAccount for the operator, in lieu of using system:default
this should be created from config/rbac/serviceaccount.yml