Just ended up manually added the service account to the pod template. I think I misunderstood the reason for the serviceAccountName option -- it isn't intended to add that service account to the pods. It's an annotation for the Operator to know how to enforce RBAC.