Enabling crdHook makes the helm chart use bitnami/kubectl:latest, however replacing it with a custom image doesn't allow setting imagePullSecret. Notice there's no imagePullSecret definition in the crd-install-job.yaml template.
https://github.com/Altinity/clickhouse-operator/blob/master/deploy/helm/clickhouse-operator/templates/hooks/crd-install-job.yaml#L21