If the cluster protocol in the MobileSecurityServiceCR is set to HTTPS then the operator will internally use HTTPS for API requests. This is causing the API requests that are made from the operator to fail and it prevents apps being created or fetched.

Solution: Use HTTP instead of HTTPS for API requests that are made by the operator.