This reason that UPS doesn't get provisioned properly seems to be that either the enmasse CRDs haven't been provisioned on the cluster yet, or maybe the SA doesn't have permissions to deal with them before the pod has started.

One solution could be to run something like the following until we get the result we want, before deploying the operator:

oc auth can-i create addressspaces -n mobile-unifiedpush --as system:serviceaccount:mobile-unifiedpush:unifiedpush-operator

There's also an additional problem to consider: the installation continues, even after timing out at the retries when it waits for it to be ready.