Deploying OLM using the package_release.sh script, which generates the k8s manifest files, does not allow me to apply tolerations to the upstream CatalogSource.
The workaround was to set installtype to "" and then install the catalogsource myself with the toleration.
grpcPodConfig:
securityContextConfig: restricted
tolerations:
- key: "key1"
operator: "Equal"
value: "value1"
effect: "NoSchedule"