forked from cerc-io/stack-orchestrator
Testing specs can set image-pull-policy: IfNotPresent so kind-loaded local images are used instead of pulling from the registry. Production specs omit the key and get the default Always behavior. Root cause: with Always, k8s pulled the GHCR kubo image (with baked R2 endpoint) instead of the locally-built image (with https://s3:443), causing kubo to connect to R2 directly and get Unauthorized. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>