6767b49649
Same pattern as infinity-tales and marktvogt.de: the tenant-2 namespace holds a pre-provisioned dockerconfigjson secret named itsh-registry that authenticates pulls from registry.itsh.dev. Reference it from the pod spec so the kubelet can fetch the image.