logging: use canonical upstream image names

apps/base/logging/clickhouseinstallation.yaml

@@ -87,7 +87,7 @@ spec:
             runAsGroup: 101
           containers:
             - name: clickhouse
-              image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+              image: docker.io/clickhouse/clickhouse-server:24.8
               resources:
                 requests:
                   cpu: 500m

apps/base/logging/job_clickhouse-schema.yaml

@@ -32,7 +32,7 @@ spec:
         runAsGroup: 101
       containers:
         - name: clickhouse-schema
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+          image: docker.io/clickhouse/clickhouse-server:24.8
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

apps/base/logging/logviewer/oauth2-proxy-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/logging/nats-bootstrap-job.yaml

@@ -58,7 +58,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: nats-bootstrap
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
+          image: docker.io/natsio/nats-box:0.18.0
           # nats CLI stats the working directory when loading its response
           # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
           # default WORKDIR is not accessible ("stat .: permission denied"), so