logging: use canonical upstream image names (#433)

rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit (logarchiver/logviewer are untouched).

Changes:
- Point the ClickHouseInstallation and the clickhouse-schema job at `docker.io/clickhouse/clickhouse-server:24.8`.
- Point the logviewer oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`.
- Point the NATS bootstrap job at `docker.io/natsio/nats-box:0.18.0`.
- Point the NATS chart values at `docker.io/library/nats` and `docker.io/natsio/nats-server-config-reloader`.
- Point all three Vector values files (agent, aggregator, vm-ingest) at `docker.io/timberio/vector`.
- Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values.

Tags/digests unchanged and the `repository`/`tag` split is preserved. `kustomize build --enable-helm apps/overlays/au-syd1/logging` differs from main only in those nine image strings.

Extra found, not changed here: `.woodpecker/vector-test.yaml` still pins its CI step image to `artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian`. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately.

Reviewed-on: #433
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/logging/clickhouseinstallation.yaml

@@ -87,7 +87,7 @@ spec:
             runAsGroup: 101
           containers:
             - name: clickhouse
-              image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+              image: docker.io/clickhouse/clickhouse-server:24.8
               resources:
                 requests:
                   cpu: 500m

apps/base/logging/job_clickhouse-schema.yaml

@@ -32,7 +32,7 @@ spec:
         runAsGroup: 101
       containers:
         - name: clickhouse-schema
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
+          image: docker.io/clickhouse/clickhouse-server:24.8
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

apps/base/logging/logviewer/oauth2-proxy-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/logging/nats-bootstrap-job.yaml

@@ -58,7 +58,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: nats-bootstrap
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
+          image: docker.io/natsio/nats-box:0.18.0
           # nats CLI stats the working directory when loading its response
           # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
           # default WORKDIR is not accessible ("stat .: permission denied"), so

apps/overlays/au-syd1/logging/values-nats.yaml

@@ -57,10 +57,9 @@ config:
                 - "_INBOX.>"
 
 container:
-  # Pulled through the artifactapi dockerhub remote (upstream official nats;
+  # Upstream official nats; no DHI variant available.
-  # no DHI variant available for nats).
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/nats
+    repository: docker.io/library/nats
     tag: 2.14.2-alpine
   env:
     NATS_ADMIN_PASSWORD:
@@ -94,10 +93,10 @@ podTemplate:
       annotations:
         configmap.reloader.stakater.com/auto: "true"
 
-# Config-reloader sidecar image, also through artifactapi.
+# Config-reloader sidecar image.
 reloader:
   image:
-    repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-server-config-reloader
+    repository: docker.io/natsio/nats-server-config-reloader
     tag: "0.23.0"
 
 natsBox:

apps/overlays/au-syd1/logging/values-vector-agent.yaml

@@ -5,10 +5,10 @@
 role: Agent
 fullnameOverride: vector-agent
 
-# Pulled through the artifactapi dockerhub remote; distroless-libc (no DHI —
+# distroless-libc (no DHI — subscription-gated/private-namespace, not reachable
-# subscription-gated/private-namespace, not reachable via the anon proxy).
+# via the anon proxy).
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 rbac:

apps/overlays/au-syd1/logging/values-vector-aggregator.yaml

@@ -15,7 +15,7 @@ role: Stateless-Aggregator
 fullnameOverride: vector-aggregator
 
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 # Horizontal autoscaling on CPU — safe with N replicas on one durable consumer.

apps/overlays/au-syd1/logging/values-vector-vm-ingest.yaml

@@ -6,7 +6,7 @@ fullnameOverride: vector-vm-ingest
 replicas: 2
 
 image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
+  repository: docker.io/timberio/vector
   tag: 0.57.0-distroless-libc
 
 workloadResourceAnnotations: