693f541840
go-cache-plugin serve binds 127.0.0.1 only, so a Service cannot reach it directly and CI/developer builds have no way to use the S3-backed cache. - Run go-cache-plugin serve against the gocache RGW bucket, path-style, with an explicit region to skip the GetBucketLocation probe - Add an nginx sidecar stream-proxying 9090 to the loopback plugin port - Restrict the listener to the workstation and pod CIDRs: GOCACHEPROG is unauthenticated and a poisoned entry runs in every consuming build - Stage the cache on an emptyDir; loss costs a repopulate from S3