01a09a229a
The k8up operator (deployed via the k8up-system app) and its restic backup/prune/check jobs both run ghcr.io/k8up-io/k8up, which the containerd mirror only serves when the image path is allowlisted. - Add ^k8up-io/ to the ghcr remote patterns