This message was deleted.

Note that I could also force its usage at containerd level but I'd prefer to be explicit so that policy tools like Kyverno are aware of it.

https://docs.rke2.io/install/containerd_registry_configuration ?

In my understanding this is for configuring containerd. I would like to explicitly have my private registry in the Pods definition in the image field. (For rke2 Pods)

Check the docs again. There is --system-default-registry. But I didn't test it. So it might still "look wrong". Regardless of the looks I don't think it's a good idea to "mess" with the system pods with Kyverno.