This message was deleted.

look in the containerd log file, in the k3s agent dir

Thanks for the tip. That log shows the following:

time="2022-12-13T13:09:57.955659153Z" level=info msg="PullImage \"<http://docker.io/bitnami/sealed-secrets-controller:v0.18.1\|docker.io/bitnami/sealed-secrets-controller:v0.18.1\>""
time="2022-12-13T13:09:57.988003491Z" level=info msg="trying next host - response was http.StatusNotFound" host=registry.<fqdn>
time="2022-12-13T13:10:00.955694023Z" level=info msg="PullImage \"<http://docker.io/bitnami/sealed-secrets-controller:v0.18.1\|docker.io/bitnami/sealed-secrets-controller:v0.18.1\>""
time="2022-12-13T13:10:00.986493372Z" level=info msg="trying next host - response was http.StatusNotFound" host=registry.<fqdn>

When I check

resolvectl

it shows the correct DNS server. And I can resolve it with

dig

. What could be causing this?

You got a NotFound from the registry, not from DNS. It doesn't have the image you tried to pull. Containerd is then falling back to the normal public endpoint.

Ahhhh, thanks for explaining. I found the cause now. Apparently there was a mismatch in helmcharts between building the environment and deploying it. Issue was entirely user-error 😄