fix(ci): pre-load GHCR images into kind to avoid ImagePullBackOff

- docker login ghcr.io → docker pull → kind load docker-image
- kind-conformance overlay sets imagePullPolicy: IfNotPresent
- Fixes: kind cluster cannot pull from private GHCR without auth

Author: mahmut-Abi

.github/workflows/conformance.yml

@@ -35,6 +35,14 @@ jobs:
           done
           kubectl wait --for=condition=established crd/gatewayclasses.gateway.networking.k8s.io --timeout=60s
 
+      - name: Pre-load images into kind
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          for img in nantian-controlplane dataplane dashboard; do
+            docker pull "ghcr.io/nantian-gw/${img}:latest"
+            kind load docker-image "ghcr.io/nantian-gw/${img}:latest" --name conformance
+          done
+
       - name: Deploy nantian-gw
         run: |
           kubectl apply -k deploy/kubernetes/overlays/kind-conformance

.github/workflows/e2e.yml

@@ -30,6 +30,14 @@ jobs:
           done
           kubectl wait --for=condition=established crd/gatewayclasses.gateway.networking.k8s.io --timeout=60s
 
+      - name: Pre-load images into kind
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          for img in nantian-controlplane dataplane dashboard; do
+            docker pull "ghcr.io/nantian-gw/${img}:latest"
+            kind load docker-image "ghcr.io/nantian-gw/${img}:latest" --name e2e
+          done
+
       - name: Deploy nantian-gw
         run: |
           kubectl apply -k deploy/kubernetes/overlays/kind-conformance

deploy/kubernetes/overlays/kind-conformance/kustomization.yaml

@@ -15,6 +15,14 @@ images:
     newName: ghcr.io/nantian-gw/dashboard
     newTag: latest
 
+patches:
+  - target:
+      kind: Deployment
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/imagePullPolicy
+        value: IfNotPresent
+
 generatorOptions:
   disableNameSuffixHash: true