chore: replace registry for the pause container, fix multicluster test (#14918)

## `pause` container registry change

For the past few days, pulling `gcr.io/google_containers/pause:3.2` has failed sporadically:

```
$ docker pull gcr.io/google_containers/pause:3.2
Error response from daemon: unknown: failed to resolve reference "gcr.io/google_containers/pause:3.2": unexpected status from HEAD request to https://gcr.io/v2/google_containers/pause/manifests/3.2: 400 Bad Request
```

Also Artifact Hub scanning is failing:

```
error scanning image gcr.io/google_containers/pause:3.2: error running trivy on image gcr.io/google_containers/pause:3.2: 2026-02-11T18:45:49Z FATAL Fatal error run error: image scan error: scan error: scan failed: failed analysis: unable to get the image ID: unable to get the image ID: GET https://gcr.io/v2/google_containers/pause/blobs/sha256:80d28bedfe5dec59da9ebf8e6260224ac9008ab5c11dbbe16ee3ba3e4439ac2c: NAME_INVALID: Request contains an invalid argument.

(package linkerd-multicluster:2025.10.6)
```

It appears the `gcr.io/google_containers` registry is no longer favored and instead the `registry.k8s.io` has been what's [officially supported](https://kubernetes.io/blog/2022/11/28/registry-k8s-io-faster-cheaper-ga/), so we're switching to that one.

## Don't install Gateway API in the multicluster integration test target cluster

As of k8s v1.34, k3d's Traefik is installing the Gateway API on its own, among which there is a `backendtglspolicies` CRD pointing to v1.4, which conflicts with v1.2.0 that we are attempting to install.

Therefore this change moves the GWAPI installation step from the go test to the actions workflow, applying the GWAPI manifests only where necessary.

Author: alpeb

.github/workflows/integration.yml

@@ -336,9 +336,10 @@ jobs:
       fail-fast: false
       matrix:
         cases:
-        - {k8s: "v1.23", manage-controllers: false}
-        - {k8s: "v1.34", manage-controllers: false}
-        - {k8s: "v1.34", manage-controllers: true}
+        - {k8s: "v1.23", manage-controllers: false, install-gwapi: true}
+        # for v1.34 onwards, gwapi gets installed by Traefik on the target cluster
+        - {k8s: "v1.34", manage-controllers: false, install-gwapi: false}
+        - {k8s: "v1.34", manage-controllers: true, install-gwapi: false}
     name: "test-multicluster(${{ matrix.cases.k8s }}, ${{ matrix.cases.manage-controllers && 'managed-controllers' || 'unmanaged-controllers' }})"
     steps:
       - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff
@@ -370,11 +371,21 @@ jobs:
           done
       - run: docker image ls
       - run: just mc-test-build
-      - name: Run just mc-test-load
+      - name: Run just mc-load
         run: |
           just linkerd-tag='${{ needs.meta.outputs.tag }}' \
               k3d-k8s='${{ matrix.cases.k8s }}' \
-              mc-test-load
+              mc-load
+      - run: just mc-install-gwapi
+      - name: Run just mc-target-load
+        run: |
+          just linkerd-tag='${{ needs.meta.outputs.tag }}' \
+              k3d-k8s='${{ matrix.cases.k8s }}' \
+              mc-target-load
+      - name: Run just mc-install-gwapi
+        if: ${{ matrix.cases.install-gwapi }}
+        run: just k3d-name='l5d-test-target' mc-install-gwapi
+      - run: just mc-flat-network-init
       - name: Run just mc-test-run
         run: |
           just linkerd-tag='${{ needs.meta.outputs.tag }}' \

justfile

@@ -2,6 +2,8 @@
 
 lint: action-lint action-dev-check md-lint sh-lint rs-fetch rs-clippy rs-check-fmt go-lint
 
+export GWAPI_VERSION := "v1.2.0"
+
 ##
 ## Go
 ##
@@ -490,9 +492,9 @@ mc-target-k3d-delete:
             k3d-delete
     fi
 
-_mc-load: _k3d-init linkerd-load
+mc-load: _k3d-init linkerd-load
 
-_mc-target-load:
+mc-target-load:
     @{{ just_executable() }} \
         k3d-name='{{ k3d-name }}-target' \
         k3d-k8s='{{ k3d-k8s }}' \
@@ -505,17 +507,15 @@ _mc-target-load:
         linkerd-exec='{{ linkerd-exec }}' \
         linkerd-tag='{{ linkerd-tag }}' \
         _pause-load \
-        _mc-load
+        mc-load
 
-# Run the multicluster tests with cluster setup
-mc-test: mc-test-load mc-test-run
+mc-install-gwapi:
+	{{ _kubectl }} apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/${GWAPI_VERSION}/experimental-install.yaml
 
 mc-test-build:
     go build --mod=readonly \
         ./test/integration/multicluster/...
 
-mc-test-load: _mc-load _mc-target-load mc-flat-network-init
-
 k3d-source-server := "k3d-" + k3d-name + "-server-0"
 k3d-target-server := "k3d-" + k3d-name + "-target-server-0"
 

multicluster/charts/linkerd-multicluster/values.yaml

@@ -41,7 +41,7 @@ gateway:
   tolerations: []
 
   # -- The pause container to use
-  pauseImage: "gcr.io/google_containers/pause:3.2"
+  pauseImage: "registry.k8s.io/pause:3.2"
 
   # -- User id under which the gateway shall be ran
   UID: 2103

multicluster/cmd/testdata/install_default.golden

@@ -823,7 +823,7 @@ fn mk_pause(ns: &str, name: &str) -> k8s::Pod {
         spec: Some(k8s::PodSpec {
             containers: vec![k8s::api::core::v1::Container {
                 name: "pause".to_string(),
-                image: Some("gcr.io/google_containers/pause:3.2".to_string()),
+                image: Some("registry.k8s.io/pause:3.2".to_string()),
                 ..Default::default()
             }],
             ..Default::default()

multicluster/cmd/testdata/install_ha.golden

@@ -94,11 +94,6 @@ func TestInstall(t *testing.T) {
 	// Global state to keep track of clusters
 	contexts = TestHelper.GetMulticlusterContexts()
 	for _, ctx := range contexts {
-		err = TestHelper.InstallGatewayAPIWithContext(ctx)
-		if err != nil {
-			testutil.AnnotatedFatal(t, "failed to install gateway-api", err)
-		}
-
 		// Pipe cmd & args to `linkerd`
 		cmd := append([]string{"--context=" + ctx}, cmd...)
 		out, err := TestHelper.LinkerdRun(cmd...)

multicluster/cmd/testdata/install_psp.golden

@@ -749,12 +749,6 @@ func (h *TestHelper) InstallGatewayAPI() error {
 	return err
 }
 
-func (h *TestHelper) InstallGatewayAPIWithContext(ctx string) error {
-	url := fmt.Sprintf("https://github.com/kubernetes-sigs/gateway-api/releases/download/%s/experimental-install.yaml", GATEWAY_API_VERSION)
-	_, err := h.KubectlWithContext("", ctx, "apply", "-f", url)
-	return err
-}
-
 // ReadFile reads a file from disk and returns the contents as a string.
 func ReadFile(file string) (string, error) {
 	b, err := os.ReadFile(file)