Private registry pulls fail with x509 unknown authority after node image refresh

Only refreshed nodes fail to pull from the internal registry because the new node image no longer trusts the custom CA chain.