The kubelet credential provider cache expires before the node refreshes its cloud identity, and private registry pulls fail only after several hours

New pods work immediately after boot, but later image pulls break because two credential lifecycles drift apart.