That's a lot of infra to get this setup.

What we do instead is use a python script and a yaml file to mirror a defined set of images into our cloud managed registry (GCR/GAR). Internal images can only FROM images we host.

Thanks for checking out the content! A fixed set of images makes sense for many cases. However, for cases where maintaining images from a specific list is infeasible, a mirror is a good way to go about this. Another issue is going to be image updates / maintenance though this can be worked around nicely using a pull-through cache when there is internal control.

We get that control of images and versions through our git workflow and it also ensures wide consistency

Simple and minimal is nice