In my VCF 9.1.0 lab, a DNS failure prevented the injected Vault Agent image from being pulled into a VKS cluster. I worked around it by redirecting the image reference to the same digest in the existing Regional Harbor depot.