ImageContentSourcePolicy in management cluster impacting KAS pull reference

When the management cluster has ICSP resources, the pull reference of the Kube APIServer is replaced with a pull ref from the management cluster ICSPs resulting in a pull failure.

4.14

Always

1. Create a cluster with release registry.ci.openshift.org/ocp/release:4.14.0-0.nightly-2023-08-28-154013 on a management cluster that has ICSPs
2. Watch the kube-apiserver pods.

kube-apiserver pods are initially deployed with a pull ref from the release payload and they start, but then the deployment is updated with a pull ref from an ICSP mapping and the deployment fails to roll out.

kube-apiserver pods roll out successfully.