The pod placement controller should not use cluster service-ca.crt CA to inspect image arch if the user don't added it to trusted anchors explicitly.

always

    1. Build a registry in the clustet and use ingress to export the route, the router uses tls re-encryption   
    2. Deploy a workload with the image in above registry
    3. Check pod nodeaffinify
    

the kubelet can't pull image with error x509: certificate signed by unknown authority, but PPC can correctly inspect image arch and add nodeaffinify in it

The PPC should not use the cluster-ca.crt to inspect image if the user don't added it to trusted anchors explicitly.