this is a staging repository, which has lower security than registry.k8s.io, so we should REALLY be pinning it.
TODO: This is one of the few places we still depend on GCR to build things. We should consider promoting this image to registry.k8s.io or using a different image.