fix: correct the deployment script

examples/tenant-4nodes.yaml

@@ -10,6 +10,9 @@ metadata:
     app: rustfs
 spec:
   image: rustfs/rustfs:latest
+  # Kind demos load the server image into node-local containerd. Avoid forcing
+  # Docker Hub access for the `latest` tag when the image is already present.
+  imagePullPolicy: IfNotPresent
   podManagementPolicy: Parallel
 
   # Credentials (optional - RustFS has built-in defaults if not specified)
@@ -59,6 +62,10 @@ spec:
   env:
     - name: RUST_LOG
       value: info
+    # Kind local PVs are backed by directories on the same Docker node disk.
+    # This is acceptable for local demos only; production must use distinct disks.
+    - name: RUSTFS_UNSAFE_BYPASS_DISK_CHECK
+      value: "true"
 
 ---
 # Credentials Secret for RustFS (keys must be at least 8 characters)

scripts/deploy/deploy-rustfs-4node.sh

@@ -343,6 +343,7 @@ deploy_operator_and_console() {
 
     local image_name="rustfs/operator:dev"
     local console_web_image="rustfs/console-web:dev"
+    local rustfs_server_image="rustfs/rustfs:latest"
 
     log_info "Building Operator (release)..."
     cargo build --release
@@ -372,14 +373,33 @@ deploy_operator_and_console() {
         exit 1
     }
 
-    # Load RustFS server image if present locally
+    # Load RustFS server image. The 4-node Kind demo is intended to run from a
+    # node-local image; if this fails, Tenant pods will fall back to Docker Hub
+    # and commonly end up in ImagePullBackOff in offline/proxied environments.
     if docker images --format '{{.Repository}}:{{.Tag}}' | grep -q '^rustfs/rustfs:latest$'; then
-        log_info "Loading RustFS server image..."
-        kind load docker-image rustfs/rustfs:latest --name ${CLUSTER_NAME} 2>/dev/null || log_warning "Failed to load rustfs/rustfs:latest; Tenant may pull from registry"
+        log_info "Loading RustFS server image into Kind..."
+        kind load docker-image "$rustfs_server_image" --name ${CLUSTER_NAME} || {
+            log_error "Failed to load rustfs/rustfs:latest into Kind"
+            log_info "Build or pull the RustFS server image first, then rerun:"
+            log_info "  docker build -t rustfs/rustfs:latest <rustfs-server-repo>"
+            log_info "  kind load docker-image rustfs/rustfs:latest --name ${CLUSTER_NAME}"
+            exit 1
+        }
     else
-        log_warning "rustfs/rustfs:latest not found locally; Tenant will try to pull from registry"
+        log_error "rustfs/rustfs:latest not found locally"
+        log_info "Build or pull the RustFS server image first, then rerun:"
+        log_info "  docker build -t rustfs/rustfs:latest <rustfs-server-repo>"
+        exit 1
     fi
 
+    log_info "Verifying RustFS server image is available on all Kind nodes..."
+    for node in "${CLUSTER_NAME}-control-plane" "${WORKER_NODES[@]}"; do
+        if ! docker exec "$node" crictl images 2>/dev/null | grep -Eq 'rustfs/rustfs[[:space:]]+latest'; then
+            log_error "rustfs/rustfs:latest was not loaded into Kind node ${node}"
+            exit 1
+        fi
+    done
+
     log_info "Creating Console JWT Secret..."
     local jwt_secret
     jwt_secret=$(openssl rand -base64 32 2>/dev/null || head -c 32 /dev/urandom | base64)

scripts/test/script-test.sh

@@ -25,5 +25,22 @@ bash -n scripts/deploy/deploy-rustfs-4node.sh && echo "  ✓ Syntax OK" || { ech
 echo "5. Checking scripts/cleanup/cleanup-rustfs-4node.sh..."
 bash -n scripts/cleanup/cleanup-rustfs-4node.sh && echo "  ✓ Syntax OK" || { echo "  ✗ Syntax Error"; exit 1; }
 
+echo "6. Checking 4-node tenant uses local Kind-friendly image pull policy..."
+grep -q '^  imagePullPolicy: IfNotPresent$' examples/tenant-4nodes.yaml \
+  && echo "  ✓ Tenant imagePullPolicy is IfNotPresent" \
+  || { echo "  ✗ examples/tenant-4nodes.yaml must set imagePullPolicy: IfNotPresent for local Kind demos"; exit 1; }
+
+echo "7. Checking 4-node deploy fails fast when RustFS server image is unavailable..."
+grep -q 'rustfs/rustfs:latest not found locally' scripts/deploy/deploy-rustfs-4node.sh \
+  && grep -q 'Failed to load rustfs/rustfs:latest into Kind' scripts/deploy/deploy-rustfs-4node.sh \
+  && echo "  ✓ RustFS server image load is fail-fast" \
+  || { echo "  ✗ deploy-rustfs-4node.sh must fail fast when rustfs/rustfs:latest cannot be loaded"; exit 1; }
+
+echo "8. Checking 4-node tenant enables RustFS local-disk bypass for Kind only..."
+grep -q '^    - name: RUSTFS_UNSAFE_BYPASS_DISK_CHECK$' examples/tenant-4nodes.yaml \
+  && grep -q '^      value: "true"$' examples/tenant-4nodes.yaml \
+  && echo "  ✓ Kind demo bypasses same-disk safety check explicitly" \
+  || { echo "  ✗ examples/tenant-4nodes.yaml must set RUSTFS_UNSAFE_BYPASS_DISK_CHECK=true for local Kind PVs"; exit 1; }
+
 echo ""
-echo "All script syntax checks passed! ✅"
+echo "All script checks passed! ✅"