I'm using `image-override` to pull from a private ECR repo, but it doesn't work unless I can set `image-pull-credentials-type-override` to `SERVICE_ROLE`.