its globally in the hub. The announcement says they are rolling out the block in March but this already blew up my k8s clusters since last weekend. Have tried looking for an option to tell k8s to always use authentication tokens for image pulls, but can't find a way, going to have to add Kyverno to mutate all incoming Deployments to add imagePullSecrets.