We need ca_dir to copy the certs in, but when we run in multi-node cases the use-buildset-registry invocation is in a separate place so we dont' leak the var in. This will get deleted in the next patch, but that patch is not working and we need this to unbreak the multi-arch functionality for nodepool. Change-Id: I4f92f0415fb471f304fdd0a1e576812c8d67ab24