A user has described difficulties in using an internal registry when air-gapped.

As described in https://issues.redhat.com/browse/CRW-750, using a secured internal registry is troublesome. The user has to manually place a pull secret for the internal registry.

The user has devised a second way of using the internal registry. All images should be copied to the local (OpenShift) repository. Then when a new workspace is created, along with it comes a new Project with a Service Account. If the Service Account is given role system:image-puller, things work well.

oc policy add-role-to-user system:image-puller system:serviceaccout:user-codeready:che-workspace --namespace=workspaces

This request is to make an option to automate this action. (Giving system:image-puller to the SA).