If the contents of the pull-secret in install-config.yaml does not contain an entry for the pullspec for the releaseImage defined in cluster-image-set.yaml it will result in an error in create-cluster-and-infraenv at runtime. It would be useful to detect this misconfiguration when the agent iso is built and output a warning.

For example, if the cluster-image-set.yaml contains:
releaseImage: registry.build03.ci.openshift.org/ci/release@sha256:4c85f5ab72e1c223b78e54aa08734a22b77f90ec4b602d96965cd10163605a12

and pull-secret has:
apiVersion: v1
kind: Secret
metadata:
creationTimestamp: null
name: hub-pull-secret
stringData:
.dockerconfigjson: |-
{
"auths": {
"registry.ci.openshift.org":

}
}

It would be good to detect this before the runtime error.