The image registry operator fails to install when installing OpenShift 4.15.9 through ACM causing the overall cluster install to fail. The configs.imageregistry.operator.openshift.io/cluster manifest is not created as part of the bootstrapping process. The target environment for the managed cluster is OpenStack.

N/A    

This bug seems fairly reproducible    

1.Set up an OpenShift cluster on OpenStack and install ACM. This is the hub cluster.

2. Follow the instructions in the guide to create the required manifests for OpenStack as the target environment.The managed cluster is to be installed on the same OpenStack instance as the hub cluster. Create an individual pull secret for each Hive cluster. The clouds.yaml encoded in the secret should use application_credential_id and application_credential_secret and not username and password.Add platform.openstack.apiFloatingIP and platform.openstack.ingressFloatingIP to the install-config.yaml. In the ClusterDeployment manifest et spec.provisioning.imageSetRef.name to img4.15.9-x86-64-appsub (use the preexisting clusterimageset with this name). No machine pools were set.

Guide: https://github.com/openshift/hive/blob/master/docs/using-hive.md#using-hive

3. Deploy all resources and watch the logs of the pod in the namespace of the ClusterDeployment.The installation will fail saying the image-registry cluster is unavailable.

4. Log into the partially deployed managed cluster. The pods in the openshift-image-registry namespace say that the config.imageregistry.operator.openshift.io "cluster" cant be found. The pod also cant authenticate to OpenStack.
    

The managed cluster to be deployed is only partially installed and fails because the image-registry operator is unavailable.    

Deploying the ClusterDeployment should bring up a managed cluster.    

The OpenStack instance with the hub cluster and the intended location of the managed cluster is behind a VPN.

The clouds.yaml fields are as follows.

clouds:  
  openstack:    
    auth:      
     auth_url: xxx      
     application_credential_id: xxx      
     application_credential_secret: xxx      
     project_id: xxx      
     project_name: xxx      
     user_domain_name: xxx    
  region_name: xxx    
  interface: xxx    
  identity_api_version: xxx
 
I have attached the results of oc must gather in the comments.