A frequent cause of support issues in disconnected environments is users passing their regular Red Hat pull secret in the install-config and forgetting to add any credentials for their mirror registry. This always results in a bootstrap node that can't pull any container images, which is challenging to debug and probably usually results in a support request.

The install-config contains both the pull secret and the ImageDigestSources list that contains the pointers to mirrors. It should be easy to cross-reference these to determine if some or all of the mirrors listed cannot ever be authenticated to.

Initially we can log a warning - this is probably worth backporting. If that proves not to generate false positives then we can upgrade it to an error later.