Quay is configured with the cluster-internal DNS for the Noobaa endpoint (s3.openshift-storage.svc), which is not accessible outside the cluster. Quay constructs blob URLs using this DNS, and thus Docker pulls won't work.

Solution is to either use FEATURE_PROXY_STORAGE or use the public S3 Route for Noobaa. The latter may come with its own self-signed TLS cert problem.