Description of problem:

Prerequisites (if any, like setup, operators/versions):

• OCP cluster (ROSA 4.20)

Steps to Reproduce

Tested with the Operator, but the same issue might happen for Helm as well.
CR:

apiVersion: rhdh.redhat.com/v1alpha5
kind: Backstage
metadata: 
  name: bs1
spec: 
  application: 
    extraEnvs: 
      envs: 
        - name: CATALOG_INDEX_IMAGE
          # Doesn't exist, but just wanted to anticipate the fact that the catalog index image will come by default from RRIO in the shipped version of the oeprator
          value: registry.redhat.io/rhdh/rhdh-plugin-index-catalog:1.9
          containers: [ install-dynamic-plugins ]

Actual results:

The init container fails with auth issues:

======= Created lock file: /dynamic-plugins-root/install-dynamic-plugins.lock

======= Extracting catalog index from registry.redhat.io/rhdh/rhdh-plugin-index-catalog:1.9
==> Copying catalog index image to local filesystem
Traceback (most recent call last):
File "/opt/app-root/src/install-dynamic-plugins.py", line 1175, in <module>
main()
File "/opt/app-root/src/install-dynamic-plugins.py", line 1041, in main
catalog_index_default_file = extract_catalog_index(catalog_index_image, dynamic_plugins_root, catalog_entities_parent_dir)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/app-root/src/install-dynamic-plugins.py", line 987, in extract_catalog_index
raise InstallException(f"Failed to download catalog index image

Unknown macro: {catalog_index_image}

:

Unknown macro: {result.stderr}

")
InstallException: Failed to download catalog index image registry.redhat.io/rhdh/rhdh-plugin-index-catalog:1.9: time="2026-01-12T14:59:09Z" level=fatal msg="initializing source docker://registry.redhat.io/rhdh/rhdh-plugin-index-catalog:1.9: unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication"

======= Cleaning up temporary catalog index directory
======= Removed lock file: /dynamic-plugins-root/install-dynamic-plugins.lock

This might be expected on non-OCP, but for OCP, we should be able to pull any images from RRIO out of the box.

Expected results:

It should fail currently (because the image is not there yet), but not for authentication reasons.

This might be expected on non-OCP, but for OCP, we should be able to pull any images from RRIO out of the box.

This means that we at least should explicitly document how non-OCP users should make sure their auth creds are available to the Skopeo in the init container.

For OCP, let's try to see how we can make it work by default, possibly using the same mechanism that allows images to be pulled by the Kubelet from RRIO.

Reproducibility (Always/Intermittent/Only Once):

Always

Build Details:

Additional info (Such as Logs, Screenshots, etc):