Loading...

Type: Bug
Resolution: Done
Priority: Blocker
Fix Version/s: 1.9.1
Affects Version/s: 1.9.0
Component/s: Helm Chart, Operator
Labels:
None

Story Points:
2
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Ready:
False
Release Note Text:

Hide
= Authenticated registry used in chart and operator bundle

In 1.9.0, the authenticated Red Hat Ecosystem Catalog registry.redhat.io was incorrectly set in helm chart and operator bundle defaults, requiring that an authentication secret be configured in the cluster or a manual adjustment be done when installing.

This is fixed in 1.9.1, after switching the default registry to the unauthenticated one, registry.access.redhat.com.

Show
= Authenticated registry used in chart and operator bundle In 1.9.0, the authenticated Red Hat Ecosystem Catalog registry.redhat.io was incorrectly set in helm chart and operator bundle defaults, requiring that an authentication secret be configured in the cluster or a manual adjustment be done when installing. This is fixed in 1.9.1, after switching the default registry to the unauthenticated one, registry.access.redhat.com.
Release Note Type:
Bug Fix
Release Note Status:
Proposed
Intelligence Requested:
Market:

Sprint:
RHDH COPE 3288

SFDC Cases Links:
SFDC Cases Open:
SFDC Cases Counter:

Description of problem:

Looks like the released 1.9.0 of the Helm Chart/Operator points the plugin catalog index image to the authenticated `registry.redhat.io`.
See Operator and in the released Helm chart values:

# -- Catalog index configuration for automatic plugin discovery.
  # The `install-dynamic-plugins.py` script pulls this image if the `CATALOG_INDEX_IMAGE` environment variable is set.
  # The `dynamic-plugins.default.yaml` file will be extracted and written to `dynamic-plugins-root` volume mount.
  catalogIndex:
    image:
      registry: registry.redhat.io
      repository: rhdh/plugin-catalog-index@sha256
      # tag is set to digest via prepare.sh script
      # tag: "${PLUGIN_CATALOG_INDEX_DIGEST}"

      tag: "1026e4c63ed82cbe546dae87d516e2db71b590a1b59ee62c73674a535e826070"

As we caught in ~~RHDHBUGS-2485~~ and ~~RHIDP-11486~~, we should be using the unauthenticated registry.access.redhat.com reference instead.

Also reported here:

The default configuration of the Helm chart and the Operator therefore need to be updated, which means a new release of these install methods is needed.

Prerequisites (if any, like setup, operators/versions):

Helm or Operator 1.9.0

Steps to Reproduce

Just deploy a 1.9.0 RHDH instance using either Helm or the Operator or upgrade an existing instance to 1.9.0

Actual results:

The init container fails to start:

======= Created lock file: /dynamic-plugins-root/install-dynamic-plugins.lock

======= Extracting catalog index from registry.redhat.io/rhdh/plugin-catalog-
During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/app-root/src/install-dynamic-plugins.py", line 1284, in <module>
    main()
  File "/opt/app-root/src/install-dynamic-plugins.py", line 1150, in main
    catalog_index_default_file = extract_catalog_index(catalog_index_image, dynamic_plugins_root, catalog_entities_parent_dir)
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/app-root/src/install-dynamic-plugins.py", line 1093, in extract_catalog_index
    run_command(
  File "/opt/app-root/src/install-dynamic-plugins.py", line 179, in run_command
    raise InstallException(msg)
InstallException: Failed to download catalog index image registry.redhat.io/rhdh/plugin-catalog-index@sha256:1026e4c63ed82cbe546dae87d516e2db71b590a1b59ee62c73674a535e826070: command failed with exit code 1
command: /usr/bin/skopeo copy --override-os=linux --override-arch=amd64 docker://registry.redhat.io/rhdh/plugin-catalog-index@sha256:1026e4c63ed82cbe546dae87d516e2db71b590a1b59ee62c73674a535e826070 dir:/tmp/tmprphs5wth/catalog-index-oci
stderr: time="2026-03-04T17:20:48Z" level=fatal msg="initializing source docker://registry.redhat.io/rhdh/plugin-catalog-index@sha256:1026e4c63ed82cbe546dae87d516e2db71b590a1b59ee62c73674a535e826070: unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication"

======= Cleaning up temporary catalog index directory
======= Removed lock file: /dynamic-plugins-root/install-dynamic-plugins.lock

Expected results:

Should pull the plugin catalog index image from the unauthenticated `registry.access.redhat.com`, not `registry.redhat.io`

Reproducibility (Always/Intermittent/Only Once):

Always

Additional info (Such as Logs, Screenshots, etc):

Workaround for users is to manually override the catalog index image registry in the Backstage CR or Helm values file (or explicitly require creating an auth secret, but we wanted to avoid this, as discussed in ~~RHDHBUGS-2485~~).

is duplicated by

RHDHBUGS-2786 install-dynamic-plugins container is crashing in RHDH 1.9.0

Closed

is triggering

RHDHBUGS-2789 [rhdh] Add pre-commit check in sync-midstream.sh: verify related images (plugin-catalog-index, hub, operator, postgres) are pullable before committing bundle

New

RHDHBUGS-2790 [rhdh-plugin-catalog] Validate catalog-index dynamic-plugins.default.yaml (DPDY) image refs are valid/pullable

New

relates to

RHDHBUGS-2775 When tagging and branching, increment the rhdh-plugin-catalog-*.yaml RPAs

Review

links to

KCS

Details

Description

Description of problem:

Prerequisites (if any, like setup, operators/versions):

Steps to Reproduce

Actual results:

Expected results:

Reproducibility (Always/Intermittent/Only Once):

Additional info (Such as Logs, Screenshots, etc):

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates

PagerDuty