Description of Problem

[Doc Bug] Enabling IOP is failing on Satellite and gives error while pulling images requires for IOP enablement

How reproducible

Customer is getting error while pulling images requiring IOP and returns exit code 125.

Checking the Satellite.log found below error

~~~
~~~
2026-01-07 13:33:57 [INFO ] [configure] /Stage[main]/Iop::Core_host_inventory_frontend/Podman::Image[core_host_inventory_frontend]/Exec[pull_image_core_host_inventory_frontend]/returns: time="2026-01-07T13:32:51+03:00" level=warning msg="Failed, retrying in 1s ... (2/3). Error: Source image rejected: Get \"
https://access.redhat.com/webassets/docker/content/sigstore/satellite/iop-host-inventory-frontend-rhel9@sha256=c2b513d4702fe7e97c7ac367da016313439f6da415f74ad705e90f6395560d04/signature-1\
": dial tcp
2.20.109.121
:443: i/o timeout"

2026-01-07 13:33:57 [INFO ] [configure] /Stage[main]/Iop::Core_host_inventory_frontend/Podman::Image[core_host_inventory_frontend]/Exec[pull_image_core_host_inventory_frontend]/returns: Error: unable to copy from source
[docker://registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9:6.18]
: Source image rejected: Get "
https://access.redhat.com/webassets/docker/content/sigstore/satellite/iop-host-inventory-frontend-rhel9@sha256=c2b513d4702fe7e97c7ac367da016313439f6da415f74ad705e90f6395560d04/signature-1
": dial tcp
2.20.109.83
:443: i/o timeout
2026-01-07 13:33:57 [ERROR ] [configure] 'podman image pull registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9:6.18' returned 125 instead of one of [0]

~~~
 

2. Customer opened all required ports as mentioned in Table 3.1 https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/installing_satellite_server_in_a_connected_network_environment/installing_server_connected_satellite#configuring-http-proxy-to-connect-to-cdn_satellite

3.  Fix for this issue is to add and allow *.akamaiedge.net:443 URL from the Firewall.

4. Requesting to add URL below in Table 3.1 

https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/installing_satellite_server_in_a_connected_network_environment/installing_server_connected_satellite#configuring-http-proxy-to-connect-to-cdn_satellite

~~~

• .akamaiedge.net:443 [https] *OR *.akamaitechnologies.com:443 [https]

~~~

akamaiedge.net is owned by Akamai, which Red Hat uses as its CDN backend.

If akamaiedge.net [ |http://akamaiedge.net/]is blocked, you will see: Repo sync failures, podman pull exit code 125