Description of problem: Even though customer seems to be able to successfully login to registry: [root@q23ru26 ~]# podman login -u $TOKEN -p $SECRET https://registry.redhat.io --log-level=debug DEBU[0000] Credentials not found DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/registry.redhat.io DEBU[0000] GET https://registry.redhat.io/v2/ DEBU[0000] Ping https://registry.redhat.io/v2/ status 401 DEBU[0000] GET https://registry.redhat.io/auth/realms/rhcc/protocol/redhat-docker-v2/auth?account=2924717%7Csiv&service=docker-registry DEBU[0001] GET https://registry.redhat.io/v2/ Login Succeeded! [root@q23ru26 ~]# podman login -u $UNAME -p $PASS registry.redhat.io --log-level=debug DEBU[0000] Returning credentials from /run/user/0/containers/auth.json DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/registry.redhat.io DEBU[0000] GET https://registry.redhat.io/v2/ DEBU[0000] Ping https://registry.redhat.io/v2/ status 401 DEBU[0000] GET https://registry.redhat.io/auth/realms/rhcc/protocol/redhat-docker-v2/auth?account=rolando.c.sacramento%40intel.com&service=docker-registry DEBU[0001] GET https://registry.redhat.io/v2/ Login Succeeded! He's getting the following while running an Openstack deployment: Exception: Unable to authenticate. This may indicate missing registry credentials or the provided container or namespace does not exist. 401 Client Error: Unauthorized for url: https://registry.redhat.io/auth/realms/rhcc/protocol/redhat-docker-v2/auth?service=docker-registry&scope=repository%3Arhosp-rhel8%2Fopenstack-cinder-api%3Apull Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/tripleo_common/image/image_uploader.py", line 2320, in discover_tag_from_inspect image_url, username=username, password=password) How reproducible: Every time for this specific customer.
You need to provide ContainerImageRegistryCredentials in order to interact with registry.redhat.io. This is failing in the discovery process which does not use podman and needs to have this parameter specified in order to function correctly.
FTR, https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.0/html/director_installation_and_usage/preparing-for-director-installation#container-image-preparation-parameters has all the various items documented. There's additional parameters needed if you don't use push_destination: true