Got some feedback from @zvonkok on github (from rhel coreos team) that users trying to set up RH subscription / entitlements for OpenShift Builds were getting confused on why they would want to create imagestreams for the UBI image vs. referencing registry.redhat.io directly. The doc at https://docs.openshift.com/container-platform/4.3/builds/running-entitled-builds.html#builds-create-imagestreamtag_running-entitled-builds mentions that an imagestream in the openshift namespace makes it available for all users. We should also clarify that if the imagestream is created in the openshift namespace, you do NOT have to create a pull secret for registry.redhat.io, like you do when the imagestream is created in the user's namespace. As part of setting up samples, the samples operator creates a pull secret in the openshift namespace which allows for getting content from registry.redhat.io So one less thing for them to do when creating build's in their specific namespaces. If their builds reference the openshift ubi imagestream as their builder/input image, they are good to go.
Started a discussion thread with Rolfe, Adam, and myself at https://coreos.slack.com/archives/C014MHHKUSF/p1608235577304200 Among other things, since this defect was opened, 4.5 has shipped, which means you can benefit from the changes that allow you to get the registry.redhat.io creds in the install pull secret from any namespace on the cluster. So minimally this defect should pivot to mention that, and remove the existing doc's statements about having to create a pull secret for registry.redhat.io.
Add /lgtm on pr, change this bug to verified.