RHOSP Director has a "container image prepare" step which generates a
deployment configuration file containing the list of container images to
deploy on the OSP nodes based on the user provided config. It can
optionally populate a local registry and update the configuration file to
reference the locally mirrored images instead.

In the first case, where it just generates the image list, connectivity to
the registry is tested for each of the images unless it is from a
predefined list of secure registries. If TLS verification for this
connection fails then the registry is automatically added to the
DockerInsecureRegistries parameter in the generated config file. This
parameter will ultimately set insecure=true for the referenced registry in
/etc/containers/registry.conf on all hosts while deploying/updating RHOSP
and images will be pulled from the registry insecurely.

In the second case, while mirroring an image, the same connectivity check
is used. If TLS verification of this connection fails then TLS verification
is disabled for the image mirroring task.

With TLS verification disabled a MITM attack delivering tainted container
images would not be detected.