Issue

• creating the undercloud fails when it tries to pull the docker containers from registry.redhat.io the service account has been verified to be correct and can log in, but fails with a message that the EULA needs to be accepted:

# openstack undercloud install
...
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://registry.redhat.io/auth/realms/rhcc/protocol/redhat-docker-v2/auth?service=docker-registry&scope=repository%3Arhosp-rhel8%2Fopenstack-cron%3Apull
...
tripleo_common.image.exception.ImageUploaderException: Unable to authenticate. This may indicate missing registry credentials or the provided container or namespace does not exist. 401 Client Error: Unauthorized for url: https://registry.redhat.io/auth/realms/rhcc/protocol/redhat-docker-v2/auth?service=docker-registry&scope=repository%3Arhosp-rhel8%2Fopenstack-cron%3Apull
...

• cat containers-prepare-parameter.yaml does contain ContainerImageRegistryCredentials:

parameter_defaults:
  ContainerImagePrepare:
  - push_destination: true
    set:
      ceph_alertmanager_image: ose-prometheus-alertmanager
      ceph_alertmanager_namespace: registry.redhat.io/openshift4
      ceph_alertmanager_tag: 4.1
      ceph_grafana_image: rhceph-3-dashboard-rhel7
      ceph_grafana_namespace: registry.redhat.io/rhceph
      ceph_grafana_tag: 3
      ceph_image: rhceph-4-rhel8
      ceph_namespace: registry.redhat.io/rhceph
      ceph_node_exporter_image: ose-prometheus-node-exporter
      ceph_node_exporter_namespace: registry.redhat.io/openshift4
      ceph_node_exporter_tag: v4.1
      ceph_prometheus_image: ose-prometheus
      ceph_prometheus_namespace: registry.redhat.io/openshift4
      ceph_prometheus_tag: 4.1
      ceph_tag: latest
      name_prefix: openstack-
      name_suffix: ''
      namespace: registry.redhat.io/rhosp-rhel8
      neutron_driver: ovn
      rhel_containers: false
      tag: '16.0'
    tag_from_label: '{version}-{release}'
  ContainerImageRegistryLogin: true 
  ContainerImageRegistryCredentials:
    registry.redhat.io:
      "username": "password"

• Podman works:

$ podman login registry.access.redhat.com
Username: username
Password: 
Login Succeeded!

• But we can't pull images from registry.access.redhat.com:
  $ podman pull registry.access.redhat.com/rhosp-rhel8/openstack-cron
  Trying to pull registry.access.redhat.com/rhosp-rhel8/openstack-cron...
  unsupported: This repo requires terms acceptance and is only available on registry.redhat.io
  Error: error pulling image "registry.access.redhat.com/rhosp-rhel8/openstack-cron": unable to pull registry.access.redhat.com/rhosp-rhel8/openstack-cron: unable to pull image: Error initializing source docker://registry.access.redhat.com/rhosp-rhel8/openstack-cron:latest: Error reading manifest latest in registry.access.redhat.com/rhosp-rhel8/openstack-cron: unsupported: This repo requires terms acceptance and is only available on registry.redhat.io

- And it doesn't work from `registry.redhat.io` either:

podman pull registry.redhat.io/rhosp-rhel8/openstack-cron

Trying to pull registry.redhat.io/rhosp-rhel8/openstack-cron...
unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication
Error: error pulling image "registry.redhat.io/rhosp-rhel8/openstack-cron": unable to pull registry.redhat.io/rhosp-rhel8/openstack-cron: unable to pull image: Error initializing source docker://registry.redhat.io/rhosp-rhel8/openstack-cron:latest: unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication
~~~