From 31e047291c6b751b614c5ac8d7218a2d5ea3dec8 Mon Sep 17 00:00:00 2001
From: tusharjadhav3302 <tjadhav@redhat.com>
Date: Wed, 29 Jul 2026 11:00:30 +0530
Subject: [PATCH] Fix baremetal registry DNS and creds after #1922

PR #1922 introduced NODES_PLATFORM=baremetal support for agent-based
installs but left gaps in the early-exit path of 02_configure_host.sh:

1. LOCAL_REGISTRY_DNS_NAME (default virthost.<cluster>.<domain>) has
   no /etc/hosts entry. The libvirt path adds this at line ~480, but
   that code sits after the `exit 0` and never runs for baremetal
   deployments. Without it, podman login and release-image mirroring
   fail on name resolution.

2. When MIRROR_IMAGES=true the local registry is not started and no
   podman login creates the authfile, causing downstream scripts to
   fail reading REGISTRY_CREDS.

3. write_pull_secret() unconditionally merges REGISTRY_CREDS into
   the combined pull secret even when no local registry is
   configured, injecting a blank or stale authfile.

Add the same sed+tee /etc/hosts pattern from the libvirt path,
set up the local registry and authfile when mirroring is enabled,
and gate the REGISTRY_CREDS merge in write_pull_secret() behind
use_registry checks.

Signed-off-by: tusharjadhav3302 <tjadhav@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 02_configure_host.sh | 23 +++++++++++++++++++++++
 utils.sh             | 18 +++++++++++++-----
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/02_configure_host.sh b/02_configure_host.sh
index 1b1ff9264..a23dc9997 100755
--- a/02_configure_host.sh
+++ b/02_configure_host.sh
@@ -97,6 +97,29 @@ if [[ "${NODES_PLATFORM}" == "baremetal" ]]; then
 
     switch_to_internal_dns
 
+    # Add a /etc/hosts entry for $LOCAL_REGISTRY_DNS_NAME
+    sudo sed -i "/${LOCAL_REGISTRY_DNS_NAME}/d" /etc/hosts
+    echo "${PROVISIONING_HOST_EXTERNAL_IP} ${LOCAL_REGISTRY_DNS_NAME}" | sudo tee -a /etc/hosts
+
+    # When MIRROR_IMAGES is configured, the local registry must be running
+    # before 04_setup_ironic.sh attempts to mirror release images into it.
+    # This covers virtual-baremetal (sushy-emulator) CI environments that
+    # set NODES_PLATFORM=baremetal together with MIRROR_IMAGES=true.
+    if use_registry "podman"; then
+        setup_local_registry
+        rm -f "${REGISTRY_CREDS}"
+        sudo podman login --authfile "${REGISTRY_CREDS}" \
+            -u "${REGISTRY_USER}" -p "${REGISTRY_PASS}" \
+            "${LOCAL_REGISTRY_DNS_NAME}":"${LOCAL_REGISTRY_PORT}"
+    elif use_registry ""; then
+        setup_local_registry
+    else
+        echo '{}' | sudo dd of="${REGISTRY_CREDS}"
+    fi
+    if [ -f "${REGISTRY_CREDS}" ]; then
+        sudo chown "$USER":"$USER" "${REGISTRY_CREDS}"
+    fi
+
     exit 0
 fi
 
diff --git a/utils.sh b/utils.sh
index 6044a13ce..aa7fb803d 100755
--- a/utils.sh
+++ b/utils.sh
@@ -1009,8 +1009,12 @@ function write_pull_secret() {
     if [ "${OPENSHIFT_CI}" == true ]; then
         # We don't need to fetch a personal pull secret with the
         # token, but we still need to merge what we're given with the
-        # credentials for the local reigstry.
-        jq -s '.[0] * .[1]' "${REGISTRY_CREDS}" "${PERSONAL_PULL_SECRET}" > "${PULL_SECRET_FILE}"
+        # credentials for the local registry when mirroring is enabled.
+        if use_registry ""; then
+            jq -s '.[0] * .[1]' "${REGISTRY_CREDS}" "${PERSONAL_PULL_SECRET}" > "${PULL_SECRET_FILE}"
+        else
+            cp "${PERSONAL_PULL_SECRET}" "${PULL_SECRET_FILE}"
+        fi
         return
     fi
 
@@ -1025,9 +1029,13 @@ function write_pull_secret() {
     _tmpfiles="$_tmpfiles $tmppullsecret"
     oc registry login --kubeconfig="$tmpkubeconfig" --to="$tmppullsecret"
 
-    # Combine the personal pull secret with the ones for the CI
-    # registry and the local registry credentials.
-    jq -s '.[0] * .[1] * .[2]' "${PERSONAL_PULL_SECRET}" "${REGISTRY_CREDS}" "${tmppullsecret}" > "${PULL_SECRET_FILE}"
+    # Combine the personal pull secret with the CI registry credentials,
+    # and with the local registry credentials only when mirroring is enabled.
+    if use_registry ""; then
+        jq -s '.[0] * .[1] * .[2]' "${PERSONAL_PULL_SECRET}" "${REGISTRY_CREDS}" "${tmppullsecret}" > "${PULL_SECRET_FILE}"
+    else
+        jq -s '.[0] * .[1]' "${PERSONAL_PULL_SECRET}" "${tmppullsecret}" > "${PULL_SECRET_FILE}"
+    fi
 }
 
 function switch_to_internal_dns() {