Fix MCD image pull failure with mirrored releases

utils.sh

@@ -129,6 +129,68 @@ function create_cluster() {
     fi
     generate_metal3_config
 
+    # When mirroring images for non-GA releases (nightly/CI), the RHCOS default
+    # policy.json requires sigstoreSigned verification for quay.io/openshift-release-dev
+    # images. Nightly/CI images are not signed, and the policy check uses the original
+    # image name even when pulling from a mirror.
+    #
+    # Fix: Replace /etc/containers/policy.json with a permissive version via
+    # MachineConfig, and force machine-config-daemon-pull.service to use
+    # --signature-policy so even the initial MCD pull succeeds.
+    if [[ ! -z "${MIRROR_IMAGES}" && "${MIRROR_IMAGES,,}" != "false" && "${OPENSHIFT_RELEASE_TYPE}" != "ga" ]]; then
+      echo "Adding MCD pull policy fix for mirrored non-GA release"
+      local policy_b64
+      policy_b64=$(base64 -w0 <<'POLICY'
+{
+  "default": [
+    {
+      "type": "insecureAcceptAnything"
+    }
+  ],
+  "transports": {
+    "docker-daemon": {
+      "": [
+        {
+          "type": "insecureAcceptAnything"
+        }
+      ]
+    }
+  }
+}
+POLICY
+)
+      for role in master worker; do
+        cat > "${assets_dir}/openshift/99_${role}-mcd-pull-policy-fix.yaml" <<MCEOF
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+metadata:
+  labels:
+    machineconfiguration.openshift.io/role: ${role}
+  name: 99-${role}-mcd-pull-policy-fix
+spec:
+  config:
+    ignition:
+      version: 3.2.0
+    storage:
+      files:
+        - path: /etc/containers/policy.json
+          mode: 0644
+          overwrite: true
+          contents:
+            source: data:text/plain;charset=utf-8;base64,${policy_b64}
+    systemd:
+      units:
+        - name: machine-config-daemon-pull.service
+          dropins:
+            - name: 10-force-permissive-policy.conf
+              contents: |
+                [Service]
+                ExecStartPre=
+                ExecStartPre=/bin/sh -c 'echo "--signature-policy /etc/machine-config-daemon/policy-for-old-podman.json" > /tmp/podman_policy_args'
+MCEOF
+      done
+    fi
+
     find assets/generated -name '*.yaml' -exec cp -f {} ${assets_dir}/openshift \;
 
     if [[ "${IP_STACK}" == "v4v6" && "$(openshift_version $OCP_DIR)" =~ 4.[67] ]]; then