[openshift_setup] Apply CatalogSource from content-set catalog manifest

Apply cifmw_catalog_manifest so architecture-update jobs can install
the OCP-aware index selected from the RHOSO content set.

Related-Issue: #OSPCIX-1431
Closes: ANVIL-159
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Roberto Alfieri <ralfieri@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rebtoor

roles/openshift_setup/tasks/configure_registries.yml

@@ -53,6 +53,65 @@
       spec:
         imageDigestMirrors: "{{ cifmw_openshift_setup_digest_mirrors }}"
 
+- name: Add catalog registry credentials to cluster pull-secret
+  when:
+    - cifmw_catalog_manifest is defined
+    - cifmw_catalog_manifest | length > 0
+    - cifmw_openshift_setup_catalog_registry_credentials is defined
+  no_log: true
+  block:
+    - name: Get current cluster pull-secret
+      kubernetes.core.k8s_info:
+        kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+        api_key: "{{ cifmw_openshift_token | default(omit) }}"
+        context: "{{ cifmw_openshift_context | default(omit) }}"
+        kind: Secret
+        name: pull-secret
+        namespace: openshift-config
+      register: _cluster_pull_secret
+
+    - name: Merge catalog registry auth into cluster pull-secret
+      vars:
+        _current_auths: >-
+          {{
+            (_cluster_pull_secret.resources[0].data['.dockerconfigjson']
+             | b64decode | from_json).auths
+          }}
+        _catalog_auth:
+          "{{ cifmw_openshift_setup_catalog_registry_credentials.registry }}":
+            auth: >-
+              {{
+                (cifmw_openshift_setup_catalog_registry_credentials.username ~ ':'
+                 ~ cifmw_openshift_setup_catalog_registry_credentials.password)
+                | b64encode
+              }}
+        _merged:
+          auths: "{{ _current_auths | combine(_catalog_auth) }}"
+      kubernetes.core.k8s:
+        kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+        api_key: "{{ cifmw_openshift_token | default(omit) }}"
+        context: "{{ cifmw_openshift_context | default(omit) }}"
+        state: present
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: pull-secret
+            namespace: openshift-config
+          type: kubernetes.io/dockerconfigjson
+          data:
+            .dockerconfigjson: "{{ _merged | to_json | b64encode }}"
+
+- name: Create CatalogSource for OpenStack operators
+  when:
+    - cifmw_catalog_manifest is defined
+    - cifmw_catalog_manifest | length > 0
+  kubernetes.core.k8s:
+    kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+    api_key: "{{ cifmw_openshift_token | default(omit)}}"
+    context: "{{ cifmw_openshift_context | default(omit)}}"
+    definition: "{{ cifmw_catalog_manifest }}"
+
 #  If both ImageDigestMirrorSet and ImageTagMirrorSet are applied to the registries,
 # ITMS acts as a fallback for tag-based pulls, while IDMS provides the primary
 # secure source for digests