[openshift_setup] Apply CatalogSource from content-set catalog manifest

Apply cifmw_catalog_manifest so architecture-update jobs can install
the OCP-aware index selected from the RHOSO content set.

Related-Issue: #OSPCIX-1431
Closes: ANVIL-159
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Roberto Alfieri <ralfieri@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rebtoor

roles/openshift_setup/tasks/configure_registries.yml

@@ -53,6 +53,84 @@
       spec:
         imageDigestMirrors: "{{ cifmw_openshift_setup_digest_mirrors }}"
 
+- name: Add catalog registry credentials to cluster pull-secret
+  when:
+    - cifmw_openshift_setup_catalog_registry_credentials is defined
+    - cifmw_openshift_setup_catalog_registry_credentials | length > 0
+  no_log: true
+  block:
+    - name: Get current cluster pull-secret
+      kubernetes.core.k8s_info:
+        kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+        api_key: "{{ cifmw_openshift_token | default(omit) }}"
+        context: "{{ cifmw_openshift_context | default(omit) }}"
+        kind: Secret
+        name: pull-secret
+        namespace: openshift-config
+      register: _cluster_pull_secret
+
+    - name: Merge catalog registry auth into cluster pull-secret
+      vars:
+        _current_auths: >-
+          {{
+            (_cluster_pull_secret.resources[0].data['.dockerconfigjson']
+             | b64decode | from_json).auths
+          }}
+        _catalog_auth:
+          "{{ cifmw_openshift_setup_catalog_registry_credentials.registry }}":
+            auth: >-
+              {{
+                (cifmw_openshift_setup_catalog_registry_credentials.username ~ ':'
+                 ~ cifmw_openshift_setup_catalog_registry_credentials.password)
+                | b64encode
+              }}
+        _merged:
+          auths: "{{ _current_auths | combine(_catalog_auth) }}"
+      kubernetes.core.k8s:
+        kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+        api_key: "{{ cifmw_openshift_token | default(omit) }}"
+        context: "{{ cifmw_openshift_context | default(omit) }}"
+        state: present
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: pull-secret
+            namespace: openshift-config
+          type: kubernetes.io/dockerconfigjson
+          data:
+            .dockerconfigjson: "{{ _merged | to_json | b64encode }}"
+
+- name: Wait for MachineConfigPools to settle after registry changes
+  when:
+    - cifmw_openshift_setup_digest_mirrors is defined
+    - cifmw_openshift_setup_digest_mirrors | length > 0
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  ansible.builtin.shell:
+    cmd: |
+      set -eo pipefail
+      MCP_JSON=$(oc get mcp -o json)
+      UPDATING=$(echo "$MCP_JSON" | jq -r '
+        .items[] |
+        select(
+          .status.conditions // [] |
+          map(select(.type == "Updating" and .status == "True")) |
+          length > 0
+        ) | .metadata.name')
+      if [ -z "$UPDATING" ]; then
+        echo "All MCPs settled."
+        exit 0
+      fi
+      echo "MCPs still updating: $UPDATING"
+      exit 1
+  register: _mcp_settle
+  until: _mcp_settle.rc == 0
+  retries: 60
+  delay: 30
+  changed_when: false
+
 #  If both ImageDigestMirrorSet and ImageTagMirrorSet are applied to the registries,
 # ITMS acts as a fallback for tag-based pulls, while IDMS provides the primary
 # secure source for digests