Docker login to Pulp container registry redirects to internal `nodeport.local:30000` token endpoint, failing external DNS lookup

Description

Using Pulp Operator v1.1.0, docker login to the container registry via a manual Ingress fails. The request to the external domain (https://pulp.example.com) redirects to an internal token endpoint (http://nodeport.local:30000/token/), causing a DNS lookup error: "dial tcp: lookup nodeport.local: no such host". This blocks external pushes/pulls to the registry. The issue stems from content_origin in pulp status pointing to http://nodeport.local:30000, which is cluster-internal.

Environment

• Pulp Operator Version: v1.1.0
• Pulp Version: Core 3.90.0, Container 2.26.2 (full versions below from pulp status)
• Kubernetes Version: v1.33.4
• Cluster Setup: Talos Linux, Flannel CNI, single/multi-node: [Please fill if known]
• Ingress Controller: NGINX
• Namespace: pulp-operator-system
• Other: Container plugin enabled; repository created via pulp container repository create --name my-repo; distribution with base-path (e.g., my-registry)

Full pulp status output:

{
  "versions": [ ... (lists core 3.90.0, container 2.26.2, etc.) ... ],
  "online_workers": [ ... ],
  "online_api_apps": [ ... ],
  "online_content_apps": [ ... ],
  "database_connection": { "connected": true },
  "redis_connection": { "connected": true },
  "storage": { ... },
  "content_settings": {
    "content_origin": "http://nodeport.local:30000",
    "content_path_prefix": "/pulp/content/"
  },
  "domain_enabled": false
}

Reproduction Steps

1. Deploy Pulp Operator v1.1.0 via Helm in pulp-operator-system.

2. Apply Pulp CR with ingress_type: ingress (or default).

3. Create push repo/distribution via CLI: pulp container repository create --name my-repo --type push, then pulp container distribution create --name my-dist --base-path my-registry --repository <href>.

4. Apply manual Ingress:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: pulp-web-ingress
     namespace: pulp-operator-system
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt-prod
   spec:
     tls:
       - hosts:
           - pulp.example.com
         secretName: pulp-internal-tls
     rules:
       - host: pulp.example.com
         http:
           paths:
             - path: /
               pathType: Prefix
               backend:
                 service:
                   name: <pulp-web-svc>  # e.g., hcli-pulp-web-svc
                   port:
                     number: 8080
   

   (Domain resolves to Ingress IP via /etc/hosts.)

5. From external host: docker login -u admin -p <password> pulp.example.com.

Expected Behavior

Docker login succeeds externally, with auth redirects resolvable via the Ingress (e.g., to https://pulp.example.com/token/). Pushes/pulls to pulp.example.com/my-registry/<image> work.

Actual Behavior

• Redirects to http://nodeport.local:30000/token/?account=admin&client_id=docker&offline_token=true&service=pulp.example.com.
• Fails: "Get "[https://pulp.example.com/v2/](https://pulp.example.com/v2/%5C)": Get "[http://nodeport.local:30000/token/...](http://nodeport.local:30000/token/...%5C)": dial tcp: lookup nodeport.local: no such host".
• Internal cluster access (e.g., port-forward) works; external Docker fails.
• Pods healthy; pulp status via CLI succeeds.

How can I fix this to make the container registry externally accessible with a manual Ingress? What CR/Ingress config aligns content_origin and auth redirects with the external domain? Guidance on handling NodePort auth in external setups?

Thanks!

Start with the Pulp CR using ingress_type: ingress, the manual pulp-web-ingress manifest, and the content_settings section of pulp status. Trace how the configured content_origin and NodePort token endpoint produce the Docker redirect, then verify that external login and registry pushes and pulls use the Ingress domain without resolving nodeport.local.