OCI — Multi-Registry and Air-Gapped Support (issue 10 of 29)

Labels: ready-to-code
Depends on: Issue 1 (#4039 shared infra), Issue 9 (#TBD core connector)
RHIDP Stories: RHIDP-15297
Feature: RHDHPLAN-1507 — Epic RHIDP-15294

Add multi-registry configuration support (distinct credentials, CA bundles, and sync schedules per registry instance), K8s pull secret loader with Docker config.json parsing, custom CA bundle integration via shared @red-hat-developer-hub/backstage-plugin-boost-connector-utils, and air-gapped registry support with no external DNS resolution.

Tasks

From openspec/changes/oci-skill-registry/tasks.md group 4 (RHIDP-15297):

• 4.1 Define app-config schema for ai-catalog-oci-skill-registry with registry instances
• 4.2 Implement config parser with validation
• 4.3 Implement Secret loader for registry credentials
• 4.4 Implement ConfigMap/Secret loader for custom CA bundles
• 4.5 Implement per-registry sync interval scheduling
• 4.6–4.7 Unit tests and integration test for multi-registry

From openspec/changes/oci-skill-connector/tasks.md group 4 (RHIDP-15327):

• 4.1–4.15 Auth and air-gapped: K8s pull secret loader, Docker config.json parsing, Basic Auth, missing pull secret handling, custom CA bundle, shared CA utility integration, system CA fallback, per-registry auth, credential reuse, air-gapped registry support, DNS resolution failure handling, unit and integration tests

Specifications

• openspec/changes/oci-skill-registry/specs/multi-registry-config/spec.md

Start with openspec/changes/oci-skill-registry/tasks.md group 4 and specs/multi-registry-config/spec.md, then review the dependency issues for shared infrastructure and the core connector. Trace the shared @red-hat-developer-hub/backstage-plugin-boost-connector-utils CA integration and the connector tasks for Kubernetes pull secrets, Docker config.json parsing, authentication, and air-gapped behavior. Done means multi-registry configuration, credential and CA loading, per-registry scheduling, and the listed unit and integration tests are covered.