$ helm get values <release-name> -n <namespace> > backup-values.yaml

Replace <release-name> with your Helm release name (for example, redhat-rhaap-portal) and <namespace> with your OpenShift namespace (for example, default).

The install-dynamic-plugins init container uses the authentication secret directly and does not use cluster pull secrets or imagePullSecrets. Follow these steps:

1. Create the base64-encoded credentials. Use the -w0 flag to produce single-line output (required):

   $ AUTHB64=$(printf '%s' '<username>:<password>' | base64 -w0)

   Use your Red Hat service account username and password for registry.redhat.io, or your mirror registry credentials for air-gapped deployments.

2. Create the auth.json file:

   $ cat > auth.json <<EOF
   {
     "auths": {
       "registry.redhat.io": {
         "auth": "${AUTHB64}"
       }
     }
   }
   EOF

   For mirror registries, replace registry.redhat.io with your mirror registry host (for example, yb-artifactory or mirror.example.com:5000).

3. Create the Kubernetes secret. The secret name must include your Helm release name:

   $ oc create secret generic <release-name>-dynamic-plugins-registry-auth \
     --from-file=auth.json=./auth.json -n <namespace>

   For example, if your release is redhat-rhaap-portal, the secret name is redhat-rhaap-portal-dynamic-plugins-registry-auth.

4. Verify the secret was created correctly:

   $ oc get secret <release-name>-dynamic-plugins-registry-auth \
     -o jsonpath='{.data.auth\.json}' -n <namespace> | base64 -d

   The output should display valid JSON with your credentials intact.

Keep all existing custom configuration (OAuth, RBAC, certificate settings, etc.). Add or modify only the plug-in delivery settings:

redhat-developer-hub:
  global:
    pluginMode: oci
    imageTagInfo: "<plugin-version>"

Replace <plugin-version> with the version from your current Helm release (for example, 2.2). To find the current version, run:

$ helm get values <release-name> -n <namespace> | grep imageTagInfo

$ helm upgrade <release-name> openshift-helm-charts/redhat-rhaap-portal \
  -n <namespace> -f backup-values.yaml

If you also need to specify a chart version, add --version <chart-version>.

After the Helm upgrade completes, the pod will restart. Check the install-dynamic-plugins init container logs to confirm successful OCI pulls:

$ oc logs <pod-name> -c install-dynamic-plugins -n <namespace>

Successful output includes messages like:

======= Installing dynamic plugin oci://registry.redhat.io/ansible-automation-platform/automation-portal:<plugin-version>!ansible-backstage-plugin-catalog-backend-module-rhaap
...
-> Successfully installed dynamic plugin oci://registry.redhat.io/ansible-automation-platform/automation-portal:<plugin-version>!ansible-backstage-plugin-catalog-backend-module-rhaap

The version in the log must match your imageTagInfo value. If you see authentication errors or "No such image" messages, see Troubleshoot the migration.

$ oc delete deployment,service,buildconfig,imagestream plugin-registry -n <namespace>

This cleans up the in-cluster HTTP service that hosted the tarball files. Deletion is safe once OCI pulls are confirmed in the pod logs.