Pull secret management

You can manage your cluster pull secrets by downloading them from the console or updating them globally.

Download the pull secret from OpenShift Cluster Manager
Copy link

An image pull secret provides authentication for the cluster to access services and registries which serve the container images for OpenShift components. Every individual user gets a single pull secret generated.

Before you begin
Copy link

  • A Red Hat login

About this task
Copy link

The pull secret is used when installing an OpenShift Container Platform cluster. It is also used by OpenShift Cluster Manager to identify a specific Red Hat user when transferring cluster ownership. To transfer a cluster to another owner, you need to download the pull secret for the user that will take ownership of the cluster.

Procedure
Copy link

  1. Log in to OpenShift Cluster Manager as the Red Hat user you want to download the pull secret for.
    Important

    Each pull secret is unique to a specific user. If you are downloading the pull secret to transfer a cluster to another owner, log in to OpenShift Cluster Manager as the user who will take ownership of the cluster. Obtain that user’s pull secret.
  2. Go to Downloads in OpenShift Cluster Manager and find your pull secret in the Tokens category.
  3. Click Copy to copy your pull secret to the clipboard, or click Download to download your pull secret.
    Important

    Do not share your pull secret. The pull secret should be treated like a password.

    You can now use this pull secret to create an OpenShift Container Platform cluster or for transferring cluster ownership.

Update the global pull secret
Copy link

An image pull secret provides authentication for the cluster to access services and registries which serve the container images for OpenShift components. Every individual user gets a single pull secret generated.

Before you begin
Copy link

  • You must be the Cluster Owner or an Organization Administrator.
  • You must have a new or modified pull secret file to upload. You can download your pull secret from the Downloads page under Tokens.
  • You must have access to the cluster as a user with the cluster-admin role. See Authentication and authorization in the OpenShift Container Platform documentation for more information about cluster roles.
  • If you are transferring the cluster to a new owner, you must initiate the transfer in OpenShift Cluster Manager before changing the global pull secret, so that you keep receiving Telemetry metrics for the cluster.

About this task
Copy link

The pull secret is used when installing an OpenShift Container Platform cluster and when transferring cluster ownership.

To transfer a connected cluster to a new owner, you must update the pull secret to the new owner’s pull secret. Do this after initiating the cluster transfer in OpenShift Cluster Manager. The pull secret must be updated within five days of initiating the transfer, or you must restart the transfer process. See Cluster ownership transfer.

Important

On clusters using OpenShift Container Platform versions earlier than 4.7.4, cluster resources must adjust to the new pull secret. This can temporarily limit the usability of the cluster. This occurs because updating the pull secret causes the Machine Config Operator to drain the nodes, apply the change, and uncordon the nodes.

This does not affect clusters using OpenShift Container Platform versions 4.7.4 and later, where a pull secret change does not cause a node drain or reboot.

Procedure
Copy link

  1. Run the following command using the pull secret you downloaded from OpenShift Cluster Manager to change the cluster’s pull secret: 
    # oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=pull-secret.txt

    If a secret is not already created, run the following command to create the secret:

    # oc create secret generic pull-secret -n openshift-config --type=kubernetes.io/dockerconfigjson --from-file=.dockerconfigjson=/path/to/downloaded/pull-secret
  2. Wait for the update process to complete on all nodes in the cluster. The time required depends on the size of your cluster.
  3. Verify the pull secret change by going to Downloads in OpenShift Cluster Manager and finding your pull secret in the Tokens category:
    1. Click Copy to copy your pull secret to the clipboard.
    2. Click Download to download your pull secret.