5.4.3. Updating the global cluster pull secret

Procedure

1. Optional: To append a new pull secret to the existing pull secret:

   1. Download the pull secret by entering the following command:

      $ oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > <pull_secret_location>

      where:

      <pull_secret_location>

      Specifies the path to the pull secret file.

   2. Add the new pull secret by entering the following command:

      $ oc registry login --registry="<registry>" \
      --auth-basic="<username>:<password>" \
      --to=<pull_secret_location>

      where:

      <registry>

      Specifies the new registry. You can include many repositories within the same registry, for example: --registry="<registry/my-namespace/my-repository>.

      <username>:<password>

      Specifies the credentials of the new registry.

      <pull_secret_location>

      Specifies the path to the pull secret file.

2. Update the global pull secret for your cluster by entering the following command. Note that this update rolls out to all nodes, which can take some time depending on the size of your cluster.

   $ oc set data secret/pull-secret -n openshift-config \
     --from-file=.dockerconfigjson=<pull_secret_location>

   where:

   <pull_secret_location>

   Specifies the path to the new pull secret file.

   This merges your additional pull secret with the original HostedCluster pull secret, making it available to all nodes in the cluster.

3. Optional: Modify the additional pull secret added by entering the following command:

   $ oc edit secret additional-pull-secret -n kube-system

   The secret must contain a valid DockerConfigJSON format.

   Example pull secret

   apiVersion: v1
   kind: Secret
   metadata:
     name: additional-pull-secret
     namespace: kube-system
   type: kubernetes.io/dockerconfigjson
   data:
     .dockerconfigjson: <base64-encoded-docker-config-json>

   This results in the following states of the each pull secret:

   • Original: immutable
   • Additional: mutable
   • Global: final state of both the original and additional pull secrets

4. Optional: Delete the additional pull secret added by entering the following command:

   $ oc delete secret additional-pull-secret -n kube-system

   This triggers the automatic cleanup process across your nodes.