Red Hat OpenShift Container Platform

Update the global cluster pull secret

To add new registries or update authentication for your Red Hat OpenShift Container Platform cluster, you can update the global pull secret by appending new credentials to the additional-pull-secret. To do this, you can use the oc set data secret/additional-pull-secret -n kube-system command. Hypershift manages the new credential propagation among the HostedCluster nodes.

Use this procedure when you need a separate registry to store images than the registry used during installation.

Prerequisites

You have access to the cluster as a user with the cluster-admin role.

Procedure

Optional: To append a new pull secret to the existing pull secret:
1. Download the pull secret by entering the following command:
  $ oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > <pull_secret_location>
  where:
  
  <pull_secret_location>
  
  Specifies the path to the pull secret file.
2. Add the new pull secret by entering the following command:
  $ oc registry login --registry="<registry>" \ --auth-basic="<username>:<password>" \ --to=<pull_secret_location>
  where:
  
  <registry>
  
  Specifies the new registry. You can include many repositories within the same registry, for example: --registry="<registry/my-namespace/my-repository>.
  
  <username>:<password>
  
  Specifies the credentials of the new registry.
  
  <pull_secret_location>
  
  Specifies the path to the pull secret file.
Update the global pull secret for your cluster by entering the following command. Note that this update rolls out to all nodes, which can take some time depending on the size of your cluster.
```
$ oc set data secret/pull-secret -n openshift-config \
  --from-file=.dockerconfigjson=<pull_secret_location>
```
where:

<pull_secret_location>

Specifies the path to the new pull secret file.

This merges your additional pull secret with the original HostedCluster pull secret, making it available to all nodes in the cluster.
Optional: Modify the additional pull secret added by entering the following command:
```
$ oc edit secret additional-pull-secret -n kube-system
```
The secret must contain a valid DockerConfigJSON format.
Example pull secret
```
apiVersion: v1
kind: Secret
metadata:
  name: additional-pull-secret
  namespace: kube-system
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: <base64-encoded-docker-config-json>
```
This results in the following states of the each pull secret:
- Original: immutable
- Additional: mutable
- Global: final state of both the original and additional pull secrets
Optional: Delete the additional pull secret added by entering the following command:
```
$ oc delete secret additional-pull-secret -n kube-system
```
This triggers the automatic cleanup process across your nodes.