How to replace the pull secret in OpenShift hosted control planes (HCP)

Environment

• Red Hat OpenShift Container Platform (RHOCP)
  • 4
• Hosted control planes (HCP)

Issue

• How to replace the pull secret in OpenShift hosted control plane (HCP) clusters.
• Need to change the pull secret of a hosted control plane (HCP) cluster.

Resolution

The solution how to change the global pull secret in OpenShift 4 provides generic information for updating/changing the pull secret in OpenShift 4 clusters.

For HCP clusters, refer to the above solution to change the pull secret for the hosting cluster (the management cluster), and if the pull secret needs to be changed in a hosted cluster, continue reading this solution.

Testing a pull secret before changing it in the cluster

Before updating the pull secret in the cluster, please test if the new pull secret is valid and working:

$ podman pull --authfile /path/to/downloaded/pull-secret registry.redhat.io/ubi8/ubi:latest

Replacing the pull secret for a hosted HCP cluster

clusters is the namespace from the hosting cluster that contains the HostedCluster used in this example. Change it accordingly with the namespace where the HostedCluster custom resource for which the pull request is going to be changed is deployed.

• Create a new secret using updated pull secret data like below:

  $ oc -n clusters create secret generic <new-pull-secret> --from-file=.dockerconfigjson=./pull-secret.txt --type=kubernetes.io/dockerconfigjson -n clusters
  

  where <new-pull-secret> is the name of the new pull secret

• Update the .spec.pullSecret.name field of the HostedCluster custom resource with newly created secret:

  $ oc edit hostedclusters.hypershift.openshift.io <HostedCluster_name> -n clusters
  

  where <HostedCluster_name> is the name of the hosted cluster.

• Verify the secret is correctly added to HostedCluster custom resource:

  $ oc get hostedclusters.hypershift.openshift.io <HostedCluster_name> -o json -n clusters | jq .spec.pullSecret.name
    "<new-pull-secret>"  
  

• Verify the respective NodePool is started updating with new pull secret change:

      $ oc get nodepools.hypershift.openshift.io -n clusters
  
      NAME                               CLUSTER              DESIRED NODES  CURRENT NODES  AUTOSCALING  AUTOREPAIR  VERSION  UPDATINGVERSION  UPDATINGCONFIG  MESSAGE
      <hosted_cluster>-ap-south-1a       <hosted_cluster>     2              2              False        False       4.18.12  False            True       
  

IMPORTANT: It is required to create a new secret and change the name in the HostedCluster custom resource. If the current secret is edited in-place instead, changes won't be properly propagated.

Root Cause

To update the pull secret of a hosted HCP cluster, it is required to add the new secret and change the secret name in the HostedCluster object, because hypershift-operator only monitors changes in the secret names of the HostedCluster objects but doesn't watch for changes on the secrets themselves used to store cluster pull secrets.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.