February 3, 2020 By Alex Parker 2 min read

IBM Cloud Container Registry will not accept UAA tokens for authentication starting August 12, 2020.

IBM Cloud Container Registry has supported IAM as its main form of authentication for several years now. In parallel, IBM Cloud Container Registry continued to support UAA and registry tokens as deprecated forms of authentication. On August 12, 2020, UAA tokens will no longer be accepted for authenticating to IBM Cloud Container Registry. Registry tokens will continue to work, but an end of support for registry tokens will come in the near future. All customers who are not already doing so should begin using IAM for authenticating to IBM Cloud Container Registry.

Next steps to use IAM for authentication

If you have any automation that uses registry or UAA tokens to authenticate to IBM Cloud Container Registry, you need to update this to use IAM instead. For example, any scripts that perform an explicit docker login and pass something other than the IAM usernames mentioned here must be updated to instead pass a form of IAM authentication. API keys are the recommended approach for automation. Note that ibmcloud cr login performs a docker login under the covers, but this is already updated to log in with IAM.

Kubernetes clusters can use image pull secrets to pull images from private registries. If any Kubernetes namespaces in your cluster rely on pull secrets that contain a registry or UAA token, these need to be replaced with pull secrets that contain an IAM API key. 

IBM Cloud Kubernetes Service clusters created before February 25, 2019, do not have IAM API keys in pull secrets and, therefore, need to be updated. This update is automated by the IBM Cloud Container Registry CLI plugin, and instructions can be found here. Clusters created after February 25, 2019, already contain updated pull secrets. However, if you copied pull secrets containing registry tokens to any Kubernetes namespaces other than default, you will need to ensure that those pull secrets contain an API key.


On August 12, 2020, UAA tokens will no longer be accepted to authenticate to IBM Cloud Container Registry. Registry tokens will continue to work but are deprecated, and an end of support will come in the near future. Ensure that you are not using UAA tokens for authentication and consider removing all uses of registry tokens and migrating fully to IAM. API keys are the recommended approach for automation and pull secrets.

There are lots of benefits to using IAM API keys instead of registry tokens. With IAM API keys, you can add IAM policies for more fine-grained control over access. For instance, you can create IAM access policies to restrict permissions to specific registry namespaces so that a cluster can only pull images from those namespaces.

More from Announcements

IBM named a Leader in Gartner Magic Quadrant for SIEM, for the 14th consecutive time

3 min read - Security operations is getting more complex and inefficient with too many tools, too much data and simply too much to do. According to a study done by IBM, SOC team members are only able to handle half of the alerts that they should be reviewing in a typical workday. This potentially leads to missing the important alerts that are critical to an organization's security. Thus, choosing the right SIEM solution can be transformative for security teams, helping them manage alerts…

IBM and MuleSoft expand global relationship to accelerate modernization on IBM Power 

2 min read - As companies undergo digital transformation, they rely on APIs as the backbone for providing new services and customer experiences. While APIs can simplify application development and deliver integrated solutions, IT shops must have a robust solution to effectively manage and govern them to ensure that response times and costs are kept low for all applications. Many customers use Salesforce’s MuleSoft, named a leader by Gartner® in full lifecycle API management for seven consecutive times, to manage and secure APIs across…

IBM Consulting augments expertise with AWS Competencies: A win-win for clients 

3 min read - In today's dynamic economic landscape, businesses demand continuous innovation and speed of execution. At IBM Consulting®, our unwavering focus on partnerships and shared commitment to delivering enterprise-level solutions to mutual clients have been core to our success.   We are thrilled to announce that IBM® has recently gained five competencies from Amazon Web Services (AWS) in vital domains including Cloud Operations, Internet of Things (IoT), Life Sciences, Mainframe Modernization, and Telecommunications. With these credentials, IBM further establishes its position as a…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters