June 12, 2019 By Alex Parker 2 min read

To facilitate migrations to IAM and our new icr.io domains, IBM Cloud Container Registry will no longer allow the creation of registry tokens.

Recently, we introduced our new IBM Cloud Container Registry icr.io domain names. With this change, it was announced that an IAM API key—rather than a registry token—needs to be stored in an image pull secret in order to pull images from the new registry domains. In accordance with this, and to facilitate migrations to the new domains, the creation of registry tokens will be discontinued on July 1, 2019.

Since the announcement of the icr.io domains, new clusters have been deployed with both pull secrets that access bluemix.net domains with a registry token and with pull secrets that access icr.io domains with an IAM API key. Moving forward, all new clusters will be deployed with IAM API key pull secrets only, and you will be unable to create new registry tokens with ibmcloud cr token-add. This means that new clusters will have to pull images from the icr.io domains. Registry tokens have been marked as deprecated in the documentation for a few months (see here, for example), and during that time, anyone with questions about registry tokens has been pointed to IAM.

How will my existing clusters and registry tokens be affected?

Existing registry tokens will continue to provide access to IBM Cloud Container Registry using the deprecated bluemix.net domain names, so you can continue using existing registry tokens to access these domains without interruption.

However, the old domains, as well as registry tokens, will eventually be discontinued as well. To prepare yourself for this event, follow these steps to set up your clusters to pull images from the icr.io domains if you have not done so already. This action will kill two birds with one stone as you will migrate away from the deprecated bluemix.net domains while simultaneously migrating from registry tokens to IAM API keys.

What benefits are there to using IAM API keys for registry access?

There are lots of benefits to using IAM API keys instead of registry tokens. With IAM API keys, you can add IAM policies for more fine-grained control over access. For instance, you can create IAM access policies to restrict permissions to specific registry namespaces so that a cluster can only pull images from those namespaces.

More from Announcements

IBM named a Leader in Gartner Magic Quadrant for SIEM, for the 14th consecutive time

3 min read - Security operations is getting more complex and inefficient with too many tools, too much data and simply too much to do. According to a study done by IBM, SOC team members are only able to handle half of the alerts that they should be reviewing in a typical workday. This potentially leads to missing the important alerts that are critical to an organization's security. Thus, choosing the right SIEM solution can be transformative for security teams, helping them manage alerts…

IBM and MuleSoft expand global relationship to accelerate modernization on IBM Power 

2 min read - As companies undergo digital transformation, they rely on APIs as the backbone for providing new services and customer experiences. While APIs can simplify application development and deliver integrated solutions, IT shops must have a robust solution to effectively manage and govern them to ensure that response times and costs are kept low for all applications. Many customers use Salesforce’s MuleSoft, named a leader by Gartner® in full lifecycle API management for seven consecutive times, to manage and secure APIs across…

IBM Consulting augments expertise with AWS Competencies: A win-win for clients 

3 min read - In today's dynamic economic landscape, businesses demand continuous innovation and speed of execution. At IBM Consulting®, our unwavering focus on partnerships and shared commitment to delivering enterprise-level solutions to mutual clients have been core to our success.   We are thrilled to announce that IBM® has recently gained five competencies from Amazon Web Services (AWS) in vital domains including Cloud Operations, Internet of Things (IoT), Life Sciences, Mainframe Modernization, and Telecommunications. With these credentials, IBM further establishes its position as a…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters