Troubleshooting FailedToRetrieveImagePullSecret warning events for App Connect pods on Red Hat OpenShift

Red Hat OpenShift might create FailedToRetrieveImagePullSecret warning events for your App Connect pods, even when those pods are running successfully. For example, you might see the following type of warning events:

Events:
  Type     Reason                           Age                    From     Message
  ----     ------                           ----                   ----     -------
  Warning  FailedToRetrieveImagePullSecret  89s (x15803 over 13d)  kubelet  Unable to retrieve some image pull secrets (ibm-entitlement-key); attempting to pull the image may not succeed.

A change in Red Hat OpenShift 4.15 or later produces warning events when a pull secret is missing, even if the image pull is successful and the pod is running correctly. In earlier versions, missing pull secrets were silently ignored. App Connect automatically adds pull secret references with known names to pods to make it simple to add pull secrets for use with App Connect. If you are not using these pull secrets, they now trigger the warning events.

• If you are using a global pull secret, the ibm-entitlement-key secret might not exist in the same namespace (project) as the pod, which triggers the warning.

  You might use a global pull secret for these reasons:

  • To provide authentication to a local registry mirror for a network-restricted (air-gapped) environment
  • To simplify pull secret management for an online cluster
• Other pull secrets, which are added to App Connect pods by default, might also trigger the warning.

You can address these warnings in either of the following ways:

• If the image is pulled successfully, you can ignore the warnings.
• You can also suppress the warnings by creating an empty secret for each missing pull secret.
  1. Get the list of missing pull secrets from the warning message.
  2. For each missing pull secret, create an empty secret by running the following command:

     oc create secret generic secretName -n namespaceName

     For example:

     oc create secret generic ibm-entitlement-key -n ace-test