Finding and applying your entitlement key by using the UI (online installation)

The IBM Entitled Registry contains software images for the instances. To allow the operators to automatically pull those software images, you must first obtain your entitlement key, then add your entitlement key in a pull secret.

This task is performed by using the UI (including the OpenShift console).

Obtaining your entitlement key

Go to the Container software library.
For any key that is listed, click Copy.
Copy the entitlement key to a safe place so you can use it when you add the pull secret in the next section.
(Optional) Verify the validity of the key by logging in to the IBM Entitled Registry by using a container tool.
```
docker login cp.icr.io --username cp --password entitlement_key
```

Applying the pull secret

Your entitlement key must be added to the OpenShift cluster as a pull secret to deploy instances. Adding a global pull secret enables deployment of instances in all namespaces. The alternative is to add a pull secret to each namespace in which you plan to deploy instances (any namespace with operators), plus the `openshift-operators` namespace. However, this option adds work to your installation process.

Important: If you installed the operators in all namespaces, do one of the following:

In the openshift-operators namespace, create an entitlement key secret.
In the openshift-config namespace, update a secret called pullsecret with the entitlement key.

Adding a global pull secret for all namespaces

Requirements:

You must be an OpenShift cluster administrator to complete this task. For more information, see OpenShift roles and permissions.
You can't use an OpenShift cluster that is on IBM Cloud.

This task adds a pull secret for the whole OpenShift cluster.

Log in to the OpenShift web console console. Make sure the Administrator perspective is selected.
In the navigation pane, click Workloads > Secrets.
Ensure that the Project is set to openshift-config.
In the Secrets pane, find and click pull-secret in the list of secrets.
Click the arrow to expand the Actions list, then click Edit Secret.
In the list of credentials, scroll to the end of the page and click Add credentials.
Enter these values in the following fields:
- Registry server address - cp.icr.io.
- Username - cp.
- Password - the entitlement key you got in the first section, "Obtaining your entitlement key".
Click Save.
In the navigation menu, click Compute > Nodes to confirm the progress of the update.
When all the nodes have the value Ready in the Status column, your global pull secret is applied.

Adding the pull secret to a namespace by using the OpenShift web console

You must be a namespace administrator to perform this task. For more information, see OpenShift roles and permissions.

Log in to the OpenShift web console and select the Administrator perspective (if not selected by default).
In the left navigation, click Workloads > Secrets.
Ensure that the Project is set to the namespace where you intend to install instances.
If you installed the operators in All namespaces on the cluster mode, you must use a project other than openshift-operators in which to deploy the instance.
- If needed, create a new project for this purpose. Under Home > Projects, click Create Project, enter the name for your new project, and click Create.
For more information about permitted namespaces, see Guidelines for installing operators.
Click Create and select Image pull secret.

Set the following parameters for the secret:

Parameter	Value
Secret name	`ibm-entitlement-key`
Authentication type	Image registry credentials
Registry server address	`cp.icr.io`
Username	`cp`
Password	Value of the entitlement key you copied when you got your entitlement key.
Email	(Optional value)

Click Create to create the secret.

What to do next

You can now deploy the IBM Cloud Pak Platform UI by using either the UI or CLI. For more information, see Deploying the Platform UI.