// Module included in the following assemblies:
//
// * virt/fusion_access_SAN/install-configure-fusion-access-san.adoc

:_mod-docs-content-type: PROCEDURE
[id="creating-pull-secret-fusion-san_{context}"]
= Creating a Kubernetes pull secret

[role="_abstract"]
After installing the {FusionSAN} Operator, you must create a Kubernetes secret object to hold the IBM entitlement key for pulling the required container images from the IBM container registry.

.Prerequisites

* You installed the `oc` CLI.
* You have access to the cluster as a user with the `cluster-admin` role.
* You installed the {FusionSAN} Operator and created the `ibm-fusion-access` namespace in the process.

.Procedure

. Log in to the https://myibm.ibm.com/products-services/containerlibrary[*IBM Container software library*] with your {FusionSAN} *IBMid* and *password*.

. In the *IBM Container software library*, get the entitlement key:

.. If you do not have an entitlement key yet, click *Get entitlement key* or *Add new key*, and then click *Copy*.

.. If you already have an entitlement key, click *Copy*.

. Save the entitlement key in a safe place.

. Create the secret object by running the `oc create` command, replacing `<ibm-entitlement-key>` with the entitlement key that you copied in step 2.
+
[source,terminal]
----
$ oc create secret -n ibm-fusion-access generic fusion-pullsecret \
--from-literal=ibm-entitlement-key=<ibm-entitlement-key>
----

.Verification

. In the {product-title} web console, navigate to *Workloads* -> *Secrets*.

. Find the `fusion-pullsecret` in the list.
