Managing entitlements

How do entitlement keys work?

Entitlement keys are owned by individuals. You can think of them as something like a combined user ID plus password that tells the entitled registry who you are. Every time a key is used to pull software, the registry checks the current level of entitlement for that individual to determine whether they have access or not.

Instead of having to download and install software, entitlement keys enable you to pull your software into a container environment of your choosing. IBM product containers are accessed by way of the IBM Container Registry (cp.icr.io).

When you install your software, you are directed to use your entitlement key. You can access your entitlement key by creating it through My IBM, then connect to the registry and pull containers. In the My IBM Container Software Library, you can add, view, copy, and delete your entitlement keys. You can also view your software entitlements including containers in the My IBM Container Software Library.

Entitlement Keys are used in a command line or in automated CI/CD processes to connect to the registry by using keys and pulling containers into your clusters.

How is entitlement managed?

Entitlement is managed through Passport Advantage. Specifically, access is based on your association in Passport Advantage with the entitlement key having a download role. Your Passport Advantage site administrator manages access to your site, and can also pull containers.

The following examples illustrate common pitfalls when pulling:

• If you attempt to pull a container, but it does not currently have entitlement, you see an error message denying access. Click the provided resolution link in the message. This can happen when your license has lapsed or you have not been granted a role in Passport Advantage.
  
• If you log in to My IBM and do not currently have entitlement, the My IBM page provides instructions to follow the Passport Advantage process to gain access.
  

Accessing entitlements

PPA

The most common way of accessing your products is through the Passport Advantage client portal. You can now manage entitlements through your portal too. The keys that you find in Passport Advantage are the same keys that are available in My IBM.

IBM Cloud

Alternatively, you can now use the IBM Cloud console to install WebSphere Automation and other container software products into your managed clusters. This approach uses the same Passport Advantage entitlements, but it does not require the use of the My IBM entitlement keys.

Instead, you can use the Account menu from the IBM Cloud console to make your Passport Advantage licenses available to IBM Cloud.

FAQs

I know that my company has purchased IBM software, but it's not listed in the My IBM Container Software Library view. When I try to pull the containers, I get a You are not authorized or Insufficient scope error message. Why would this happen?

The entitlement keys are based on an individual having access to the Passport Advantage "site" that the software was sold into. If you cannot see the entitlements in My IBM, or get an error trying to pull them from the IBM Entitled Registry, your IBMid likely has not been granted access to the site.

Managing access to sites is the responsibility of the customer site administrator. You might be able to solve this yourself by logging in to the Passport Advantage online customer portal.

If you are prompted for "self-nomination" this means that you don't have access to any sites. If you can log in but don't see the relevant site to select, then you need to request access and that request will need to be approved by your site administrator.

I need help with fixing my container software entitlements.

Container software entitlement is managed the same way as traditional software entitlement, through the Passport Advantage program. For more information about Passport Advantage entitlement, see Passport Advantage Online for Customers.

And if you need any help with the Passport Advantage site management process, reach out to the eCustomer Care team.

We have a policy to "rotate" our keys every 90 days to ensure that we aren't using old credentials. How do we do this?

To rotate your keys, generate a new key in the My IBM Container Software Library by clicking Add new key. Now you can update your installation to use the new key. Often the entitlement key is stored in a single place (for example, an environment file or Red Hat OpenShift pull secret) and needs to be updated there only once. After you've confirmed the new key is working, delete the old one in My IBM. The Issue Date field tells you which of your entitlement keys are older.