<p>I'm using openshift 3.11 and I have a very hard time figuring out how to setup permenant token for image pull and push.
After I do docker login it is ok, but eventually that token expires.
By the documentation it seems that services account :  default ,builder should have access.</p>

<p>As you can see each of them have some default dockercfg:
Labels:              
Annotations:         
Image pull secrets:  default-dockercfg-ttjml
Mountable secrets:   default-token-q4x4w
                     default-dockercfg-ttjml
Tokens:              default-token-729xq
                     default-token-q4x4w
Events:              </p>

<p>default-dockercfg-ttjml, Which has really weird username and password. Read the documentation many times and still I can't understand how to setup a permanent token. Can someone explain me in a plain manner what is the procedure?</p>

Danny
<p>AFAIK, <code>serviceAccount</code> token does not expire until create it again. Look [0] for details. If you want to create <code>docker</code> authentication <code>secret</code> against external docker registry, refer [1] for details.</p>

<p>[0]<a href="https://docs.openshift.com/container-platform/3.11/dev_guide/service_accounts.html#dev-managing-service-accounts" rel="nofollow noreferrer">Managing Service Accounts
</a></p>

<pre><code>The generated API token and registry credentials do not expire, but they can be revoked by deleting the secret. 
</code></pre>

<p>[1]<a href="https://docs.openshift.com/container-platform/3.11/dev_guide/managing_images.html#allowing-pods-to-reference-images-from-other-secured-registries" rel="nofollow noreferrer">Allowing Pods to Reference Images from Other Secured Registries
</a></p>

<pre><code>$ oc create secret generic &lt;pull_secret_name&gt; \
    --from-file=.dockerconfigjson=&lt;path/to/.docker/config.json&gt; \
    --type=kubernetes.io/dockerconfigjson
</code></pre>
