根据https://docs.openshift.org/latest/dev_guide/managing_images.html，我通过命令生成了一个名为“test-secret”的秘密：
oc secrets new-dockercfg test-secret \
--docker-server=my.registry.com:5000 \ #if the port '5000' needed? But I get the same error with the two cases
--docker-username=origin \
--docker-password=XXX \
--docker-email=origin@XXX.com
然后通过以下方式将秘密添加到服务帐户：
oc secrets link default test-secret --for=pull
oc secrets link builder test-secret
注册表 'ca.crt' 的证书已放在 '/etc/docker/cert.d/registry.example.com:5000/ca.crt' 上，我可以通过docker pull registry.example.com:5000/XXX/XXXX:XXX.
但是运行时会出现错误：
oc import-image XXX:master --from=registry.example.com:5000/XXX/XXXX --confirm：
The import completed with errors.
Name: XXX
Namespace: XXXX
Created: 20 minutes ago
Labels: <none>
Annotations: openshift.io/image.dockerRepositoryCheck=2017-03-31T07:02:41Z
Docker Pull Spec: 172.30.81.113:5000/XXXX/XXX
Unique Images: 0
Tags: 1
master
tagged from registry.XXXX.com:5000/XXX/XXXX
! error: Import failed (InternalError): Internal error occurred: Get
https://registry.XXXX.com:5000/v2/XXXX/manifests/latest: denied: access forbidden
20 minutes ago
和注册表服务器日志：
time="2017-03-31T07:49:14.323833338Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.6.2 http.request.host="registry.example.com:5000" http.request.id=7476c6f4-b563-4132-8912-f0f19a5beb72 http.request.method=GET http.request.remoteaddr="192.168.1.23:52540" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1" instance.id=0b54b523-31bf-4b56-adcc-e20320f4cea9 service=registry version=v2.4.1
192.168.1.23 - - [31/Mar/2017:07:49:14 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "Go-http-client/1.1"
请帮忙 ！