anchor.diff:  <1> Set the `*openshift.io/image.insecureRepository*` annotation to *true*
   ====
   
  +[IMPORTANT]
  +====
  +This option instructs integrated registry to fall-back to an insecure transport
  +for any external image tagged in the image stream when serving it, which is
  +dangerous. If possible, avoid this risk by
  +xref:insecure-tag-import-policy[marking just an istag as insecure].
  +====
  +
   ifdef::openshift-enterprise,openshift-origin[]
   [IMPORTANT]
   ====
   The above definition only affects importing tag and image metadata. For this
  -image to be used in the cluster (e.g., to be able to do a `docker pull`), each
  -node must have Docker configured with the `--insecure-registry` flag. See
  +image to be used in the cluster (e.g., to be able to do a `docker pull`) one of
  +the following must be true:
  +
  +1. Each node has Docker configured with the `--insecure-registry` flag matching
  +the registry part of the `dockerImageRepository`. See
   xref:../install_config/install/host_preparation.adoc#install-config-install-host-preparation[Host
   Preparation] for information.
  +2. Each istag specification must have `referencePolicy.type` set to `Local`. See
  +xref:reference-policy[below] for more information.
   ====
   endif::[]
   
  -Additionally, you can specify a single tag using an insecure repository. To do
  -so, set `*importPolicy.insecure*` in the tag's definition to *true*:
  +[[imagestream-tag-policies]]
  +==== ImageStream Tag policies
  +
  +[[insecure-tag-import-policy]]
  +===== Insecure Tag Import Policy
  +The above annotation applies to all images and tags of a particular
  +ImageStream. For a finer-grained control, policies may be set on
  +xref:../architecture/core_concepts/builds_and_image_streams.adoc#image-stream-tag[_istags_].
  +Set `*importPolicy.insecure*` in the tag's definition to *true* to allow a
  +fall-back to insecure transport just for images under this tag.
  +
  +[NOTE]
  +====
  +The fall-back to insecure transport for an image under particular _istag_ will
  +be enabled either when the image stream is annotated as insecure or the _istag_
  +has insecure import policy. The image stream annotation cannot be overriden by
  +the `*importPolicy.insecure*` set to *false*. 
  +====
  +
  +[[reference-policy]]
  +===== Reference Policy 
  +Allows to specify where the image consumers will pull from. It is applicable
  +just to remote images (those imported from external registries). There are two
  +options to choose from: `*Local*` and `*Source*`. 
  +
  +The `*Source*` policy intructs clients to pull directly from the source registry of the image. The integrated registry won't be involved unless the image is managed by the cluster (it's not an external image). This is the default policy.
  +
  +The `*Local*` policy instructs clients to pull always from the integrated
  +registry. This is useful if you want to pull from external insecure registries
  +without modifying docker daemon settings. The
  +xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  +feature] of the registry will take care of serving the remote image to the
  +client. Additionaly, all the blobs will be mirrored for latter faster access.
  +
  +The policy can be set in a specification of image stream tag as  `referencePolicy.type`.
  +
  +Here's an example of insecure tag with a local reference policy:
   
   ====
   [source,yaml]
  
positive.code:     name: mytag
      importPolicy:
        insecure: true <1>
  ----
  <1> Set tag *mytag* to use insecure connection to that registry.
  ====
  
  ifdef::openshift-origin,openshift-online,openshift-enterprise,openshift-dedicated[]
  
negative.code: system level. See xref:importing-tag-and-image-metadata[Importing Tag and
  Image Metadata] for more details.
  
  If you want to instruct docker to always fetch the tagged image from the
  integrated registry, use `--reference-policy=local`. The registry will use
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] to serve the image to the client and by default, the image blobs will
  be mirrored locally by the registry. As a result, they will be available in
  shorter time next time they are needed. The flag also allows for pulling from
  insecure registries without a need to supply `--insecure-registry` to the
  Docker daemon if the image stream has an xref:insecure-registries[insecure
  annotation] or the tag has an xref:insecure-tag-import-policy[insecure import
  policy].
  
  [[tag-naming]]
  === Tag Naming
  