anchor.diff:    [registries.block]
       registries = ["untrusted.com"]
   ----
  -
  
positive.code: [id="images-configuration-insecure_{context}"]
  = Importing insecure registries and blocking registries
  
  You can add insecure registries or block any registry by editing the `image.config.openshift.io/cluster` custom resource (CR).  
  {product-title} applies the changes to this CR to all nodes in the cluster. 
  
  Insecure external registries, such as those do not have a valid TLS certificate or
  only support HTTP connections, should be avoided.
  
negative.code:     - insecure.com
      blockedRegistries:<2>
      - untrusted.com
      allowedRegistries:
      - quay.io <3>
  status:
    internalRegistryHostname: image-registry.openshift-image-registry.svc:5000
  ----
  <1> Specify an insecure registry.
  <2> Specify registries that should be blacklisted for image pull and push actions. All other
  registries are allowed. Either `blockedRegistries` or `allowedRegistries` can be set, but not both.
  <3> Specify registries that should be permitted for image pull and push actions. All other registries are denied. Either `blockedRegistries` or `allowedRegistries` can be set, but not both.
  +
  The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster`
  for any changes to registries and reboots the nodes when it detects changes.
  Changes to the registries appear in the */host/etc/containers/registries.conf* file on each node.
  +
  ----
  