anchor.diff:  If you require dates in tag names, periodically inspect old and unsupported
   images and _istags_ and remove them. Otherwise, you might experience increasing
   resource usage caused by old images.
  +
   [[tag-removal]]
   === Removing Tags from Image Streams
   To remove a tag completely from an image stream run:
  
positive.code: 
  You can also add the `--scheduled=true` flag to have the destination tag be
  refreshed (i.e., re-imported) periodically. The period is configured globally at
  system level. See xref:importing-tag-and-image-metadata[Importing Tag and
  Image Metadata] for more details.
  
  If you want to instruct docker to always fetch the tagged image from the
  integrated registry, use `--reference-policy=local`. The registry will use
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] to serve the image to the client and by default, the image blobs will
  be mirrored locally by the registry. As a result, they will be available in
  shorter time next time they are needed. The flag also allows for pulling from
  insecure registries without a need to supply `--insecure-registry` to the
  Docker daemon if the image stream has an xref:insecure-registries[insecure
  annotation] or the tag has an xref:insecure-tag-import-policy[insecure import
  policy].
  
  [[tag-naming]]
  === Tag Naming
  
negative.code: 
  [IMPORTANT]
  ====
  This option instructs integrated registry to fall back to an insecure transport
  for any external image tagged in the image stream when serving it, which is
  dangerous. If possible, avoid this risk by
  xref:insecure-tag-import-policy[marking just an `istag` as insecure].
  ====
  
  ifdef::openshift-enterprise,openshift-origin[]
  [IMPORTANT]
  ====
  The above definition only affects importing tag and image metadata. For this
  image to be used in the cluster (e.g., to be able to do a `docker pull`), one of
  the following must be true:
  
  . Each node has Docker configured with the `--insecure-registry` flag matching the
  registry part of the `dockerImageRepository`. See
  xref:../install_config/install/host_preparation.adoc#install-config-install-host-preparation[Host
  Preparation] for more information.
  
  . Each `istag` specification must have `referencePolicy.type` set to `Local`. See
  xref:reference-policy[Reference Policy] for more information.
  ====
  endif::[]
  
  [[imagestream-tag-policies]]
  ==== ImageStream Tag Policies
  
  [[insecure-tag-import-policy]]
  ===== Insecure Tag Import Policy
  The above annotation applies to all images and tags of a particular
  `ImageStream`. For a finer-grained control, policies may be set on
  xref:../architecture/core_concepts/builds_and_image_streams.adoc#image-stream-tag[`istags`].
  Set `importPolicy.insecure` in the tag's definition to `true` to allow a
  fall-back to insecure transport just for images under this tag.
  
  [NOTE]
  ====
  The fall-back to insecure transport for an image under particular `istag` will
  be enabled either when the image stream is annotated as insecure or the `istag`
  has insecure import policy. The `importPolicy.insecure`` set to `false` can not
  override the image stream annotation.
  ====
  
  [[reference-policy]]
  ===== Reference Policy
  The Reference Policy allows you to specify where the image consumers will pull
  from. It is only applicable to remote images (those imported from external
  registries). There are two options to choose from, `Local` and `Source`.
  
  The `Source` policy instructs clients to pull directly from the source registry
  of the image. The integrated registry is not involved unless the image is
  managed by the cluster. (It is not an external image.) This is the default
  policy.
  
  The `Local` policy instructs clients to always pull from the integrated
  registry. This is useful if you want to pull from external insecure registries
  without modifying Docker daemon settings. The
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] of the registry serves the remote image to the client. Additionally,
  all the blobs are mirrored for faster access later.
  
  You can set the policy in a specification of image stream tag as
  `referencePolicy.type`.
  
  .Exmple of Insecure Tag with a Local Reference Policy
  ====
  [source,yaml]
  ----
  