anchor.diff:  system level. See xref:importing-tag-and-image-metadata[Importing Tag and
   Image Metadata] for more details.
   
  -[IMPORTANT]
  -====
  -Avoid tagging {product-title}-managed images (i.e., those built using an {product-title} instance and pushed to its internal registry). There is a
  -ifdef::openshift-origin,openshift-enterprise[]
  -xref:../install_config/registry/registry_known_issues.adoc#install-config-registry-known-issues[known
  -issue]
  -endif::[]
  -ifdef::openshift-online,openshift-dedicated,atomic-registry[]
  -https://docs.openshift.com/enterprise/3.2/release_notes/ose_3_2_release_notes.html#ose-32-known-issues[known issue]
  -endif::[]
  -that prevents the registry client from pulling from such a tag.
  -====
  +If you want to instruct docker to always fetch the tagged image from the
  +integrated registry, use `--reference-policy=local`. The registry will use
  +xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  +feature] to serve the image to the client and by default, the image blobs will
  +be mirrored locally by the registry. As a result, they will be available in
  +shorter time next time they are needed. The flag also allows for pulling from
  +insecure registries without a need to supply `--insecure-registry` to the
  +Docker daemon if the image stream has an xref:insecure-registries[insecure
  +annotation] or the tag has an xref:insecure-tag-import-policy[insecure import
  +policy].
   
   [[tag-naming]]
   === Tag Naming
  
positive.code:     name: mytag
      importPolicy:
        insecure: true <1>
  ----
  <1> Set tag *mytag* to use insecure connection to that registry.
  ====
  
  ifdef::openshift-origin,openshift-online,openshift-enterprise,openshift-dedicated[]
  
negative.code: <1> Set the `*openshift.io/image.insecureRepository*` annotation to *true*
  ====
  
  [IMPORTANT]
  ====
  This option instructs integrated registry to fall-back to an insecure transport
  for any external image tagged in the image stream when serving it, which is
  dangerous. If possible, avoid this risk by
  xref:insecure-tag-import-policy[marking just an istag as insecure].
  ====
  
  ifdef::openshift-enterprise,openshift-origin[]
  [IMPORTANT]
  ====
  The above definition only affects importing tag and image metadata. For this
  image to be used in the cluster (e.g., to be able to do a `docker pull`) one of
  the following must be true:
  
  1. Each node has Docker configured with the `--insecure-registry` flag matching
  the registry part of the `dockerImageRepository`. See
  xref:../install_config/install/host_preparation.adoc#install-config-install-host-preparation[Host
  Preparation] for information.
  2. Each istag specification must have `referencePolicy.type` set to `Local`. See
  xref:reference-policy[below] for more information.
  ====
  endif::[]
  
  [[imagestream-tag-policies]]
  ==== ImageStream Tag policies
  
  [[insecure-tag-import-policy]]
  ===== Insecure Tag Import Policy
  The above annotation applies to all images and tags of a particular
  ImageStream. For a finer-grained control, policies may be set on
  xref:../architecture/core_concepts/builds_and_image_streams.adoc#image-stream-tag[_istags_].
  Set `*importPolicy.insecure*` in the tag's definition to *true* to allow a
  fall-back to insecure transport just for images under this tag.
  
  [NOTE]
  ====
  The fall-back to insecure transport for an image under particular _istag_ will
  be enabled either when the image stream is annotated as insecure or the _istag_
  has insecure import policy. The image stream annotation cannot be overriden by
  the `*importPolicy.insecure*` set to *false*. 
  ====
  
  [[reference-policy]]
  ===== Reference Policy 
  Allows to specify where the image consumers will pull from. It is applicable
  just to remote images (those imported from external registries). There are two
  options to choose from: `*Local*` and `*Source*`. 
  
  The `*Source*` policy intructs clients to pull directly from the source registry of the image. The integrated registry won't be involved unless the image is managed by the cluster (it's not an external image). This is the default policy.
  
  The `*Local*` policy instructs clients to pull always from the integrated
  registry. This is useful if you want to pull from external insecure registries
  without modifying docker daemon settings. The
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] of the registry will take care of serving the remote image to the
  client. Additionaly, all the blobs will be mirrored for latter faster access.
  
  The policy can be set in a specification of image stream tag as  `referencePolicy.type`.
  
  Here's an example of insecure tag with a local reference policy:
  
  ====
  [source,yaml]
  