anchor.diff:      name: mytag
       importPolicy:
         insecure: true <1>
  +    referencePolicy:
  +      type: Local <2>
   ----
   <1> Set tag *mytag* to use insecure connection to that registry.
  +<2> Set tag *mytag* to use integrated registry for pulling external images. If
  +the reference policy type is set to `*Source*`, clients fetch the image
  +directly from `my.repo.com:5000/myimage`.
   ====
   
   ifdef::openshift-origin,openshift-online,openshift-enterprise,openshift-dedicated[]
  
positive.code: <1> Set the `*openshift.io/image.insecureRepository*` annotation to *true*
  ====
  
  ifdef::openshift-enterprise,openshift-origin[]
  [IMPORTANT]
  ====
  The above definition only affects importing tag and image metadata. For this
  image to be used in the cluster (e.g., to be able to do a `docker pull`), each
  node must have Docker configured with the `--insecure-registry` flag. See
  xref:../install_config/install/host_preparation.adoc#install-config-install-host-preparation[Host
  Preparation] for information.
  ====
  endif::[]
  
  Additionally, you can specify a single tag using an insecure repository. To do
  so, set `*importPolicy.insecure*` in the tag's definition to *true*:
  
  ====
  [source,yaml]
  
negative.code: system level. See xref:importing-tag-and-image-metadata[Importing Tag and
  Image Metadata] for more details.
  
  If you want to instruct docker to always fetch the tagged image from the
  integrated registry, use `--reference-policy=local`. The registry will use
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] to serve the image to the client and by default, the image blobs will
  be mirrored locally by the registry. As a result, they will be available in
  shorter time next time they are needed. The flag also allows for pulling from
  insecure registries without a need to supply `--insecure-registry` to the
  Docker daemon if the image stream has an xref:insecure-registries[insecure
  annotation] or the tag has an xref:insecure-tag-import-policy[insecure import
  policy].
  
  [[tag-naming]]
  === Tag Naming
  