anchor.diff:      - insecure.com
       blockedRegistries:<2>
       - untrusted.com
  +    allowedRegistries:
  +    - quay.io <3>
   status:
     internalRegistryHostname: image-registry.openshift-image-registry.svc:5000
   ----
   <1> Specify an insecure registry.
  -<2> Specify any registries that should be blacklisted for image pull and push actions. All other
  -registries are allowed.
  +<2> Specify registries that should be blacklisted for image pull and push actions. All other
  +registries are allowed. Either `blockedRegistries` or `allowedRegistries` can be set, but not both.
  +<3> Specify registries that should be permitted for image pull and push actions. All other registries are denied. Either `blockedRegistries` or `allowedRegistries` can be set, but not both.
   +
  -The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster` 
  -for any changes to registries and reboots the nodes when it detects changes. 
  +The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster`
  +for any changes to registries and reboots the nodes when it detects changes.
   Changes to the registries appear in the */host/etc/containers/registries.conf* file on each node.
   +
   ----
  
positive.code:   [registries.block]
      registries = ["untrusted.com"]
  ----
  
  
negative.code: [id="images-configuration-insecure_{context}"]
  = Importing insecure registries and blocking registries
  
  You can add insecure registries or block any registry by editing the `image.config.openshift.io/cluster` custom resource (CR).
  {product-title} applies the changes to this CR to all nodes in the cluster.
  
  Insecure external registries, such as those do not have a valid TLS certificate or
  only support HTTP connections, should be avoided.
  