anchor.diff:      referencePolicy:
         type: Local <2>
   ----
  -<1> Set tag *mytag* to use insecure connection to that registry.
  -<2> Set tag *mytag* to use integrated registry for pulling external images. If
  -the reference policy type is set to `*Source*`, clients fetch the image
  +<1> Set tag `mytag` to use an insecure connection to that registry.
  +<2> Set tag `mytag` to use integrated registry for pulling external images. If
  +the reference policy type is set to `Source`, clients fetch the image
   directly from `my.repo.com:5000/myimage`.
   ====
   
  
positive.code: 
  [IMPORTANT]
  ====
  This option instructs integrated registry to fall-back to an insecure transport
  for any external image tagged in the image stream when serving it, which is
  dangerous. If possible, avoid this risk by
  xref:insecure-tag-import-policy[marking just an istag as insecure].
  ====
  
  ifdef::openshift-enterprise,openshift-origin[]
  [IMPORTANT]
  ====
  The above definition only affects importing tag and image metadata. For this
  image to be used in the cluster (e.g., to be able to do a `docker pull`) one of
  the following must be true:
  
  1. Each node has Docker configured with the `--insecure-registry` flag matching
  the registry part of the `dockerImageRepository`. See
  xref:../install_config/install/host_preparation.adoc#install-config-install-host-preparation[Host
  Preparation] for information.
  2. Each istag specification must have `referencePolicy.type` set to `Local`. See
  xref:reference-policy[below] for more information.
  ====
  endif::[]
  
  [[imagestream-tag-policies]]
  ==== ImageStream Tag policies
  
  [[insecure-tag-import-policy]]
  ===== Insecure Tag Import Policy
  The above annotation applies to all images and tags of a particular
  ImageStream. For a finer-grained control, policies may be set on
  xref:../architecture/core_concepts/builds_and_image_streams.adoc#image-stream-tag[_istags_].
  Set `*importPolicy.insecure*` in the tag's definition to *true* to allow a
  fall-back to insecure transport just for images under this tag.
  
  [NOTE]
  ====
  The fall-back to insecure transport for an image under particular _istag_ will
  be enabled either when the image stream is annotated as insecure or the _istag_
  has insecure import policy. The image stream annotation cannot be overriden by
  the `*importPolicy.insecure*` set to *false*. 
  ====
  
  [[reference-policy]]
  ===== Reference Policy 
  Allows to specify where the image consumers will pull from. It is applicable
  just to remote images (those imported from external registries). There are two
  options to choose from: `*Local*` and `*Source*`. 
  
  The `*Source*` policy intructs clients to pull directly from the source registry of the image. The integrated registry won't be involved unless the image is managed by the cluster (it's not an external image). This is the default policy.
  
  The `*Local*` policy instructs clients to pull always from the integrated
  registry. This is useful if you want to pull from external insecure registries
  without modifying docker daemon settings. The
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] of the registry will take care of serving the remote image to the
  client. Additionaly, all the blobs will be mirrored for latter faster access.
  
  The policy can be set in a specification of image stream tag as  `referencePolicy.type`.
  
  Here's an example of insecure tag with a local reference policy:
  
  ====
  [source,yaml]
  ----
  
negative.code: 
  You can also add the `--scheduled=true` flag to have the destination tag be
  refreshed (i.e., re-imported) periodically. The period is configured globally at
  system level. See xref:importing-tag-and-image-metadata[Importing Tag and Image
  Metadata] for more details.
  
  If you want to instruct Docker to always fetch the tagged image from the
  integrated registry, use `--reference-policy=local`. The registry uses the
  xref:../install_config/registry/extended_registry_configuration.adoc#middleware-repository-pullthrough[pull-through
  feature] to serve the image to the client. By default, the image blobs are
  mirrored locally by the registry. As a result, they are available for a  shorter
  time the next time they are needed. The flag also allows for pulling from
  insecure registries without a need to supply `--insecure-registry` to the Docker
  daemon if the image stream has an xref:insecure-registries[insecure annotation]
  or the tag has an xref:insecure-tag-import-policy[insecure import policy].
  
  [[tag-naming]]
  === Tag Naming
  