anchor.diff:  [[insecure-registries]]
   
   === Importing Images from Insecure Registries
  +
   An image stream can be configured to import tag and image metadata from insecure
   image registries, such as those signed with a self-signed certificate or using
   plain HTTP instead of HTTPS.
  
positive.code: 
  The sample image below is from the *ruby* image stream and was
  retrieved by asking for the `*ImageStreamImage*` with the name
  *ruby@371829c*:
  
  .Definition of an Image Object retrieved via ImageStreamImage
  ====
  
  [source,json]
  ----
  {
      "kind": "ImageStreamImage",
      "apiVersion": "v1",
      "metadata": {
          "name": "ruby@371829c",
          "uid": "a48b40d7-18e2-11e5-9ba2-001c422dcd49",
          "resourceVersion": "1888",
          "creationTimestamp": "2015-06-22T13:29:00Z"
      },
      "image": {
          "metadata": {
              "name": "371829c6d5cf05924db2ab21ed79dd0937986a817c7940b00cec40616e9b12eb",
              "uid": "a48b40d7-18e2-11e5-9ba2-001c422dcd49",
              "resourceVersion": "1888",
              "creationTimestamp": "2015-06-22T13:29:00Z"
          },
          "dockerImageReference": "openshift/ruby-20-centos7:latest",
          "dockerImageMetadata": {
              "kind": "DockerImage",
              "apiVersion": "1.0",
              "Id": "371829c6d5cf05924db2ab21ed79dd0937986a817c7940b00cec40616e9b12eb",
              "Parent": "8c7059377eaf86bc913e915f064c073ff45552e8921ceeb1a3b7cbf9215ecb66",
              "Created": "2015-06-20T23:02:23Z",
              "ContainerConfig": {},
              "DockerVersion": "1.6.0",
              "Author": "Jakub Hadvig \u003cjhadvig@redhat.com\u003e",
              "Config": {
                  "User": "1001",
                  "ExposedPorts": {
                      "8080/tcp": {}
                  },
                  "Env": [
                      "PATH=/opt/openshift/src/bin:/opt/openshift/bin:/usr/local/sti:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                      "STI_SCRIPTS_URL=image:///usr/local/sti",
                      "HOME=/opt/openshift/src",
                      "BASH_ENV=/opt/openshift/etc/scl_enable",
                      "ENV=/opt/openshift/etc/scl_enable",
                      "PROMPT_COMMAND=. /opt/openshift/etc/scl_enable",
                      "RUBY_VERSION=2.0"
                  ],
                  "Cmd": [
                      "usage"
                  ],
                  "Image": "8c7059377eaf86bc913e915f064c073ff45552e8921ceeb1a3b7cbf9215ecb66",
                  "WorkingDir": "/opt/openshift/src",
                  "Labels": {
                      "io.openshift.s2i.scripts-url": "image:///usr/local/sti",
                      "k8s.io/description": "Platform for building and running Ruby 2.0 applications",
                      "k8s.io/display-name": "Ruby 2.0",
                      "openshift.io/expose-services": "8080:http",
                      "openshift.io/tags": "builder,ruby,ruby20"
                  }
              },
              "Architecture": "amd64",
              "Size": 53950504
          },
          "dockerImageMetadataVersion": "1.0"
      }
  }
  ----
  ====
  
  [[image-pull-policy]]
  
  === Image Pull Policy
  
  Each container in a pod has a Docker image. Once you have created an image and
  pushed it to a registry, you can then refer to it in the pod.
  
  When OpenShift creates containers, it uses the container's `*imagePullPolicy*`
  to determine if the image should be pulled prior to starting the container.
  There are three possible values for `*imagePullPolicy*`:
  
  - `*Always*` - always pull the image.
  - `*IfNotPresent*` - only pull the image if it does not already exist on the node.
  - `*Never*` - never pull the image.
  
  If a container's `*imagePullPolicy*`
  parameter is not specified, OpenShift sets it based on the image's tag:
  
  . If the tag is *latest*, OpenShift defaults `*imagePullPolicy*` to `*Always*`.
  . Otherwise, OpenShift defaults `*imagePullPolicy*` to `*IfNotPresent*`.
  
  [[importing-tag-and-image-metadata]]
  
  === Importing Tag and Image Metadata
  An image stream can be configured to import tag and image metadata from an image
  repository in an external Docker image registry. See
  link:../infrastructure_components/image_registry.html[Image Registry] for more
  details.
  
  [[tag-tracking]]
  
  === Tag Tracking
  An image stream can also be configured so that a tag "tracks" another one. For
  example, you can configure the *latest* tag to always refer to the current image
  for the tag "2.0":
  
  ====
  
  [source,json]
  ----
  {
    "kind": "ImageStream",
    "apiVersion": "v1",
    "metadata": {
      "name": "ruby"
    },
    "spec": {
      "tags": [
        {
          "name": "latest",
          "from": {
            "kind": "ImageStreamTag",
            "name": "2.0"
          }
        }
      ]
    }
  }
  ----
  ====
  
  You can also do the same using the `oc tag` command:
  
  `oc tag ruby:latest ruby:2.0`
  
  [[tag-removal]]
  
  === Tag Removal
  You can stop tracking a tag simply by removing it. For example, you can stop
  tracking the *latest* tag you set above:
  
  
negative.code: Preparation] for information.
  ====
  endif::[]
  
  Additionally there is an option to specify single tag use insecure repository.
  To do that set `.importPolicy.insecure` in tag's definition to *true*:
  
  ====
  [source,yaml]
  ----
  kind: ImageStream
  apiVersion: v1
  metadata:
    name: ruby
    tags:
    - from:
        kind: DockerImage
        name: my.repo.com:5000/myimage
      name: mytag
      importPolicy:
        insecure: "true" <1>
  ----
  <1> Set tag ruby:mytag to use insecure connection to that registry.
  ====
  
  [[private-registries]]
  
  === Importing Images from Private Registries
  
  An image stream can be configured to import tag and image metadata from private
  image registries, requiring authentication.
  
  To configure this, you need to create a link:../dev_guide/secrets.html[`*secret*`]
  which is used to store your credentials.
  
  . Create the `*secret*` first before importing image from the private repository:
  
  ====
  ----
  $ oc secrets new-dockercfg SECRET --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL
  ----
  ====
  
  For other options consult with `oc secrets new --help`.
  
  Once the secret is configured proceed with creating new Image Stream or using
  `oc import-image` command. During the import process OpenShift will pick up the
  secrets and provide to the remote party.
  
  [[image-pull-policy]]
  
  === Image Pull Policy
  
  Each container in a pod has a Docker image. Once you have created an image and
  pushed it to a registry, you can then refer to it in the pod.
  
  When OpenShift creates containers, it uses the container's `*imagePullPolicy*`
  to determine if the image should be pulled prior to starting the container.
  There are three possible values for `*imagePullPolicy*`:
  
  - `*Always*` - always pull the image.
  - `*IfNotPresent*` - only pull the image if it does not already exist on the node.
  - `*Never*` - never pull the image.
  
  If a container's `*imagePullPolicy*`
  parameter is not specified, OpenShift sets it based on the image's tag:
  
  . If the tag is *latest*, OpenShift defaults `*imagePullPolicy*` to `*Always*`.
  . Otherwise, OpenShift defaults `*imagePullPolicy*` to `*IfNotPresent*`.
  