Chapter 5. Managing images

Procedure

• You can add tags to an image stream using the

  oc tag

  command:

  $ oc tag <source> <destination>

  For example, to configure the

  ruby

  image stream

  static-2.0

  tag to always refer to the current image for the

  ruby

  image stream

  2.0

  tag:

  $ oc tag ruby:2.0 ruby:static-2.0

  This creates a new image stream tag named

  static-2.0

  in the

  ruby

  image stream. The new tag directly references the image id that the

  ruby:2.0

  image stream tag pointed to at the time

  oc tag

  was run, and the image it points to never changes.

• To ensure the destination tag is updated when the source tag changes, use the

  --alias=true

  flag:

  $ oc tag --alias=true <source> <destination>

• You can also add the

  --scheduled=true

  flag to have the destination tag be refreshed, or re-imported, periodically. The period is configured globally at the system level.

• The

  --reference

  flag creates an image stream tag that is not imported. The tag points to the source location, permanently.

  If you want to instruct OpenShift Container Platform to always fetch the tagged image from the integrated registry, use

  --reference-policy=local

  . The registry uses the pull-through feature to serve the image to the client. By default, the image blobs are mirrored locally by the registry. As a result, they can be pulled more quickly the next time they are needed. The flag also allows for pulling from insecure registries without a need to supply

  --insecure-registry

  to the container runtime as long as the image stream has an insecure annotation or the tag has an insecure import policy.

Procedure

• To remove a tag completely from an image stream run:

  $ oc delete istag/ruby:latest

  or:

  $ oc tag -d ruby:latest

Procedure

• To reference an image for a given image stream and tag, use

  ImageStreamTag

  :

  <image_stream_name>:<tag>

• To reference an image for a given image stream and image

  sha

  ID, use

  ImageStreamImage

  :

  <image_stream_name>@<id>

  The

  <id>

  is an immutable identifier for a specific image, also called a digest.

• To reference or retrieve an image for a given external registry, use

  DockerImage

  :

  openshift/ruby-20-centos7:2.0

  Note

  When no tag is specified, it is assumed the

  latest

  tag is used.

  You can also reference a third-party registry:

  registry.redhat.io/rhel7:latest

  Or an image with a digest:

  centos/ruby-22-centos7@sha256:3a335d7d8a452970c5b4054ad7118ff134b3a6b50a2bb6d0c07c746e8986b28e

Procedure

• If you already have a

  .dockercfg

  file for the secured registry, you can create a secret from that file by running:

  $ oc create secret generic <pull_secret_name> \
      --from-file=.dockercfg=<path/to/.dockercfg> \
      --type=kubernetes.io/dockercfg

• Or if you have a

  $HOME/.docker/config.json

  file:

  $ oc create secret generic <pull_secret_name> \
      --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
      --type=kubernetes.io/dockerconfigjson

• If you do not already have a Docker credentials file for the secured registry, you can create a secret by running:

  $ oc create secret docker-registry <pull_secret_name> \
      --docker-server=<registry_server> \
      --docker-username=<user_name> \
      --docker-password=<password> \
      --docker-email=<email>

• To use a secret for pulling images for pods, you must add the secret to your service account. The name of the service account in this example should match the name of the service account the pod uses. The default service account is

  default

  :

  $ oc secrets link default <pull_secret_name> --for=pull

Prerequisites

• You have access to the cluster as a user with the

  cluster-admin

  role.