🔧 Configuring allowedRegistries and insecureRegistries in OpenShift

In OpenShift, image pulling behavior is controlled by the image.config.openshift.io/cluster resource. You can use it to explicitly allow image sources and configure insecure registries for development or non-production use.

This guide shows how to edit the cluster-wide image configuration using oc.

🛠 Step-by-Step Instructions

1. Open the Image Configuration for Editing

Use the oc CLI to edit the cluster image configuration:

oc edit image.config.openshift.io/cluster

This opens the configuration in your default text editor.

2. Add allowedRegistries and insecureRegistries

Inside the spec.registrySources section, you can define which registries OpenShift is allowed to pull from, and which should be treated as insecure (i.e., without TLS or using self-signed certificates).

Example Configuration:

apiVersion: config.openshift.io/v1
kind: Image
metadata:
  name: cluster
spec:
  registrySources:
    allowedRegistries:
      - registry.redhat.io
      - quay.io
      - docker.io
    insecureRegistries:
      - my-insecure-registry.local:5000
      - 192.168.1.100:5000

• allowedRegistries: Only these registries will be used for pulling images.