[OSDOCS-12036]ROSA-HCP - Image registry mirror config to customers #99809

mletalie · 2025-09-29T12:58:13Z

Version(s):

4.19+
Issue:

https://issues.redhat.com/browse/OSDOCS-12036
Link to docs preview:

images-registry-mirroring_image-configuration-hcp

Create Image Mirror Config
Edit Image Mirror Config
Delete Image Mirror Config
List Image Mirror Config
Configuring in Terraform
Release Note
QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-09-29T13:08:51Z

🤖 Wed Oct 08 15:24:01 - Prow CI generated the docs preview:
https://99809--ocpdocs-pr.netlify.app
Complete list of updated preview URLs: artifacts/updated_preview_urls.txt

davidleerh · 2025-10-01T18:19:21Z

modules/rosa-delete-objects.adoc

 $ rosa delete machinepool --cluster=mycluster mp-1
 ----
+ifdef::openshift-rosa-hcp[]
+[id="rosa-delete-mirro-set_{context}"]


i think this might be a typo:
rosa-delete-mirro-set -> rosa-delete-mirror-set

davidleerh · 2025-10-01T18:21:31Z

on the module docs, can we emphasize at the top that image mirrors only pertain to image reference by digest only at this time (ImageDigestMirrorSets)? and image reference by tag is not available yet with this feature.

I think this is what Aaren (PM) wanted to show to customers.

ocpdocs-vale-bot · 2025-10-02T15:59:22Z

modules/rosa-sts-cluster-terraform-mirror-image.adoc

@@ -0,0 +1,166 @@
+// Module included in the following assemblies:


🤖 [error] OpenShiftAsciiDoc.ModuleContainsContentType: Module is missing the '_mod-docs-content-type' variable.

ocpdocs-vale-bot · 2025-10-03T16:12:33Z

modules/images-registry-mirroring.adoc

@@ -0,0 +1,100 @@
+// Module included in the following assemblies:


🤖 [error] OpenShiftAsciiDoc.ModuleContainsContentType: Module is missing the '_mod-docs-content-type' variable.

ocpdocs-vale-bot · 2025-10-03T17:59:19Z

modules/images-registry-mirroring.adoc

+[id="create-image-mirroring_{context}"]
+==  Create image mirroring
+
+.Procedure


🤖 [error] AsciiDocDITA.AdmonitionTitle: Admonition titles are not supported in DITA.

I'm not sure exactly what issue the bot is flagging here. Will investigate further.

AedinC

Hey @mletalie. Great work. Just had some very minor style quibbles.

AedinC · 2025-10-06T10:53:41Z

modules/images-registry-mirroring.adoc

+// Module included in the following assemblies:
+//
+// * openshift_images/image-configuration-hcp.adoc
+


Suggested change

:_mod-docs-content-type: CONCEPT

AedinC · 2025-10-06T10:54:19Z

modules/images-registry-mirroring.adoc

+
+IDMS defines a set of cluster-wide policies for registry mirroring. It intercepts image pull requests that identify an image by its unique content-addressable digest. Based on these policies, the IDMS transparently redirects the pull operation from its specified source registry to one or more designated mirror registries.
+
+The benefits of configuring your {product-title} to pull images from a mirrored registry using IDMS include:


Suggested change

The benefits of configuring your {product-title} to pull images from a mirrored registry using IDMS include:

The benefits of configuring your {product-title} cluster (?) to pull images from a mirrored registry using IDMS include:

AedinC · 2025-10-06T10:57:20Z

modules/images-registry-mirroring.adoc

+
+[IMPORTANT]
+====
+The image mirror configuration feature operates exclusively with image references by digest, meaning that image mirroring will only activate when an image is pulled using its unique and immutable ID. Any image references using a mutable tag are currently not supported by this functionality.


Wondering if you should move this note back up to about line 10 when digest is first mentioned- might be more useful for the reader.

Good call...forgot to move after adding those bullet points. thanks!

Note is still here - just in case you forgot to move it, or maybe you've changed your mind and want to keep it here?

AedinC · 2025-10-06T10:59:50Z

modules/images-registry-mirroring.adoc

+
+
+.Prerequisites
+


There are some extra pluses here and above.

AedinC · 2025-10-06T11:00:53Z

modules/images-registry-mirroring.adoc

+.Prerequisites
+
+
+** You have installed and configured the latest ROSA CLI on your installation host.


Suggested change

** You have installed and configured the latest ROSA CLI on your installation host.

** You have installed and configured the latest {rosa-cli-first} on your installation host.

AedinC · 2025-10-06T11:26:43Z

modules/rosa-sts-cluster-terraform-mirror-image.adoc

+
+.Procedure
+
+. Add the following `rhcs_image_mirror` resource block to your Terraform configuration file (e.g., `main.tf`), replacing the variable values with your specific requirements.


Suggested change

. Add the following `rhcs_image_mirror` resource block to your Terraform configuration file (e.g., `main.tf`), replacing the variable values with your specific requirements.

. Add the following `rhcs_image_mirror` resource block to your Terraform configuration file (for example, `main.tf`), replacing the variable values with your specific requirements.

AedinC · 2025-10-06T11:27:00Z

modules/rosa-sts-cluster-terraform-mirror-image.adoc

+$ terraform plan
+----
+
+


AedinC · 2025-10-06T11:27:20Z

modules/rosa-sts-cluster-terraform-mirror-image.adoc

+
+. Once you have confirmed that only one resource (`rhcs_image_mirror`) will be added to your {product-title} cluster, and nothing will be changed or destroyed, run the following command to apply the changes:
+
+


Few extra pluses here and below.

AedinC · 2025-10-06T11:27:45Z

modules/rosa-sts-cluster-terraform-mirror-image.adoc

+
+. Click **Enter** to approve the changes.
+
+The `ImageContentSourcePolicy` is now configured on your cluster, and the image mirror will be active.


When will it be active- do we know?

AedinC · 2025-10-06T11:30:22Z

rosa_release_notes/rosa-release-notes.adoc

+=== Q4 2025
+ifdef::openshift-rosa-hcp[]
+* ** ImageDigestMirrorSets (IDMS) now supported.**
+{product-title} now supports ImageDigestMirrorSets (IDMS), enabling clusters to redirect image pulls to a private, mirrored registry. This enhancement is critical for customers in air-gapped or restricted networks, allowing them to host their own mirrors for third-party images while satisfying strict security and compliance requirements. For more information, see xref:../openshift_images/image-configuration-hcp.adoc#images-registry-mirroring_image-configuration-hcp[Image registry mirroring for {product-title}].


Took a stab at rewriting this to be less passive.

Suggested change

{product-title} now supports ImageDigestMirrorSets (IDMS), enabling clusters to redirect image pulls to a private, mirrored registry. This enhancement is critical for customers in air-gapped or restricted networks, allowing them to host their own mirrors for third-party images while satisfying strict security and compliance requirements. For more information, see xref:../openshift_images/image-configuration-hcp.adoc#images-registry-mirroring_image-configuration-hcp[Image registry mirroring for {product-title}].

{product-title} now supports ImageDigestMirrorSets (IDMS), enabling clusters to redirect image pulls to a private, mirrored registry. This critical enhancement means customers in air-gapped or restricted networks can host their own mirrors for third-party images while satisfying strict security and compliance requirements. For more information, see xref:../openshift_images/image-configuration-hcp.adoc#images-registry-mirroring_image-configuration-hcp[Image registry mirroring for {product-title}].

AedinC · 2025-10-08T12:10:57Z

modules/images-registry-mirroring.adoc

+
+[IMPORTANT]
+====
+The image mirror configuration feature operates exclusively with image references by digest, meaning that image mirroring will only activate when an image is pulled using its unique and immutable ID. Any image references using a mutable tag are currently not supported by this functionality.


Note is still here - just in case you forgot to move it, or maybe you've changed your mind and want to keep it here?

AedinC · 2025-10-08T12:15:05Z

modules/images-registry-mirroring.adoc

+|===
+
+.Examples
+Creating an image mirror configuration for a cluster named `mycluster`.


Suggested change

Creating an image mirror configuration for a cluster named `mycluster`.

Creates an image mirror configuration for a cluster named `mycluster`.

AedinC · 2025-10-08T12:15:17Z

modules/images-registry-mirroring.adoc

+An ID is automatically generated and assigned to an image mirror during image mirror configuration creation.
+====
+
+Creating an image mirror configuration with a specific type.


Suggested change

Creating an image mirror configuration with a specific type.

Creates an image mirror configuration with a specific type.

AedinC · 2025-10-08T12:15:34Z

modules/images-registry-mirroring.adoc

+====
+When editing an image mirror configuration, the new mirrors list completely replaces the existing mirrors list.
+====
+


Extra plus.

AedinC · 2025-10-08T12:16:14Z

modules/images-registry-mirroring.adoc

+  --mirrors=new-primary.company.com/team,new-secondary.company.com/team
+----
+
+


Extra plus.

AedinC · 2025-10-08T12:17:04Z

modules/rosa-create-objects.adoc

+====
+The image mirror configuration feature operates exclusively with image references by digest, meaning that image mirroring will only activate when an image is pulled using its unique and immutable ID. Any image references using a mutable tag is currently not supported by this functionality.
+
+{product-title} clusters must be in the **Ready** state in order to create image.


Suggested change

{product-title} clusters must be in the **Ready** state in order to create image.

{product-title} clusters must be in the **Ready** state in order to create an image.

AedinC · 2025-10-08T12:17:44Z

modules/rosa-edit-objects.adoc

@@ -353,4 +352,57 @@ Associate a `KubeletConfig` object with an existing `high-pid-pool` machine pool
 ----
 $ rosa edit machinepool -c mycluster --kubelet-configs=set-high-pids high-pid-pool
 ----
+


Extra plus.

AedinC · 2025-10-08T12:22:01Z

modules/rosa-sts-cluster-terraform-mirror-image.adoc

+// Module included in the following assemblies:
+//
+// * rosa_hcp/terraform/rosa-hcp-creating-a-cluster-quickly-terraform.adoc
+// * rosa_install_access_delete_clusters/terraform/rosa-classic-creating-a-cluster-quickly-terraform.adoc


Should this be removed as its for HCP only?

AedinC

Just a few more tiny things.

openshift-ci · 2025-10-08T15:25:40Z

@mletalie: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

mletalie · 2025-10-13T16:09:55Z

/cherrypick enterprise-4.19
/cherrypick enterprise-4.20

openshift-cherrypick-robot · 2025-10-13T16:10:49Z

@mletalie: new pull request created: #100406

In response to this:

/cherrypick enterprise-4.19
/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-10-13T16:11:40Z

@mletalie: new pull request created: #100407

In response to this:

/cherrypick enterprise-4.19
/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

mletalie force-pushed the OSDOCS-12036 branch from 76b93d6 to 9b6459f Compare September 29, 2025 12:58

openshift-ci bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Sep 29, 2025

mletalie changed the title ~~Osdocs 12036~~ [OSDOCS-12036]ROSA-HCP - Image registry mirror config to customers Sep 29, 2025

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 29, 2025

mletalie force-pushed the OSDOCS-12036 branch 4 times, most recently from c69063b to ef2f1a8 Compare October 1, 2025 17:09

davidleerh reviewed Oct 1, 2025

View reviewed changes

mletalie closed this Oct 2, 2025

mletalie reopened this Oct 2, 2025

mletalie closed this Oct 2, 2025

mletalie reopened this Oct 2, 2025

openshift-ci bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 2, 2025

ocpdocs-vale-bot reviewed Oct 2, 2025

View reviewed changes

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Oct 2, 2025

mletalie force-pushed the OSDOCS-12036 branch 2 times, most recently from fa48c32 to 491153a Compare October 3, 2025 16:03

openshift-ci bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 3, 2025

ocpdocs-vale-bot reviewed Oct 3, 2025

View reviewed changes

mletalie force-pushed the OSDOCS-12036 branch from afc9763 to 7f87c22 Compare October 3, 2025 19:11

AedinC reviewed Oct 6, 2025

View reviewed changes

mletalie force-pushed the OSDOCS-12036 branch from 4d7ea84 to e3a16db Compare October 6, 2025 14:00

mletalie force-pushed the OSDOCS-12036 branch 5 times, most recently from 63f8b72 to f3dfd8f Compare October 7, 2025 17:34

AedinC reviewed Oct 8, 2025

View reviewed changes

mletalie force-pushed the OSDOCS-12036 branch from 28e7671 to 555d47b Compare October 8, 2025 15:02

IDMS

c2a42cf

mletalie force-pushed the OSDOCS-12036 branch from 555d47b to c2a42cf Compare October 8, 2025 15:05

mletalie merged commit babf53a into openshift:main Oct 13, 2025
2 checks passed

openshift-cherrypick-robot mentioned this pull request Oct 13, 2025

[enterprise-4.19] [OSDOCS-12036]ROSA-HCP - Image registry mirror config to customers #100406

Merged

openshift-cherrypick-robot mentioned this pull request Oct 13, 2025

[enterprise-4.20] [OSDOCS-12036]ROSA-HCP - Image registry mirror config to customers #100407

Merged

		@@ -0,0 +1,166 @@
		// Module included in the following assemblies:

		@@ -0,0 +1,100 @@
		// Module included in the following assemblies:


		IDMS defines a set of cluster-wide policies for registry mirroring. It intercepts image pull requests that identify an image by its unique content-addressable digest. Based on these policies, the IDMS transparently redirects the pull operation from its specified source registry to one or more designated mirror registries.

		The benefits of configuring your {product-title} to pull images from a mirrored registry using IDMS include:

		.Prerequisites


		** You have installed and configured the latest ROSA CLI on your installation host.


		.Procedure

		. Add the following `rhcs_image_mirror` resource block to your Terraform configuration file (e.g., `main.tf`), replacing the variable values with your specific requirements.


		. Once you have confirmed that only one resource (`rhcs_image_mirror`) will be added to your {product-title} cluster, and nothing will be changed or destroyed, run the following command to apply the changes:

		+


		. Click Enter to approve the changes.

		The `ImageContentSourcePolicy` is now configured on your cluster, and the image mirror will be active. No newline at end of file

	Creating an image mirror configuration for a cluster named `mycluster`.
	Creates an image mirror configuration for a cluster named `mycluster`.

	Creating an image mirror configuration with a specific type.
	Creates an image mirror configuration with a specific type.

		--mirrors=new-primary.company.com/team,new-secondary.company.com/team
		----

	{product-title} clusters must be in the Ready state in order to create image.
	{product-title} clusters must be in the Ready state in order to create an image.

[OSDOCS-12036]ROSA-HCP - Image registry mirror config to customers #99809

[OSDOCS-12036]ROSA-HCP - Image registry mirror config to customers #99809

Conversation

mletalie commented Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

davidleerh commented Oct 1, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AedinC left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AedinC left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 8, 2025

Uh oh!

Uh oh!

mletalie commented Oct 13, 2025

Uh oh!

openshift-cherrypick-robot commented Oct 13, 2025

Uh oh!

openshift-cherrypick-robot commented Oct 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

mletalie commented Sep 29, 2025 •

edited

Loading

ocpdocs-previewbot commented Sep 29, 2025 •

edited

Loading