diff --git a/cmd/tke-installer/app/installer/manifests/charts/tke-registry/templates/tke-registry-api.yaml b/cmd/tke-installer/app/installer/manifests/charts/tke-registry/templates/tke-registry-api.yaml
index 2db1ecc68..69f06788f 100644
--- a/cmd/tke-installer/app/installer/manifests/charts/tke-registry/templates/tke-registry-api.yaml
+++ b/cmd/tke-installer/app/installer/manifests/charts/tke-registry/templates/tke-registry-api.yaml
@@ -329,6 +329,9 @@ data:
 {{- end }}
       delete:
         enabled: true
+      maintenance:
+        readonly:
+          enabled: false
     security:
       tokenPrivateKeyFile: /etc/registry/private_key.pem
       tokenPublicKeyFile: /etc/registry/public_key.crt
diff --git a/pkg/registry/apis/config/types.go b/pkg/registry/apis/config/types.go
index 0d169a30d..6cbf8fb18 100644
--- a/pkg/registry/apis/config/types.go
+++ b/pkg/registry/apis/config/types.go
@@ -50,6 +50,8 @@ type Storage struct {
 	Etcd *EtcdStorage
 	// +optional
 	Delete *Delete
+	// +optional
+	Maintenance *Maintenance
 }
 type EtcdStorage struct {
 	CAFile    string
@@ -119,6 +121,15 @@ type Delete struct {
 	Enabled bool
 }
 
+// Maintenance ReadOnly enabled set to true, clients will not be allowed to write to the registry.
+type Maintenance struct {
+	ReadOnly ReadOnly
+}
+
+type ReadOnly struct {
+	Enabled bool
+}
+
 type Security struct {
 	TokenPrivateKeyFile string
 	TokenPublicKeyFile  string
diff --git a/pkg/registry/apis/config/v1/types.go b/pkg/registry/apis/config/v1/types.go
index 68cbb9879..4c26a1d9c 100644
--- a/pkg/registry/apis/config/v1/types.go
+++ b/pkg/registry/apis/config/v1/types.go
@@ -50,6 +50,8 @@ type Storage struct {
 	Etcd *EtcdStorage `json:"etcd,omitempty" yaml:"etcd,omitempty"`
 	// +optional
 	Delete *Delete `json:"delete,omitempty" yaml:"delete,omitempty"`
+	// +optional
+	Maintenance *Maintenance `json:"maintenance,omitempty" yaml:"maintenance,omitempty"`
 }
 
 type EtcdStorage struct {
@@ -120,6 +122,15 @@ type Delete struct {
 	Enabled bool `json:"enabled" yaml:"enabled"`
 }
 
+// Maintenance ReadOnly enabled set to true, clients will not be allowed to write to the registry.
+type Maintenance struct {
+	ReadOnly ReadOnly `json:"readonly" yaml:"readonly"`
+}
+
+type ReadOnly struct {
+	Enabled bool `json:"enabled" yaml:"enabled"`
+}
+
 type Security struct {
 	TokenPrivateKeyFile string `json:"tokenPrivateKeyFile" yaml:"tokenPrivateKeyFile"`
 	TokenPublicKeyFile  string `json:"tokenPublicKeyFile" yaml:"tokenPublicKeyFile"`
diff --git a/pkg/registry/apis/config/v1/zz_generated.conversion.go b/pkg/registry/apis/config/v1/zz_generated.conversion.go
index 448e4d26e..24c16b9df 100644
--- a/pkg/registry/apis/config/v1/zz_generated.conversion.go
+++ b/pkg/registry/apis/config/v1/zz_generated.conversion.go
@@ -77,6 +77,26 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddGeneratedConversionFunc((*Maintenance)(nil), (*config.Maintenance)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Maintenance_To_config_Maintenance(a.(*Maintenance), b.(*config.Maintenance), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*config.Maintenance)(nil), (*Maintenance)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_config_Maintenance_To_v1_Maintenance(a.(*config.Maintenance), b.(*Maintenance), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*ReadOnly)(nil), (*config.ReadOnly)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ReadOnly_To_config_ReadOnly(a.(*ReadOnly), b.(*config.ReadOnly), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*config.ReadOnly)(nil), (*ReadOnly)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_config_ReadOnly_To_v1_ReadOnly(a.(*config.ReadOnly), b.(*ReadOnly), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddGeneratedConversionFunc((*Redis)(nil), (*config.Redis)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1_Redis_To_config_Redis(a.(*Redis), b.(*config.Redis), scope)
 	}); err != nil {
@@ -218,6 +238,50 @@ func Convert_config_InMemoryStorage_To_v1_InMemoryStorage(in *config.InMemorySto
 	return autoConvert_config_InMemoryStorage_To_v1_InMemoryStorage(in, out, s)
 }
 
+func autoConvert_v1_Maintenance_To_config_Maintenance(in *Maintenance, out *config.Maintenance, s conversion.Scope) error {
+	if err := Convert_v1_ReadOnly_To_config_ReadOnly(&in.ReadOnly, &out.ReadOnly, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_Maintenance_To_config_Maintenance is an autogenerated conversion function.
+func Convert_v1_Maintenance_To_config_Maintenance(in *Maintenance, out *config.Maintenance, s conversion.Scope) error {
+	return autoConvert_v1_Maintenance_To_config_Maintenance(in, out, s)
+}
+
+func autoConvert_config_Maintenance_To_v1_Maintenance(in *config.Maintenance, out *Maintenance, s conversion.Scope) error {
+	if err := Convert_config_ReadOnly_To_v1_ReadOnly(&in.ReadOnly, &out.ReadOnly, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_config_Maintenance_To_v1_Maintenance is an autogenerated conversion function.
+func Convert_config_Maintenance_To_v1_Maintenance(in *config.Maintenance, out *Maintenance, s conversion.Scope) error {
+	return autoConvert_config_Maintenance_To_v1_Maintenance(in, out, s)
+}
+
+func autoConvert_v1_ReadOnly_To_config_ReadOnly(in *ReadOnly, out *config.ReadOnly, s conversion.Scope) error {
+	out.Enabled = in.Enabled
+	return nil
+}
+
+// Convert_v1_ReadOnly_To_config_ReadOnly is an autogenerated conversion function.
+func Convert_v1_ReadOnly_To_config_ReadOnly(in *ReadOnly, out *config.ReadOnly, s conversion.Scope) error {
+	return autoConvert_v1_ReadOnly_To_config_ReadOnly(in, out, s)
+}
+
+func autoConvert_config_ReadOnly_To_v1_ReadOnly(in *config.ReadOnly, out *ReadOnly, s conversion.Scope) error {
+	out.Enabled = in.Enabled
+	return nil
+}
+
+// Convert_config_ReadOnly_To_v1_ReadOnly is an autogenerated conversion function.
+func Convert_config_ReadOnly_To_v1_ReadOnly(in *config.ReadOnly, out *ReadOnly, s conversion.Scope) error {
+	return autoConvert_config_ReadOnly_To_v1_ReadOnly(in, out, s)
+}
+
 func autoConvert_v1_Redis_To_config_Redis(in *Redis, out *config.Redis, s conversion.Scope) error {
 	out.Addr = in.Addr
 	out.Password = in.Password
@@ -386,6 +450,7 @@ func autoConvert_v1_Storage_To_config_Storage(in *Storage, out *config.Storage,
 	out.S3 = (*config.S3Storage)(unsafe.Pointer(in.S3))
 	out.Etcd = (*config.EtcdStorage)(unsafe.Pointer(in.Etcd))
 	out.Delete = (*config.Delete)(unsafe.Pointer(in.Delete))
+	out.Maintenance = (*config.Maintenance)(unsafe.Pointer(in.Maintenance))
 	return nil
 }
 
@@ -400,6 +465,7 @@ func autoConvert_config_Storage_To_v1_Storage(in *config.Storage, out *Storage,
 	out.S3 = (*S3Storage)(unsafe.Pointer(in.S3))
 	out.Etcd = (*EtcdStorage)(unsafe.Pointer(in.Etcd))
 	out.Delete = (*Delete)(unsafe.Pointer(in.Delete))
+	out.Maintenance = (*Maintenance)(unsafe.Pointer(in.Maintenance))
 	return nil
 }
 
diff --git a/pkg/registry/apis/config/v1/zz_generated.deepcopy.go b/pkg/registry/apis/config/v1/zz_generated.deepcopy.go
index e6e5de1ec..be7b7dae8 100644
--- a/pkg/registry/apis/config/v1/zz_generated.deepcopy.go
+++ b/pkg/registry/apis/config/v1/zz_generated.deepcopy.go
@@ -100,6 +100,39 @@ func (in *InMemoryStorage) DeepCopy() *InMemoryStorage {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Maintenance) DeepCopyInto(out *Maintenance) {
+	*out = *in
+	out.ReadOnly = in.ReadOnly
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Maintenance.
+func (in *Maintenance) DeepCopy() *Maintenance {
+	if in == nil {
+		return nil
+	}
+	out := new(Maintenance)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ReadOnly) DeepCopyInto(out *ReadOnly) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReadOnly.
+func (in *ReadOnly) DeepCopy() *ReadOnly {
+	if in == nil {
+		return nil
+	}
+	out := new(ReadOnly)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Redis) DeepCopyInto(out *Redis) {
 	*out = *in
@@ -328,6 +361,11 @@ func (in *Storage) DeepCopyInto(out *Storage) {
 		*out = new(Delete)
 		**out = **in
 	}
+	if in.Maintenance != nil {
+		in, out := &in.Maintenance, &out.Maintenance
+		*out = new(Maintenance)
+		**out = **in
+	}
 	return
 }
 
diff --git a/pkg/registry/apis/config/zz_generated.deepcopy.go b/pkg/registry/apis/config/zz_generated.deepcopy.go
index 19b8d0ec9..765ad2b6d 100644
--- a/pkg/registry/apis/config/zz_generated.deepcopy.go
+++ b/pkg/registry/apis/config/zz_generated.deepcopy.go
@@ -100,6 +100,39 @@ func (in *InMemoryStorage) DeepCopy() *InMemoryStorage {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Maintenance) DeepCopyInto(out *Maintenance) {
+	*out = *in
+	out.ReadOnly = in.ReadOnly
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Maintenance.
+func (in *Maintenance) DeepCopy() *Maintenance {
+	if in == nil {
+		return nil
+	}
+	out := new(Maintenance)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ReadOnly) DeepCopyInto(out *ReadOnly) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReadOnly.
+func (in *ReadOnly) DeepCopy() *ReadOnly {
+	if in == nil {
+		return nil
+	}
+	out := new(ReadOnly)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Redis) DeepCopyInto(out *Redis) {
 	*out = *in
@@ -328,6 +361,11 @@ func (in *Storage) DeepCopyInto(out *Storage) {
 		*out = new(Delete)
 		**out = **in
 	}
+	if in.Maintenance != nil {
+		in, out := &in.Maintenance, &out.Maintenance
+		*out = new(Maintenance)
+		**out = **in
+	}
 	return
 }
 
diff --git a/pkg/registry/distribution/distribution.go b/pkg/registry/distribution/distribution.go
index 8ea6b5c8b..47156dffe 100644
--- a/pkg/registry/distribution/distribution.go
+++ b/pkg/registry/distribution/distribution.go
@@ -266,5 +266,10 @@ func buildStorageConfiguration(opts *Options) map[string]configuration.Parameter
 		deleteDriver["enabled"] = storageCfg.Delete.Enabled
 		storage["delete"] = deleteDriver
 	}
+	if storageCfg.Maintenance != nil {
+		storage["maintenance"] = configuration.Parameters{
+			"readonly": map[interface{}]interface{}{"enabled": storageCfg.Maintenance.ReadOnly.Enabled},
+		}
+	}
 	return storage
 }