The Image Registry Operator installs a single instance of the OpenShift Container Platform registry, and it manages all configuration of the registry, including setting up registry storage.

Storage is only automatically configured when you install an installer-provisioned infrastructure cluster on AWS, GCP, Azure, or OpenStack.

After the control plane deploys, the Operator will create a default configs.imageregistry.operator.openshift.io resource instance based on configuration detected in the cluster.

If insufficient information is available to define a complete configs.imageregistry.operator.openshift.io resource, the incomplete resource will be defined and the operator will update the resource status with information about what is missing.

The Image Registry Operator runs in the openshift-image-registry namespace, and manages the registry instance in that location as well. All configuration and workload resources for the registry reside in that namespace.

Image Registry Operator configuration parameters

The configs.imageregistry.operator.openshift.io resource offers the following configuration parameters.

Parameter Description


Managed: The Operator updates the registry as configuration resources are updated.

Unmanaged: The Operator ignores changes to the configuration resources.

Removed: The Operator removes the registry instance and tear down any storage that the Operator provisioned.


Sets loglevel of the registry instance.


Value needed by the registry to secure uploads, generated by default.


Defines the Proxy to be used when calling master API and upstream registries.


Storagetype: Details for configuring registry storage, for example S3 bucket coordinates. Normally configured by default.


Indicates whether the registry instance should reject attempts to push new images or delete existing ones.


API Request Limit details. Controls how many parallel requests a given registry instance will handle before queuing additional requests.


Determines whether or not an external route is defined using the default hostname. If enabled, the route uses re-encrypt encryption. Defaults to false.


Array of additional routes to create. You provide the hostname and certificate for the route.


Replica count for the registry.

Enable the Image Registry default route with the Custom Resource Definition

In OpenShift Container Platform, the Registry Operator controls the registry feature. The Operator is defined by the configs.imageregistry.operator.openshift.io Custom Resource Definition (CRD).

If you need to automatically enable the Image Registry default route, patch the Image Registry Operator CRD.

  • Patch the Image Registry Operator CRD:

    $ oc patch configs.imageregistry.operator.openshift.io/cluster --type merge -p '{"spec":{"defaultRoute":true}}'

Configuring a ConfigMap for the Image Registry Operator

In addition to the configs.imageregistry.operator.openshift.io and secret resources, configuration is provided to the Operator by a separate ConfigMap resource located within the openshift-image-registry namespace.

  • The CAs must be PEM-encoded.


You can create a ConfigMap in the openshift-config namespace and use its name in AdditionalTrustedCA in the image.config.openshift.io resource to provide additional CAs that should be trusted when contacting external registries.

The key is the host name of a registry with the port for which this CA is to be trusted.

You can configure additional CAs with the following procedure.

  1. To configure an additional CA:

    $ oc create configmap registry-config --from-file=<external_registry_address>=ca.crt -n openshift-config
    $ oc edit image.config.openshift.io cluster
        name: registry-config
  2. Check your image inside the image-registry pod:

    $ oc rsh image-registry-xxxxx
    $ ls /etc/pki/ca-trust/source/anchors
    <external_registry_address> image-registry.openshift-image-registry.svc..5000 image-registry.openshift-image-registry.svc.cluster.local..5000
Image registry CA example
apiVersion: v1
kind: ConfigMap
  name: my-registry-ca
  registry.example.com: |
    -----END CERTIFICATE-----
  registry-with-port.example.com..5000: | (1)
    -----END CERTIFICATE-----
1 If the registry has the port, such as registry-with-port.example.com:5000, : should be replaced with ...

Configuring a secret for the Image Registry Operator

In addition to the configs.imageregistry.operator.openshift.io and ConfigMap resources, configuration is provided to the Operator by a separate secret resource located within the openshift-image-registry namespace.

The image-registry-private-configuration-user secret provides credentials needed for storage access and management. It overrides the default credentials used by the Operator, if default credentials were found.

  • Create an OpenShift Container Platform secret that contains the required keys.

    $ oc create secret generic image-registry-private-configuration-user --from-file=KEY1=value1 --from-literal=KEY2=value2 --namespace openshift-image-registry