--- title: "Configure use of your image registry" description: "Configure Calico Open Source to pull operator and component images from a public or private container registry, including air-gapped and constrained networks." product: "Calico Open Source" version: "3.32 (latest)" section: "Operations" canonical_url: "https://docs.tigera.io/calico/latest/operations/image-options/alternate-registry" --- # Configure use of your image registry ## Big picture Configure Calico to pull images from a registry (public or private). ## Value In many deployments, installing Calico in clusters from third-party private repos is not an option. Calico offers these public and private registry options, which can be used in any combination: - **Install from a registry** for use cases like air-gapped clusters, or clusters with bandwidth or security constraints - **Install from an image path in a registry** if you have pulled Calico images to a sub path in your registry - [Install images by registry digest](https://docs.tigera.io/calico/latest/operations/image-options/imageset.md) ## Concepts A **container image registry** (often known as a **registry**), is a service where you can push, pull, and store container images. In Kubernetes, a registry is considered *private* if it is not publicly available. A **private registry** requires an **image pull secret**. An **image pull secret** provides authentication for an image registry; this allows you to control access to certain images or give access to higher pull rate limits (like with DockerHub). An **image path** is a directory in a registry that contains images required to install Calico. ## Before you begin **Required** - Calico is managed by the operator - Configure pull access to your registry - If you are using a private registry that requires user authentication, ensure that an image pull secret is configured for your registry in the tigera-operator namespace. Set the environment variable, `REGISTRY_PULL_SECRET` to the secret name. For help, see `imagePullSecrets` and `registry` fields, in [Installation resource reference](https://docs.tigera.io/calico/latest/reference/installation/api.md). - Use the [Crane command](https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md) to manage the Calico for Windows images, as using `docker pull` commands for these images may not work depending on the operating system and version in which the commands are run. ## How to The following examples show the path format for public and private registry, `$REGISTRY/`. If you are using an image path, substitute the format: `$REGISTRY/$IMAGE_PATH/`. ### Push Calico images to your registry To install images from your registry, you must first pull the images from Tigera's registry, retag them with your own registry, and then push the newly-tagged images to your own registry. Use the `crane cp` command instead of pulling+retagging+pushing on the Calico for Windows images (`node-windows` and `cni-windows`). 1. Use the following commands to pull the required Calico images. 2. ```bash docker pull quay.io/tigera/operator:v1.42.3 docker pull quay.io/calico/node:v3.32.1 docker pull quay.io/calico/cni:v3.32.1 docker pull quay.io/calico/apiserver:v3.32.1 docker pull quay.io/calico/kube-controllers:v3.32.1 docker pull quay.io/calico/envoy-gateway:v3.32.1 docker pull quay.io/calico/envoy-proxy:v3.32.1 docker pull quay.io/calico/envoy-ratelimit:v3.32.1 docker pull quay.io/calico/dikastes:v3.32.1 docker pull quay.io/calico/pod2daemon-flexvol:v3.32.1 docker pull quay.io/calico/key-cert-provisioner:v3.32.1 docker pull quay.io/calico/goldmane:v3.32.1 docker pull quay.io/calico/whisker:v3.32.1 docker pull quay.io/calico/whisker-backend:v3.32.1 ``` Retag the images with the name of your registry `$REGISTRY`. 3. ```bash docker tag quay.io/tigera/operator:v1.42.3 $REGISTRY/tigera/operator:v1.42.3 docker tag quay.io/calico/node:v3.32.1 $REGISTRY/calico/node:v3.32.1 docker tag quay.io/calico/cni:v3.32.1 $REGISTRY/calico/cni:v3.32.1 docker tag quay.io/calico/apiserver:v3.32.1 $REGISTRY/calico/apiserver:v3.32.1 docker tag quay.io/calico/kube-controllers:v3.32.1 $REGISTRY/calico/kube-controllers:v3.32.1 docker tag quay.io/calico/envoy-gateway:v3.32.1 $REGISTRY/calico/envoy-gateway:v3.32.1 docker tag quay.io/calico/envoy-proxy:v3.32.1 $REGISTRY/calico/envoy-proxy:v3.32.1 docker tag quay.io/calico/envoy-ratelimit:v3.32.1 $REGISTRY/calico/envoy-ratelimit:v3.32.1 docker tag quay.io/calico/dikastes:v3.32.1 $REGISTRY/calico/dikastes:v3.32.1 docker tag quay.io/calico/pod2daemon-flexvol:v3.32.1 $REGISTRY/calico/pod2daemon-flexvol:v3.32.1 docker tag quay.io/calico/key-cert-provisioner:v3.32.1 $REGISTRY/calico/key-cert-provisioner:v3.32.1 docker tag quay.io/calico/goldmane:v3.32.1 $REGISTRY/calico/goldmane:v3.32.1 docker tag quay.io/calico/whisker:v3.32.1 $REGISTRY/calico/whisker:v3.32.1 docker tag quay.io/calico/whisker-backend:v3.32.1 $REGISTRY/calico/whisker-backend:v3.32.1 ``` Push the images to your registry. 4. ```bash docker push $REGISTRY/tigera/operator:v1.42.3 docker push $REGISTRY/calico/node:v3.32.1 docker push $REGISTRY/calico/cni:v3.32.1 docker push $REGISTRY/calico/apiserver:v3.32.1 docker push $REGISTRY/calico/kube-controllers:v3.32.1 docker push $REGISTRY/calico/envoy-gateway:v3.32.1 docker push $REGISTRY/calico/envoy-proxy:v3.32.1 docker push $REGISTRY/calico/envoy-ratelimit:v3.32.1 docker push $REGISTRY/calico/dikastes:v3.32.1 docker push $REGISTRY/calico/pod2daemon-flexvol:v3.32.1 docker push $REGISTRY/calico/key-cert-provisioner:v3.32.1 docker push $REGISTRY/calico/goldmane:v3.32.1 docker push $REGISTRY/calico/whisker:v3.32.1 docker push $REGISTRY/calico/whisker-backend:v3.32.1 ``` Use `crane cp` to copy the Windows images to your private registry. For hybrid Linux + Windows clusters, use `crane cp` on the following Windows images to copy them to your private registry. ```bash crane cp quay.io/calico/node-windows:v3.32.1 $REGISTRY/calico/node-windows:v3.32.1 crane cp quay.io/calico/cni-windows:v3.32.1 $REGISTRY/calico/cni-windows:v3.32.1 ``` ### Run the operator using images from your registry Before applying `tigera-operator.yaml`, modify registry references to use your custom registry: **For OpenShift** Download all manifests first, then modify the following: ```bash sed -ie "s?quay.io?$REGISTRY?g" manifests/02-tigera-operator.yaml ``` **For all other platforms** ```bash sed -ie "s?quay.io?$REGISTRY?g" tigera-operator.yaml ``` Next, if you are implementing user authentication to access a private registry, add the image pull secret for your `registry` to the secret `tigera-pull-secret`. ```bash sed -ie "/serviceAccountName: tigera-operator/a \ imagePullSecrets:\n\ - name: $REGISTRY_PULL_SECRET" tigera-operator.yaml ``` ### Configure the operator to use images Set the `spec.registry` field of your Installation resource to the name of your custom registry. For example: ```yaml apiVersion: operator.tigera.io/v1 kind: Installation metadata: name: default spec: variant: Calico imagePullSecrets: - name: tigera-pull-secret registry: myregistry.com ```