{"id":77369,"date":"2026-07-04T03:38:32","date_gmt":"2026-07-04T03:38:32","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=77369"},"modified":"2026-07-04T03:38:35","modified_gmt":"2026-07-04T03:38:35","slug":"openshift-imagestreams-vs-normal-container-images-a-complete-hands-on-tutorial-using-httpd","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/openshift-imagestreams-vs-normal-container-images-a-complete-hands-on-tutorial-using-httpd\/","title":{"rendered":"OpenShift ImageStreams vs Normal Container Images: A Complete Hands-on Tutorial Using HTTPD"},"content":{"rendered":"\n
\n\n\n\n

1. Introduction<\/h2>\n\n\n\n

OpenShift can deploy applications in two major ways:<\/p>\n\n\n\n

    \n
  1. Using a normal container image directly<\/strong>, such as:<\/li>\n<\/ol>\n\n\n
    registry.access.redhat.com\/ubi9\/httpd-24:latest\ndocker.io\/library\/httpd:2.4\nquay.io\/some-org\/some-image:tag\n<\/code><\/span><\/pre>\n\n\n
      \n
    1. Using an OpenShift ImageStream<\/strong>, such as:<\/li>\n<\/ol>\n\n\n
      httpd<\/span>:latest<\/span>\nhttpd<\/span>:2.4-ubi9<\/span>\nmy-httpd<\/span>:latest<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
      Both approaches ultimately run containers in Pods, but they behave very differently in terms of tracking, automation, promotion, rollback, image lookup, image triggers, disconnected environments, and enterprise governance.<\/p>\n\n\n\n
      OpenShift ImageStreams are an OpenShift-native abstraction over container images. They do not<\/strong> store the image layers themselves; instead, they store image metadata, tags, digests, and references. Red Hat\u2019s current OpenShift image documentation says ImageStreams provide an abstraction for referencing container images, can manage image versions, and can automate builds and deployments.<\/p>\n\n\n\n
      Your cluster is:<\/p>\n\n\n
      Server<\/span> Version<\/span>: 4.21<\/span>.14<\/span>\nKubernetes<\/span> Version<\/span>: v1<\/span>.34<\/span>.6<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
      OpenShift 4.21 officially uses Kubernetes 1.34 with CRI-O runtime.<\/p>\n\n\n\n
      \n\n\n\n
      2. What Is a Normal Image Deployment in OpenShift?<\/h1>\n\n\n\n
      A normal image deployment means the Kubernetes Deployment directly references an external or internal container image pull spec.<\/p>\n\n\n\n
      Example:<\/p>\n\n\n
      containers:\n  - name: httpd\n    image: registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span><\/pre>\n\n\n
      In this model, OpenShift behaves much like Kubernetes. The Deployment points directly to the registry image.<\/p>\n\n\n\n
      Example command:<\/p>\n\n\n
      oc create deployment httpd-direct \\\n  --image=registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span><\/pre>\n\n\n
      This is simple and familiar, but OpenShift does not automatically give you the full ImageStream-based lifecycle unless you explicitly add ImageStreams or image triggers.<\/p>\n\n\n\n
      OpenShift\u2019s own CLI tutorial says the simplest way to deploy an application is to run a provided container image. In its example, oc new-app<\/code> deploys an image and creates resources such as a Deployment and Service.<\/p>\n\n\n\n
      Important nuance: oc new-app<\/code> is OpenShift-aware. Even when you provide an external image, oc new-app<\/code> can create an ImageStreamTag to track that image. Red Hat\u2019s tutorial output shows: \u201cAn image stream tag will be created \u2026 that will track this image.\u201d<\/p>\n\n\n\n
      So if you want a true no-ImageStream test<\/strong>, use oc create deployment<\/code>, oc apply -f deployment.yaml<\/code>, or kubectl create deployment<\/code>, not oc new-app<\/code>.<\/p>\n\n\n\n
      \n\n\n\n
      3. What Is an ImageStream Deployment?<\/h1>\n\n\n\n
      An ImageStream deployment means the Deployment refers to an OpenShift ImageStreamTag, not directly to the external registry.<\/p>\n\n\n\n
      Example:<\/p>\n\n\n
      containers<\/span>:\n  -<\/span> name<\/span>: httpd<\/span>\n    image<\/span>: httpd<\/span>:latest<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
      But for Kubernetes Deployments to resolve httpd:latest<\/code> as an OpenShift ImageStreamTag, you must enable image lookup using:<\/p>\n\n\n
      oc set<\/span> image-lookup\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Red Hat\u2019s current docs say Kubernetes resources can use ImageStreams when the ImageStream is in the same project and referenced by a single-segment value such as ruby:2.5<\/code>. They also say oc set image-lookup<\/code> can enable ImageStream resolution either on a specific resource or on the ImageStream itself.<\/p>\n\n\n\n
      \n\n\n\n
      4. High-Level Comparison<\/h1>\n\n\n\n
      Feature<\/th>Normal Image Deployment<\/th>ImageStream Deployment<\/th><\/tr><\/thead>
      Image reference<\/td>Full registry path<\/td>ImageStreamTag such as httpd:latest<\/code><\/td><\/tr>
      Example<\/td>registry.access.redhat.com\/ubi9\/httpd-24:latest<\/code><\/td>httpd:latest<\/code><\/td><\/tr>
      OpenShift abstraction<\/td>No<\/td>Yes<\/td><\/tr>
      Tracks external image metadata<\/td>No, not by itself<\/td>Yes<\/td><\/tr>
      Can trigger builds\/deployments on tag changes<\/td>Not automatically<\/td>Yes, with ImageStream triggers<\/td><\/tr>
      Can promote tags like dev \u2192 test \u2192 prod<\/td>Manual registry\/tag work<\/td>Easy with oc tag<\/code><\/td><\/tr>
      Can rollback ImageStreamTag<\/td>Manual image digest change<\/td>Easier using ImageStream tag history<\/td><\/tr>
      Works like vanilla Kubernetes<\/td>Yes<\/td>OpenShift-specific<\/td><\/tr>
      Best for portability<\/td>Better<\/td>Less portable outside OpenShift<\/td><\/tr>
      Best for OpenShift CI\/CD<\/td>Basic<\/td>Strong<\/td><\/tr>
      Useful in disconnected environments<\/td>Possible but manual<\/td>Very useful with mirroring and samples<\/td><\/tr>
      Fine-grained image access through OpenShift objects<\/td>Limited<\/td>Stronger<\/td><\/tr>
      Stores image layers<\/td>Registry stores layers<\/td>ImageStream stores metadata, not layers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      OpenShift ImageStreams can point to images in the integrated registry, external registries such as registry.redhat.io<\/code> or quay.io<\/code>, or other ImageStreams in the cluster. Red Hat also documents that when a build or deployment references an ImageStreamTag, OpenShift queries the repository through that tag and uses the exact associated image ID.<\/p>\n\n\n\n
      \n\n\n\n
      5. Why ImageStreams Exist<\/h1>\n\n\n\n
      ImageStreams solve practical enterprise problems:<\/p>\n\n\n\n
        \n
      • Developers want to use short names like httpd:latest<\/code>.<\/li>\n\n\n\n
      • Platform teams want to control which external images are allowed.<\/li>\n\n\n\n
      • CI\/CD pipelines want image-change triggers.<\/li>\n\n\n\n
      • Security teams want better visibility into image references.<\/li>\n\n\n\n
      • Release teams want promotion flows such as dev<\/code>, qa<\/code>, stage<\/code>, and prod<\/code>.<\/li>\n\n\n\n
      • Disconnected clusters need a clean way to mirror and manage image references.<\/li>\n<\/ul>\n\n\n\n
        Red Hat lists several ImageStream benefits: tagging, rollback, triggering builds and deployments, periodic re-import, fine-grained image access control, team sharing, and keeping applications on a known-good image when the source image changes.<\/p>\n\n\n\n
        \n\n\n\n
        6. Lab Setup<\/h1>\n\n\n\n
        6.1 Confirm versions<\/h2>\n\n\n
        oc version\n<\/code><\/span><\/pre>\n\n\n
        Your current output:<\/p>\n\n\n
        Client<\/span> Version<\/span>: 4.18<\/span>.7<\/span>\nKustomize<\/span> Version<\/span>: v5<\/span>.4<\/span>.2<\/span>\nServer<\/span> Version<\/span>: 4.21<\/span>.14<\/span>\nKubernetes<\/span> Version<\/span>: v1<\/span>.34<\/span>.6<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        Recommended for this tutorial:<\/p>\n\n\n
        oc version\n<\/code><\/span><\/pre>\n\n\n
        Expected ideal state:<\/p>\n\n\n
        Client<\/span> Version<\/span>: 4.21<\/span>.x<\/span>\nServer<\/span> Version<\/span>: 4.21<\/span>.x<\/span>\nKubernetes<\/span> Version<\/span>: v1<\/span>.34<\/span>.x<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        Red Hat recommends using the oc<\/code> binary corresponding to the OpenShift server version if you want latest features and full command compatibility.<\/p>\n\n\n\n
        \n\n\n\n
        6.2 Create a project<\/h2>\n\n\n\n
        Do not test workloads in default<\/code>, openshift<\/code>, kube-system<\/code>, or other privileged system projects. Red Hat warns that default projects are reserved for core components, and functionality such as admission plugins, SCCs, quotas, and image reference resolution does not work normally in highly privileged projects.<\/p>\n\n\n\n
        Create a clean project:<\/p>\n\n\n
        oc new<\/span>-project httpd-image-demo\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check current project:<\/p>\n\n\n
        oc project\n<\/code><\/span><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        Using project \"httpd-image-demo\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        7. Check Existing HTTPD ImageStreams in OpenShift<\/h1>\n\n\n\n
        Many OpenShift clusters include sample ImageStreams in the openshift<\/code> namespace through the Cluster Samples Operator.<\/p>\n\n\n\n
        Check HTTPD sample ImageStream:<\/p>\n\n\n
        oc get<\/span> is -n openshift | grep -i httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Or:<\/p>\n\n\n
        oc get<\/span> imagestream httpd -n openshift\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check available tags:<\/p>\n\n\n
        oc describe is httpd -n openshift\n<\/code><\/span><\/pre>\n\n\n
        You may see tags such as:<\/p>\n\n\n
        2.4-ubi8<\/span>\n2.4-ubi9<\/span>\nlatest<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        The exact tags depend on your cluster, release, sample operator configuration, architecture, and network access.<\/p>\n\n\n\n
        The Cluster Samples Operator creates and manages sample ImageStreams and templates, including HTTPD, and its configuration can be Managed<\/code>, Unmanaged<\/code>, or Removed<\/code>.<\/p>\n\n\n\n
        Check Samples Operator:<\/p>\n\n\n
        oc<\/span> get<\/span> configs<\/span>.samples<\/span>.operator<\/span>.openshift<\/span>.io<\/span> cluster<\/span> -o<\/span> yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        Short status:<\/p>\n\n\n
        oc get configs.samples.operator.openshift.io cluster \\\n  -o jsonpath='{.spec.managementState}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        Managed\n<\/code><\/span><\/pre>\n\n\n
        If it says Removed<\/code>, sample ImageStreams might not exist.<\/p>\n\n\n\n
        \n\n\n\n
        8. Method 1 \u2014 Deploy HTTPD Using a Normal Image, Without ImageStream<\/h1>\n\n\n\n
        This is the Kubernetes-style deployment.<\/p>\n\n\n\n
        8.1 Create Deployment directly from image<\/h2>\n\n\n\n
        Use a Red Hat UBI HTTPD image:<\/p>\n\n\n
        oc create deployment httpd-direct \\\n  --image=registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span><\/pre>\n\n\n
        Check Deployment:<\/p>\n\n\n
        oc get<\/span> deploy httpd-direct\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check Pod:<\/p>\n\n\n
        oc get<\/span> pods -l app=httpd-direct\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Describe Pod:<\/p>\n\n\n
        oc describe pod -l app=httpd-direct\n<\/code><\/span><\/pre>\n\n\n
        Check exact image in Deployment:<\/p>\n\n\n
        oc get deploy httpd-direct \\\n  -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span><\/pre>\n\n\n
        This proves the Deployment is using the external registry image directly.<\/p>\n\n\n\n
        \n\n\n\n
        8.2 Expose HTTPD internally<\/h2>\n\n\n\n
        The UBI HTTPD image usually listens on port 8080<\/code>.<\/p>\n\n\n\n
        Create a Service:<\/p>\n\n\n
        oc expose deployment httpd-direct --port=8080\n<\/code><\/span><\/pre>\n\n\n
        Check Service:<\/p>\n\n\n
        oc get<\/span> svc httpd-direct\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Create a Route:<\/p>\n\n\n
        oc expose svc httpd-direct\n<\/code><\/span><\/pre>\n\n\n
        Check Route:<\/p>\n\n\n
        oc get<\/span> route httpd-direct\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Get URL:<\/p>\n\n\n
        oc get route httpd-direct \\\n  -o jsonpath='http:\/\/{.spec.host}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        Test:<\/p>\n\n\n
        curl -I \"$(oc get route httpd-direct -o jsonpath='http:\/\/{.spec.host}')\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        HTTP\/1.1 200<\/span> OK\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        8.3 Observe normal-image behavior<\/h2>\n\n\n\n
        Check image field:<\/p>\n\n\n
        oc get<\/span> deploy httpd-direct -o yaml | grep -A3 \"image:\"\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        image<\/span>: registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check if any ImageStream was created:<\/p>\n\n\n
        oc get<\/span> is\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        No resources found in httpd-image-demo namespace<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        That is the key point: this is a direct image deployment<\/strong>, not an ImageStream-based deployment.<\/p>\n\n\n\n
        \n\n\n\n
        9. Method 2 \u2014 Deploy HTTPD Using oc new-app<\/code><\/h1>\n\n\n\n
        This is a useful OpenShift shortcut, but understand the behavior carefully.<\/p>\n\n\n\n
        Run:<\/p>\n\n\n
        oc new<\/span>-app registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --name=httpd-newapp\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check resources:<\/p>\n\n\n
        oc get<\/span> all -l app=httpd-newapp\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check ImageStreams:<\/p>\n\n\n
        oc get<\/span> is\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        You may see:<\/p>\n\n\n
        NAME           IMAGE REPOSITORY   TAGS     UPDATED\nhttpd-newapp   ...                latest   ...\n<\/code><\/span><\/pre>\n\n\n
        This happens because oc new-app<\/code> is designed to generate OpenShift application objects and can create an ImageStreamTag to track the supplied image. Red Hat\u2019s CLI tutorial shows this exact behavior: when deploying a container image through oc new-app<\/code>, an ImageStreamTag is created to track that image.<\/p>\n\n\n\n
        So:<\/p>\n\n\n
        oc new<\/span>-app external-image\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        does not always mean \u201cwithout ImageStream.\u201d<\/strong><\/p>\n\n\n\n
        For a pure direct-image test, prefer:<\/p>\n\n\n
        oc create deployment\n<\/code><\/span><\/pre>\n\n\n
        or declarative YAML.<\/p>\n\n\n\n
        \n\n\n\n
        10. Method 3 \u2014 Create Your Own HTTPD ImageStream<\/h1>\n\n\n\n
        Now let us create an ImageStream manually and deploy from it.<\/p>\n\n\n\n
        10.1 Create\/import ImageStream from external HTTPD image<\/h2>\n\n\n
        oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check ImageStream:<\/p>\n\n\n
        oc get<\/span> is my-httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check ImageStreamTag:<\/p>\n\n\n
        oc get<\/span> istag my-httpd:latest\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Describe it:<\/p>\n\n\n
        oc describe is my-httpd\n<\/code><\/span><\/pre>\n\n\n
        Red Hat documents oc import-image <imagestreamtag> --from=<image> --confirm<\/code> as the command for importing an image into an ImageStream.<\/p>\n\n\n\n
        \n\n\n\n
        10.2 View the external image reference behind the ImageStream<\/h2>\n\n\n
        oc get<\/span> istag my-httpd:latest -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Useful JSONPath commands:<\/p>\n\n\n
        oc get istag my-httpd:latest \\\n  -o jsonpath='{.image.dockerImageReference}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n
        oc get istag my-httpd:latest \\\n  -o jsonpath='{.image.metadata.name}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n
        oc get istag my-httpd:latest \\\n  -o jsonpath='{.image.dockerImageMetadata.Architecture}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        This shows that the ImageStreamTag tracks image metadata and digest information.<\/p>\n\n\n\n
        \n\n\n\n
        11. Deploy HTTPD from ImageStream<\/h1>\n\n\n\n
        There are two ways.<\/p>\n\n\n\n
        \n\n\n\n
        11.1 Option A \u2014 Enable ImageStream lookup on the ImageStream<\/h2>\n\n\n\n
        Enable lookup:<\/p>\n\n\n
        oc set<\/span> image-lookup my-httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Check:<\/p>\n\n\n
        oc set<\/span> image-lookup imagestream --list\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected:<\/p>\n\n\n
        NAME       LOCAL\nmy-httpd   true<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Red Hat says enabling image lookup on the ImageStream sets ImageStream.spec.lookupPolicy.local<\/code> to true<\/code>, and then the behavior applies to all tags in that ImageStream.<\/p>\n\n\n\n
        Now create a Deployment using the short ImageStreamTag reference:<\/p>\n\n\n
        oc create deployment httpd-is \\\n  --image=my-httpd:latest\n<\/code><\/span><\/pre>\n\n\n
        Check what image the Deployment has:<\/p>\n\n\n
        oc get deploy httpd-is \\\n  -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        You might see either:<\/p>\n\n\n
        my-httpd<\/span>:latest<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        or a resolved pull spec, depending on when admission resolution happened and how the object was admitted.<\/p>\n\n\n\n
        Check Pod:<\/p>\n\n\n
        oc get<\/span> pods -l app=httpd-is\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Describe Pod:<\/p>\n\n\n
        oc describe pod -l app=httpd-is | grep -i \"Image:\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expose:<\/p>\n\n\n
        oc expose deployment httpd-is --port=8080\noc expose svc httpd-is\n<\/code><\/span><\/pre>\n\n\n
        Test:<\/p>\n\n\n
        curl -I \"$(oc get route httpd-is -o jsonpath='http:\/\/{.spec.host}')\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        11.2 Option B \u2014 Enable ImageStream lookup only on the Deployment<\/h2>\n\n\n\n
        Create Deployment:<\/p>\n\n\n
        oc create deployment httpd-is-specific \\\n  --image=my-httpd:latest\n<\/code><\/span><\/pre>\n\n\n
        Enable image lookup only for this Deployment:<\/p>\n\n\n
        oc set<\/span> image-lookup deploy\/httpd-is-specific\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Red Hat says you can enable image stream resolution on a specific resource; for a Deployment this sets the alpha.image.policy.openshift.io\/resolve-names<\/code> annotation.<\/p>\n\n\n\n
        Check annotation:<\/p>\n\n\n
        oc get<\/span> deploy httpd-is-specific -o yaml | grep -A5 \"annotations:\"\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expose:<\/p>\n\n\n
        oc expose deployment httpd-is-specific --port=8080\noc expose svc httpd-is-specific\n<\/code><\/span><\/pre>\n\n\n
        Test:<\/p>\n\n\n
        curl -I \"$(oc get route httpd-is-specific -o jsonpath='http:\/\/{.spec.host}')\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        12. ImageStreamTag Reference Types<\/h1>\n\n\n\n
        OpenShift supports several image reference styles.<\/p>\n\n\n\n
        Reference Type<\/th>Example<\/th>Meaning<\/th><\/tr><\/thead>
        Direct external image<\/td>registry.access.redhat.com\/ubi9\/httpd-24:latest<\/code><\/td>Pull directly from external registry<\/td><\/tr>
        ImageStreamTag<\/td>my-httpd:latest<\/code><\/td>Mutable tag in an ImageStream<\/td><\/tr>
        ImageStreamImage<\/td>my-httpd@sha256:<digest><\/code><\/td>Immutable image digest inside ImageStream<\/td><\/tr>
        DockerImage source<\/td>quay.io\/org\/app:tag<\/code><\/td>External registry pull spec<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        Red Hat documents that ImageStreamTag uses <image_stream_name>:<tag><\/code>, ImageStreamImage uses <image_stream_name>@<image_id><\/code>, and external DockerImage references use the normal registry pull specification.<\/p>\n\n\n\n
        \n\n\n\n
        13. Refreshing ImageStreams<\/h1>\n\n\n\n
        Refreshing is one of the biggest reasons ImageStreams exist.<\/p>\n\n\n\n
        There are two refresh styles:<\/p>\n\n\n\n
          \n
        1. Manual refresh<\/strong><\/li>\n\n\n\n
        2. Scheduled refresh<\/strong><\/li>\n<\/ol>\n\n\n\n
          \n\n\n\n
          13.1 Manual refresh<\/h2>\n\n\n\n
          Run:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Or with confirm if creating\/updating:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Check updated tag:<\/p>\n\n\n
          oc describe is my-httpd\n<\/code><\/span><\/pre>\n\n\n
          Check import events:<\/p>\n\n\n
          oc get<\/span> events --sort-by=.lastTimestamp | tail -20\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          13.2 Scheduled refresh using oc tag --scheduled<\/code><\/h2>\n\n\n\n
          Create a scheduled tracking tag:<\/p>\n\n\n
          oc tag registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  my-httpd:scheduled \\\n  --scheduled=true<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Check:<\/p>\n\n\n
          oc describe is my-httpd\n<\/code><\/span><\/pre>\n\n\n
          Red Hat documents --scheduled=true<\/code> for periodic refresh\/re-import, and the period is configured globally at the system level. In current docs, the example says the default cluster-wide period is 15 minutes.
          Remove scheduled behavior:<\/p>\n\n\n
          oc tag registry.access.redhat.com\/ubi9\/httpd-24:latest \\\n  my-httpd:scheduled\n<\/code><\/span><\/pre>\n\n\n
          Or delete the tag:<\/p>\n\n\n
          oc<\/span> tag<\/span> -d<\/span> my-httpd<\/span>:scheduled<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          14. Permanent Tags vs Tracking Tags<\/h1>\n\n\n\n
          OpenShift has two important ImageStream tag behaviors.<\/p>\n\n\n\n
          14.1 Permanent tag<\/h2>\n\n\n\n
          A permanent tag points to a specific image at a point in time.<\/p>\n\n\n
          oc<\/span> tag<\/span> my-httpd<\/span>:latest<\/span> my-httpd<\/span>:stable<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          Red Hat says the default oc tag<\/code> behavior creates a permanent tag pinned to an image ID. If the source later changes, the destination does not automatically change.<\/p>\n\n\n\n
          Use this for production-safe promotion:<\/p>\n\n\n
          oc<\/span> tag<\/span> my-httpd<\/span>:latest<\/span> my-httpd<\/span>:prod<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          14.2 Tracking tag<\/h2>\n\n\n\n
          A tracking tag follows another tag.<\/p>\n\n\n
          oc tag --alias=true<\/span> my-httpd:latest my-httpd:tracking\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Red Hat documents --alias=true<\/code> as a tracking tag, where the destination tag metadata updates when the source tag changes. It also notes that this tracking behavior works correctly within a single ImageStream.<\/p>\n\n\n\n
          Check:<\/p>\n\n\n
          oc describe is my-httpd\n<\/code><\/span><\/pre>\n\n\n
          \n\n\n\n
          15. Trigger Deployments When ImageStream Changes<\/h1>\n\n\n\n
          ImageStreams become powerful when a Deployment reacts to ImageStreamTag changes.<\/p>\n\n\n\n
          15.1 Create Deployment from ImageStream<\/h2>\n\n\n
          oc create deployment httpd-triggered \\\n  --image=my-httpd:latest\n<\/code><\/span><\/pre>\n\n\n
          Enable image lookup:<\/p>\n\n\n
          oc set<\/span> image-lookup deploy\/httpd-triggered\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Now add an image trigger:<\/p>\n\n\n
          oc set<\/span> triggers deploy\/httpd-triggered \\\n  --from-image=my-httpd:latest \\\n  -c httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          But your container name might not be httpd<\/code>. Check it first:<\/p>\n\n\n
          oc get deploy httpd-triggered \\\n  -o jsonpath='{.spec.template.spec.containers[*].name}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          If the container is named my-httpd<\/code>, use:<\/p>\n\n\n
          oc set<\/span> triggers deploy\/httpd-triggered \\\n  --from-image=my-httpd:latest \\\n  -c my-httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Red Hat\u2019s latest ImageStream trigger docs say Kubernetes resources do not have built-in trigger fields like OpenShift BuildConfigs and DeploymentConfigs, so OpenShift uses the image.openshift.io\/triggers<\/code> annotation. They also document oc set triggers deploy\/example --from-image=example:latest -c web<\/code> for Deployment image-change triggers.<\/p>\n\n\n\n
          Check triggers:<\/p>\n\n\n
          oc set<\/span> triggers deploy\/httpd-triggered\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Check annotation:<\/p>\n\n\n
          oc get<\/span> deploy httpd-triggered -o yaml | grep -A20 \"image.openshift.io\/triggers\"\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          15.2 Trigger a rollout by changing the ImageStreamTag<\/h2>\n\n\n\n
          Import another HTTPD image tag into the same ImageStreamTag.<\/p>\n\n\n\n
          Example:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Watch rollout:<\/p>\n\n\n
          oc rollout status deploy\/httpd-triggered\n<\/code><\/span><\/pre>\n\n\n
          Check new ReplicaSet:<\/p>\n\n\n
          oc get<\/span> rs -l app=httpd-triggered\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Check Deployment image:<\/p>\n\n\n
          oc get deploy httpd-triggered \\\n  -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          16. Normal Image Update vs ImageStream Update<\/h1>\n\n\n\n
          16.1 Normal image update<\/h2>\n\n\n\n
          With a direct image Deployment:<\/p>\n\n\n
          oc set<\/span> image deployment\/httpd-direct \\\n  httpd=registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          But check the container name first:<\/p>\n\n\n
          oc get deploy httpd-direct \\\n  -o jsonpath='{.spec.template.spec.containers[*].name}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Then:<\/p>\n\n\n
          oc set image deployment\/httpd-direct \\\n  <container-name<\/span>><\/span>=registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
          Rollout:<\/p>\n\n\n
          oc rollout status deployment\/httpd-direct\n<\/code><\/span><\/pre>\n\n\n
          This is manual.<\/p>\n\n\n\n
          \n\n\n\n
          16.2 ImageStream update<\/h2>\n\n\n\n
          With ImageStream:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          If triggers are configured, OpenShift can update the Deployment automatically.<\/p>\n\n\n\n
          Red Hat\u2019s ImageStream documentation explains that when a new image is added to a stream or a tag is modified, watching resources receive notifications and can react by starting a new build or deployment.<\/p>\n\n\n\n
          \n\n\n\n
          17. Rollback and Promotion<\/h1>\n\n\n\n
          17.1 Promotion using ImageStreams<\/h2>\n\n\n\n
          Create environment-style tags:<\/p>\n\n\n
          oc<\/span> tag<\/span> my-httpd<\/span>:latest<\/span> my-httpd<\/span>:dev<\/span>\noc<\/span> tag<\/span> my-httpd<\/span>:dev<\/span> my-httpd<\/span>:test<\/span>\noc<\/span> tag<\/span> my-httpd<\/span>:test<\/span> my-httpd<\/span>:prod<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          Deploy production from:<\/p>\n\n\n
          oc create deployment httpd-prod --image=my-httpd:prod\noc set<\/span> image-lookup deploy\/httpd-prod\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Expose:<\/p>\n\n\n
          oc expose deployment httpd-prod --port=8080\noc expose svc httpd-prod\n<\/code><\/span><\/pre>\n\n\n
          Now your production Deployment refers to the prod<\/code> ImageStreamTag.<\/p>\n\n\n\n
          \n\n\n\n
          17.2 Roll back prod to older known-good tag<\/h2>\n\n\n\n
          If you have a known-good tag:<\/p>\n\n\n
          oc<\/span> tag<\/span> my-httpd<\/span>:stable<\/span> my-httpd<\/span>:prod<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          Then trigger deployment:<\/p>\n\n\n
          oc rollout status deploy\/httpd-prod\n<\/code><\/span><\/pre>\n\n\n
          Or force rollout if needed:<\/p>\n\n\n
          oc rollout restart deploy\/httpd-prod\n<\/code><\/span><\/pre>\n\n\n
          ImageStreams help because you can promote and repoint tags without changing every application YAML.<\/p>\n\n\n\n
          \n\n\n\n
          18. ImageStream with External Image and Local Reference Policy<\/h1>\n\n\n\n
          You can tag an external image and tell OpenShift to use local pull-through behavior:<\/p>\n\n\n
          oc tag registry.access.redhat.com\/ubi9\/httpd-24:latest \\\n  my-httpd:local \\\n  --reference-policy=local\n<\/code><\/span><\/pre>\n\n\n
          Red Hat documents --reference-policy=local<\/code> as a way to instruct OpenShift to fetch the tagged image from the integrated registry, using pull-through behavior.<\/p>\n\n\n\n
          Check:<\/p>\n\n\n
          oc get<\/span> istag my-httpd:local -o yaml | grep -A10 referencePolicy\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          This is useful when you want OpenShift to control how images are pulled, especially in enterprise registry, network, or disconnected setups.<\/p>\n\n\n\n
          \n\n\n\n
          19. Private Registry with ImageStream<\/h1>\n\n\n\n
          If your HTTPD image is in a private registry, create a Docker config JSON secret.<\/p>\n\n\n
          oc create secret generic private-registry-secret \\\n  --from<\/span>-file=.dockerconfigjson=\/path\/<\/span>to\/config.json \\\n  --type=kubernetes.io\/dockerconfigjson\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Then import:<\/p>\n\n\n
          oc import<\/span>-image private-httpd:latest \\\n  --from<\/span>=private-registry.example.com\/team\/httpd:latest \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Red Hat documents creating a kubernetes.io\/dockerconfigjson<\/code> secret and then running oc import-image <imagestreamtag> --from=<image> --confirm<\/code> for importing ImageStreams from private registries.<\/p>\n\n\n\n
          \n\n\n\n
          20. Multi-Architecture ImageStreams<\/h1>\n\n\n\n
          Modern clusters often contain mixed architecture nodes, such as amd64<\/code>, arm64<\/code>, ppc64le<\/code>, or s390x<\/code>.<\/p>\n\n\n\n
          OpenShift 4.21 supports --import-mode<\/code> with oc import-image<\/code> and oc tag<\/code> for working with manifest lists. Red Hat documents two modes:<\/p>\n\n\n
          Legacy\nPreserveOriginal\n<\/code><\/span><\/pre>\n\n\n
          The docs say Legacy<\/code> imports a single sub-manifest, while PreserveOriginal<\/code> preserves the manifest list. They also note that the default import mode is Legacy<\/code>.<\/p>\n\n\n\n
          Import preserving multi-arch manifest list:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:multiarch \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --import<\/span>-mode='PreserveOriginal'<\/span> \\\n  --reference-policy=local \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Import legacy mode:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:legacy \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --import<\/span>-mode='Legacy'<\/span> \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Check:<\/p>\n\n\n
          oc describe is my-httpd\n<\/code><\/span><\/pre>\n\n\n
          \n\n\n\n
          21. OpenShift Sample HTTPD ImageStream<\/h1>\n\n\n\n
          Check the OpenShift-provided HTTPD ImageStream:<\/p>\n\n\n
          oc get<\/span> is httpd -n openshift\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Describe:<\/p>\n\n\n
          oc describe is httpd -n openshift\n<\/code><\/span><\/pre>\n\n\n
          Import\/tag it into your own project:<\/p>\n\n\n
          oc tag openshift\/httpd:latest local-httpd:latest\n<\/code><\/span><\/pre>\n\n\n
          Or choose a specific tag after checking:<\/p>\n\n\n
          oc describe is httpd -n openshift\n<\/code><\/span><\/pre>\n\n\n
          Example:<\/p>\n\n\n
          oc tag openshift\/httpd:2.4-ubi9 local-httpd:2.4-ubi9\n<\/code><\/span><\/pre>\n\n\n
          Enable lookup:<\/p>\n\n\n
          oc set<\/span> image-lookup local-httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Deploy:<\/p>\n\n\n
          oc create deployment httpd-from<\/span>-sample \\\n  --image=local-httpd:2.4<\/span>-ubi9\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Expose:<\/p>\n\n\n
          oc expose deployment httpd-from<\/span>-sample --port=8080<\/span>\noc expose svc httpd-from<\/span>-sample\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Test:<\/p>\n\n\n
          curl -I \"$(oc get route httpd-from-sample -o jsonpath='http:\/\/{.spec.host}')\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          The Cluster Samples Operator can manage sample ImageStreams, and Red Hat documents that the operator monitors ImageStreamTag imports and retries failed imports about every 15 minutes until the import succeeds or the configuration changes.<\/p>\n\n\n\n
          \n\n\n\n
          22. Full Side-by-Side Hands-on Test<\/h1>\n\n\n\n
          22.1 Clean project<\/h2>\n\n\n
          oc new<\/span>-project httpd-compare\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          22.2 Direct image deployment<\/h2>\n\n\n
          oc create deployment httpd-direct \\\n  --image=registry.access.redhat.com\/ubi9\/httpd-24:latest\n\noc expose deployment httpd-direct --port=8080\noc expose svc httpd-direct\n<\/code><\/span><\/pre>\n\n\n
          Verify:<\/p>\n\n\n
          oc get deploy httpd-direct \\\n  -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}'<\/span>\n\noc get is\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Expected:<\/p>\n\n\n
          registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest\nNo resources found in httpd-compare namespace<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          22.3 ImageStream deployment<\/h2>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n\noc set<\/span> image-lookup my-httpd\n\noc create deployment httpd-is \\\n  --image=my-httpd:latest\n\noc expose deployment httpd-is --port=8080\noc expose svc httpd-is\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Verify:<\/p>\n\n\n
          oc get is\noc describe is my-httpd\n\noc get deploy httpd-is \\\n  -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          22.4 Add trigger to ImageStream deployment<\/h2>\n\n\n\n
          Find container name:<\/p>\n\n\n
          oc get deploy httpd-is \\\n  -o jsonpath='{.spec.template.spec.containers[*].name}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Add trigger:<\/p>\n\n\n
          oc set<\/span> triggers deploy\/httpd-is \\\n  --from-image=my-httpd:latest \\\n  -c my-httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          If container name differs, replace my-httpd<\/code>.<\/p>\n\n\n\n
          Check:<\/p>\n\n\n
          oc set<\/span> triggers deploy\/httpd-is\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          22.5 Refresh ImageStream<\/h2>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Watch:<\/p>\n\n\n
          oc rollout status deploy\/httpd-is\n<\/code><\/span><\/pre>\n\n\n
          \n\n\n\n
          23. Troubleshooting<\/h1>\n\n\n\n
          Problem 1: ImagePullBackOff<\/code><\/h2>\n\n\n\n
          Check:<\/p>\n\n\n
          oc describe pod <pod-name<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
          Common causes:<\/p>\n\n\n
          Wrong image name\nRegistry requires authentication\nCluster cannot reach registry\nImage is blocked by image policy\nPull secret missing\nArchitecture mismatch\n<\/code><\/span><\/pre>\n\n\n
          \n\n\n\n
          Problem 2: ImageStream not found<\/h2>\n\n\n
          oc get<\/span> is\noc get<\/span> is -n openshift\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          If using sample ImageStreams:<\/p>\n\n\n
          oc<\/span> get<\/span> configs<\/span>.samples<\/span>.operator<\/span>.openshift<\/span>.io<\/span> cluster<\/span> -o<\/span> yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          Problem 3: Short image name does not resolve<\/h2>\n\n\n\n
          Example failure:<\/p>\n\n\n
          oc create deployment test --image=my-httpd:latest\n<\/code><\/span><\/pre>\n\n\n
          Fix:<\/p>\n\n\n
          oc set<\/span> image-lookup my-httpd\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Or:<\/p>\n\n\n
          oc set<\/span> image-lookup deploy\/test\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          OpenShift requires ImageStream lookup to resolve short ImageStream references in Kubernetes resources.<\/p>\n\n\n\n
          \n\n\n\n
          Problem 4: Trigger not working<\/h2>\n\n\n\n
          Check trigger annotation:<\/p>\n\n\n
          oc get<\/span> deploy httpd-is -o yaml | grep -A20 image.openshift.io\/triggers\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Check container name:<\/p>\n\n\n
          oc get deploy httpd-is \\\n  -o jsonpath='{.spec.template.spec.containers[*].name}{\"\\n\"}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Recreate trigger:<\/p>\n\n\n
          oc set triggers deploy\/httpd-is \\\n  --from-image=my-httpd:latest \\\n  -c <container-name<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          Problem 5: oc<\/code> command behaves strangely<\/h2>\n\n\n\n
          Your client is 4.18.7 and server is 4.21.14. Install the matching 4.21 oc<\/code> client.<\/p>\n\n\n\n
          Red Hat\u2019s 4.21 docs warn that if an earlier oc<\/code> is installed, you might not be able to complete all OpenShift 4.21 commands.<\/p>\n\n\n\n
          \n\n\n\n
          24. When to Use Normal Images<\/h1>\n\n\n\n
          Use direct images when:<\/p>\n\n\n
          You want Kubernetes portability.\nYou are deploying a simple app.\nYou do<\/span> not need ImageStream triggers.\nYou do<\/span> not need OpenShift-native promotion.\nYou manage images fully outside OpenShift.\nYour CI\/CD already pins images by digest.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Example production-style direct image:<\/p>\n\n\n
          apiVersion: apps\/v1\nkind: Deployment\nmetadata:\n  name: httpd-direct-prod\nspec:\n  replicas: 2\n  selector:\n    matchLabels:\n      app: httpd-direct-prod\n  template:\n    metadata:\n      labels:\n        app: httpd-direct-prod\n    spec:\n      containers:\n        - name: httpd\n          image: registry.access.redhat.com\/ubi9\/httpd-24@sha256:<digest<\/span>><\/span>\n          ports:\n            - containerPort: 8080\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
          For production, prefer immutable digests over mutable latest<\/code> tags.<\/p>\n\n\n\n
          \n\n\n\n
          25. When to Use ImageStreams<\/h1>\n\n\n\n
          Use ImageStreams when:<\/p>\n\n\n
          You are building OpenShift-native CI\/CD.\nYou want automatic deployment triggers.\nYou want dev\/test\/prod image promotion.\nYou want ImageStreamTag rollback.\nYou want to abstract<\/span> external registry locations.\nYou want to support disconnected or<\/span> mirrored environments.\nYou want better OpenShift RBAC around image references.\nYou use<\/span> BuildConfigs<\/span>, S2I<\/span>, or<\/span> OpenShift<\/span> image<\/span> workflows<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Red Hat specifically lists ImageStream advantages around triggers, periodic re-import, known-good image behavior, access control, and image sharing.<\/p>\n\n\n\n
          \n\n\n\n
          26. Recommended Enterprise Pattern<\/h1>\n\n\n\n
          For enterprise OpenShift:<\/p>\n\n\n
          Do<\/span> not deploy random external images directly in production.\nImport approved base images into controlled ImageStreams.\nUse<\/span> ImageStreamTags<\/span> such<\/span> as<\/span> dev<\/span>, qa<\/span>, stage<\/span>, prod<\/span>.\nUse<\/span> triggers<\/span> only<\/span> where<\/span> automatic<\/span> rollout<\/span> is<\/span> desired<\/span>.\nPin<\/span> production<\/span> releases<\/span> to<\/span> stable<\/span> or<\/span> digest<\/span>-backed<\/span> tags<\/span>.\nUse<\/span> scheduled<\/span> imports<\/span> for<\/span> approved<\/span> base<\/span> images<\/span>.\nUse<\/span> registry<\/span> policies<\/span> and<\/span> mirroring<\/span> for<\/span> disconnected<\/span> or<\/span> secured<\/span> clusters<\/span>.\nUse<\/span> matching<\/span> oc<\/span> client<\/span> version<\/span> for<\/span> your<\/span> OpenShift<\/span> server<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          Recommended flow:<\/p>\n\n\n
          External Registry\n      |\n      v\nApproved ImageStream: my-httpd:latest\n      |\n      v\nPromotion: my-httpd:dev -> my-httpd:test -> my-httpd:prod\n      |\n      v\nDeployment uses my-httpd:prod\n<\/code><\/span><\/pre>\n\n\n
          \n\n\n\n
          27. Final Summary<\/h1>\n\n\n\n
          A normal image deployment<\/strong> is simple and Kubernetes-portable:<\/p>\n\n\n
          oc create deployment httpd-direct \\\n  --image=registry.access.redhat.com\/ubi9\/httpd-24:latest\n<\/code><\/span><\/pre>\n\n\n
          An ImageStream deployment<\/strong> is OpenShift-native and better for enterprise image lifecycle management:<\/p>\n\n\n
          oc import<\/span>-image my-httpd:latest \\\n  --from<\/span>=registry.access.redhat.com\/ubi9\/httpd-24<\/span>:latest \\\n  --confirm\n\noc set<\/span> image-lookup my-httpd\n\noc create deployment httpd-is \\\n  --image=my-httpd:latest\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          The practical difference:<\/p>\n\n\n
          Normal image = direct pull from<\/span> registry.\nImageStream = OpenShift-managed image reference, metadata, tags, imports, triggers, promotion, and governance.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          The best one-line answer:<\/p>\n\n\n
          Use<\/span> direct<\/span> images<\/span> for<\/span> simple<\/span> Kubernetes<\/span>-style<\/span> deployments<\/span>; use<\/span> ImageStreams<\/span> when<\/span> you<\/span> want<\/span> OpenShift<\/span>-native<\/span> image<\/span> tracking<\/span>, promotion<\/span>, triggers<\/span>, refresh<\/span>, rollback<\/span>, and<\/span> enterprise<\/span> control<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
          \n\n\n\n
          28. Cleanup<\/h1>\n\n\n
          oc project httpd-image-demo\noc delete<\/span> project httpd-image-demo\n\noc project httpd-compare\noc delete<\/span> project httpd-compare\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>","protected":false},"excerpt":{"rendered":"
          1. Introduction OpenShift can deploy applications in two major ways: Both approaches ultimately run containers in Pods, but they behave very differently in terms of tracking, automation,… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-77369","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=77369"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77369\/revisions"}],"predecessor-version":[{"id":77370,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77369\/revisions\/77370"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=77369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=77369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=77369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}