// Module included in the following assemblies:
//
// * machine-configuration/mco-update-boot-images.adoc
// * nodes/nodes/nodes-update-boot-images.adoc

:_mod-docs-content-type: PROCEDURE
[id="mco-update-boot-images-disable_{context}"]
= Disabling boot image management

[role="_abstract"]
You can disable the boot image management feature so that the Machine Config Operator (MCO) no longer manages or updates the boot image in the affected machine sets. For example, you could disable this feature for the worker nodes in order to use a custom boot image that you do not want changed.

[NOTE]
====
If you are updating an {azure-first} or {vmw-first} cluster from {product-title} 4.21 to 4.22, and you have not configured the `managedBootImages` parameter, the update is blocked with the message: `This cluster is Azure or vSphere but lacks a boot image configuration`. The update is intentionally blocked on {azure-short} or {vmw-short} clusters in order to alert you that the default boot image management behavior is changing between version 4.21 and 4.22 in order to enable boot images management by default on those platforms.

To allow the update, perform one of the following tasks:

* If you want to allow the feature to be enabled, acknowledge that you are aware of the change in the default behavior by patching the `admin-acks` config map by running the following command:
+
[source,terminal]
----
$ oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-4.21-boot-image-opt-out-in-4.22":"true"}}' --type=merge
----

* If you do not want the boot image management feature enabled, explicitly disable the feature for worker machine sets by using the following procedure.
====

You disable the boot image management feature for the control plane or worker machine sets in your cluster by editing the `MachineConfiguration` object.

[NOTE]
====
include::snippets/mco-update-boot-images-intro.adoc[]
====

Disabling this feature does not rollback the nodes or machine sets to the originally-installed boot image. The machine sets retain the boot image version that was present when the feature was disabled and is not updated if the cluster is upgraded to a new {product-title} version in the future. This feature has no effect on existing nodes.

If boot image management is disabled, you must update the boot image version that is used by the boot image skew enforcement feature to ensure that the boot image is current for your cluster. For more information, see "Boot image skew enforcement".

After disabling the feature, you can re-enable the feature at any time. For more information, see "Enabling updated boot images".

.Procedure

. Edit the `MachineConfiguration` object, named `cluster`, by using the following command::
+
[source,terminal]
----
$ oc edit MachineConfiguration cluster
----

. Disable the feature for some or all of your machine sets by making one or both of the following changes:

* Disable the feature for nodes in the worker machine sets by adding the following parameters:
+
[source,yaml]
----
apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
spec:
# ...
  managedBootImages:
    machineManagers:
    - apiGroup: machine.openshift.io
      resource: machinesets
      selection:
        mode: None
----
+
--
where:

`spec.managedBootImages`:: Specifies the parameters for the boot image management feature.

`spec.managedBootImages.machineManagers.apiGroup`:: Specifies the API group. This must be `machine.openshift.io`. 

`spec.managedBootImages.machineManagers.resource`:: Specifies that the `selection.mode` parameter applies to worker nodes when a value of `machinesets` is set.

`spec.managedBootImages.machineManagers.selection.mode`:: When `None`, specifies that the feature is disabled for the specified machine sets.
--

* Disable the feature for nodes in the control plane machine sets by adding the following parameters:
+
[source,yaml]
----
apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
spec:
# ...
  managedBootImages:
    machineManagers:
    - apiGroup: machine.openshift.io
      resource: controlplanemachinesets
      selection:
        mode: None
----
+
--
where:

`spec.managedBootImages`:: Specifies the parameters for the boot image management feature.

`spec.managedBootImages.machineManagers.apiGroup`:: Specifies the API group. This must be `machine.openshift.io`. 

`spec.managedBootImages.machineManagers.resource`:: Specifies that the `selection.mode` parameter applies to control plane nodes when a value of `controlplanemachinesets` is set.

`spec.managedBootImages.machineManagers.selection.mode`:: When `None`, specifies that the feature is disabled for the specified machine sets.
--

////
Hiding per djoshy https://github.com/openshift/openshift-docs/pull/93065#pullrequestreview-2844549815
* Optional: Disable the default behavior for specific machine sets:
+
[source,yaml]
----
apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
spec:
# ...
  managedBootImages:
    machineManagers:
    - apiGroup: machine.openshift.io
      resource: machinesets
      selection:
        mode: Partial
        partial:
          machineResourceSelector:
            matchLabels:
              region: "east"
----
+
where:

`spec.managedBootImages`:: Specifies the configuration of the boot image management feature.
`spec.managedBootImages.machineManagers.apiGroup`:: Specifies an API group. This must be `machine.openshift.io`.
`spec.managedBootImages.machineManagers.resource`:: Specifies the resource within the specified API group to apply the change. This must be `machinesets`.
`spec.managedBootImages.machineManagers.selection.mode`:: Specifies that the feature is disabled for specific machine sets.
`spec.managedBootImages.machineManagers.selection.partial.machineResourceSelector`:: Specifies that the feature is enabled only for machine sets with these labels. The feature is disabled for any machine set that does not contain the listed labels. 
////

.Verification

* View the current state of the boot image management feature by using the following command to view the machine configuration object:
+
[source,terminal]
----
$ oc get machineconfiguration cluster -o yaml
----
+
.Example machine set with the boot image reference
[source,yaml]
----
kind: MachineConfiguration
metadata:
  name: cluster
# ...
status:
  conditions:
  - lastTransitionTime: "2025-05-01T20:11:49Z"
    message: Reconciled 2 of 4 MAPI MachineSets | Reconciled 0 of 0 CAPI MachineSets
      | Reconciled 0 of 0 CAPI MachineDeployments
    reason: BootImageUpdateConfigurationUpdated
    status: "True"
    type: BootImageUpdateProgressing
  - lastTransitionTime: "2025-05-01T19:30:13Z"
    message: 0 Degraded MAPI MachineSets | 0 Degraded CAPI MachineSets | 0 CAPI MachineDeployments
    reason: BootImageUpdateConfigurationUpdated
    status: "False"
    type: BootImageUpdateDegraded
  managedBootImagesStatus:
    machineManagers:
    - apiGroup: machine.openshift.io
      resource: controlplanemachinesets
      selection:
        mode: None
    - apiGroup: machine.openshift.io
      resource: machinesets
      selection:
        mode: All
----
+
--
where:

`status.managedBootImagesStatus.machineManagers.selection.mode`:: Specifies that the boot image management feature is disabled when set to `None`. In this example, the boot image management feature is disabled for control plane machine sets and enabled for worker machine sets.
--
