// Module included in the following assemblies:
//
// * machine-configuration/mco-update-boot-skew-mgmt.adoc

:_mod-docs-content-type: PROCEDURE
[id="mco-update-boot-skew-mgmt-configuring_{context}"]
= Configuring boot image skew enforcement

[role="_abstract"]
You can configure the current boot image skew enforcement mode that the Machine Config Operator (MCO) uses. By configuring the boot image skew enforcement mode, you can determine if the boot image version in the `MachineConfiguration` object is updated automatically or manually. 

Alternatively, you can disable boot image skew enforcement by setting the `mode` to `None`. When disabled, the MCO does not monitor for boot image skew, and older boot images could be used, possibly introducing issues when scaling new nodes.

In {product-title} 4.22, the automatic mode is available only for {aws-short}, {gcp-short}, {azure-short}, and {vmw-short} clusters and is the default for these platforms. If you modify a cluster from the automatic mode to the manual or none mode, you can revert a cluster back to automatic mode only by removing the `bootImageSkewEnforcement` stanza from the `MachineConfiguration` object.

All other platforms default to manual mode with the {product-title} version set as the boot image version in the `MachineConfiguration` object. In manual mode, you are expected to manually update the `MachineConfiguration` object with new boot image version whenever you update the boot image. 

.Procedure

. For manual mode, you can obtain the current boot image on a node by using the following command:
+
[source,terminal]
----
$ oc debug node/<new-node> -- chroot /host cat /sysroot/.coreos-aleph-version.json
----
+
.Example output
[source,terminal]
----
# ...
    "ref": "docker://ostree-image-signed:oci-archive:/rhcos-9.6.20251023-0-ostree.x86_64.ociarchive",
    "version": "9.6.20251023-0"
----
+
You should use the newest node on the cluster, because the boot image might have been updated after the older nodes were created. Ideally, test the newest node from each machine set and use the oldest boot image among them.

. Specify the boot image skew enforcement mode and set the boot image version as needed:
+
[source,yaml]
----
apiVersion: operator.openshift.io/v1
kind: MachineConfiguration
metadata:
  name: cluster
spec:
# ...
  bootImageSkewEnforcement:
    mode: Manual
    manual:
      mode: RHCOSVersion
      rhcosVersion: 9.6.20251023-0
# ...
----
+
where:

`spec.bootImageSkewEnforcement.mode`:: Specifies the boot image enforcement mode, one of the following values:
+
--
* `Manual`. Specifies that boot image skew management is in manual mode. You must specify the `spec.bootImageSkewEnforcement.manual` parameters.
* `None`. Specifies that boot image skew management is disabled. You do not need to specify the `spec.bootImageSkewEnforcement.manual` parameters.
--

`spec.bootImageSkewEnforcement.manual.mode`:: Specifies the version you want to represent the current boot image, either `OCPVersion` or `RHCOSVersion`. You must include one of the following parameters:
+
--
** For `RHCOSVersion`, use `spec.bootImageSkewEnforcement.manual.rhcosVersion` to specify the {op-system} version that is being used as a boot image in the `[major].[minor].[datestamp(YYYYMMDD)]-[buildnumber]` or `[major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]` format. This field must be between 14 and 21 characters.
** For `OCPVersion`, use `spec.bootImageSkewEnforcement.manual.ocpVersion` to specify the {product-title} version associated with the boot image that is being used in the `x.y.z` format. This field must be between 5 and 10 characters.
--
