//Modules included in the following assemblies
//
// * openshift_images/image-configuration.adoc

:_mod-docs-content-type: PROCEDURE
[id="images-configuration-blocked-payload_{context}"]
= Blocking a payload registry

[role="_abstract"]
In a mirroring configuration, you can block upstream payload registries in a disconnected environment by using a `ImageContentSourcePolicy` (ICSP) object.
//oc mirror v2 does not support ICSP; this content needs an update or a note
The following example procedure demonstrates how to block the `quay.io/openshift-payload` payload registry.

.Procedure

. Create the mirror configuration using an `ImageContentSourcePolicy` (ICSP) object to mirror the payload to a registry in your instance. The following example ICSP file mirrors the payload `internal-mirror.io/openshift-payload`:
+
[source,yaml]
----
apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: my-icsp
spec:
  repositoryDigestMirrors:
  - mirrors:
    - internal-mirror.io/openshift-payload
    source: quay.io/openshift-payload
----

. After the object deploys onto your nodes, verify that the mirror configuration is set by checking the `/etc/containers/registries.conf` custom resource (CR):
+
.Example output
[source,terminal]
----
[[registry]]
  prefix = ""
  location = "quay.io/openshift-payload"
  mirror-by-digest-only = true

[[registry.mirror]]
  location = "internal-mirror.io/openshift-payload"
----

. Use the following command to edit the `image.config.openshift.io` CR:
+
[source,terminal]
----
$ oc edit image.config.openshift.io cluster
----

. To block the payload registry, add the following configuration to the `image.config.openshift.io` CR:
+
[source,yaml]
----
spec:
  registrySources:
    blockedRegistries:
     - quay.io/openshift-payload
----

.Verification
//can we run a command such as an oc debug or oc edit to look at this file?
* Verify that the upstream payload registry is blocked by checking the `/etc/containers/registries.conf` file on the node.
+
.Example `/etc/containers/registries.conf` file
[source,terminal]
----
[[registry]]
  prefix = ""
  location = "quay.io/openshift-payload"
  blocked = true
  mirror-by-digest-only = true

[[registry.mirror]]
  location = "internal-mirror.io/openshift-payload"
----
