// Module included in the following assemblies:
//
// * openshift_images/image-configuration-hcp.adoc

:_mod-docs-content-type: CONCEPT
[id="images-registry-mirroring_{context}"]
=  Image registry mirroring for {product-title}

[role="_abstract"]
You can configure an existing {product-title} cluster to pull images from a mirrored registry by using the `ImageDigestMirrorSet (IDMS)` object.

[IMPORTANT]
====
The image mirror configuration feature operates exclusively with image references by digest, meaning that image mirroring will only activate when an image is pulled using its unique and immutable ID. Any image references using a mutable tag are currently not supported by this functionality.
====

IDMS defines a set of cluster-wide policies for registry mirroring that makes image downloads faster, more reliable and more secure. It works by intercepting any image pull request that identifies an image by its unique, content-addressable digest. Based on these policies, the IDMS transparently redirects the pull operation from its specified source registry to one or more designated mirror registries. For the developer, this means their request (still pointing to the original source) is automatically fulfilled by a faster, closer mirror, significantly improving deployment speed without requiring any changes to their workflow.

.Prerequisites
To configure an existing {product-title} cluster to pull images from a mirrored registry by using the `ImageDigestMirrorSet (IDMS)` object, you must meet the following prerequisites:

** You have installed and configured the latest {rosa-cli-first} on your installation host.
** You have installed a {product-title} cluster.
** The {product-title} cluster must be in a **Ready** state to create, edit, list, or delete image mirrors.
** You have access to the mirror registries you want to configure.
** You have the required IAM permissions to manage cluster configurations. For more information, see "About IAM resources".

The benefits of configuring your {product-title} cluster to pull images from a mirrored registry using IDMS include:

** *Enhanced Security*: By forcing image pulls from a private, mirrored registry, you can scan and approve all images for vulnerabilities before they ever enter your cluster.

** *Improved Cluster Reliability*: A local mirror guarantees stable and predictable cluster performance by eliminating reliance on public internet pathways.

** *Guaranteed Image Consistency*: IDMS uses image digests to reference images, which ensures that every node in the cluster pulls the same version of an image, preventing inconsistencies which could lead to deployment failures.
