:_mod-docs-content-type: PROCEDURE
[id="hcp-ibm-z-adding-registry-ca-hostedcluster_{context}"]
= Adding the registry certificate authority to the hosted cluster

[role="_abstract"]
When you are deploying {hcp} on {ibm-z-title} in a disconnected environment, include the `additional-trust-bundle` and `image-content-sources` resources. The hosted cluster uses those resources to inject the certificate authority into the data plane compute nodes so that the images are pulled from the registry.

.Procedure

. Create the `icsp.yaml` file with the `image-content-sources` information.
+
The `image-content-sources` information is available in the `ImageContentSourcePolicy` YAML file that is generated after you mirror the images by using `oc-mirror`.
+
.Example ImageContentSourcePolicy file
[source,terminal]
----
# cat icsp.yaml
- mirrors:
  - <mirror_registry>/openshift/release
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
- mirrors:
  - <mirror_registry>/openshift/release-images
  source: quay.io/openshift-release-dev/ocp-release
----

. Create a hosted cluster and provide the `additional-trust-bundle` certificate to update the compute nodes with the certificates as in the following example:
+
[source,terminal]
----
$ hcp create cluster agent \
    --name=my-hosted-cluster \
    --pull-secret=/user/name/pullsecret \
    --agent-namespace=clusters-hosted \
    --base-domain=example.com \
    --api-server-address=api.my-hosted-cluster.example.com \
    --etcd-storage-class=lvm-storageclass \
    --ssh-key ~/.ssh/id_rsa.pub \
    --namespace <hosted_cluster_namespace> \
    --control-plane-availability-policy SingleReplica \
    --release-image=quay.io/openshift-release-dev/ocp-release:4.22.0-multi \
    --additional-trust-bundle <path for cert> \
    --image-content-sources icsp.yaml
----
+
* `--name` specifies the name of your hosted cluster.
* `--pull-secret` specifies the path to your pull secret.
* `--agent-namespace` specifies the name of the hosted control plane namespace.
* `--base-domain` specifies the name of your base domain.
* `--etcd-storage-class` specifies the etcd storage class name.
* `--ssh-key` specifies the path to your SSH public key. The default file path is `~/.ssh/id_rsa.pub`.
* `--namespace` specifies the name of the hosted cluster namespace.
* `--release-image` specifies the supported {product-title} version that you want to use.
* `--additional-trust-bundle` specifies the path to the Certificate Authority of the mirror registry.