In OpenShift, an ImageStream is a resource used to manage and track container images within the cluster.

Why Use an ImageStream?

  • Tracks Image Changes – OpenShift can automatically detect when a new version of an image is pushed to a registry.
  • Manages Images Internally – Instead of referencing an external image directly, an ImageStream allows for greater flexibility and security.
  • Integrates with CI/CD – When an image is updated, OpenShift can automatically trigger deployments.

How to Create an ImageStream?

You can manually create an ImageStream using YAML or via the oc command. The following example creates an ImageStream for Nginx in OpenShift:

apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  name: nginx
  namespace: my-project
spec:
  lookupPolicy:
    local: false

Then, you can link this ImageStream to a specific image in an external registry:

oc tag docker.io/nginx:latest my-project/nginx:latest

Checking ImageStreams in OpenShift :

To list available ImageStreams in a namespace, use:

oc get imagestream -n my-project

Using an ImageStream in a Deployment:

Instead of specifying a direct image reference in a DeploymentConfig, you can use the ImageStream:

apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  name: nginx-deployment
spec:
  template:
    spec:
      containers:
      - name: nginx
        image: nginx:latest  # Refers to the ImageStream instead of an external image directly

How Does an ImageStream Help If You Already Have an External Registry?

If you have an external registry where developers push and tag images, and you reference

those images in Deployments, you might not immediately see the need for an ImageStream. However, using ImageStreams can still provide significant benefits:

Image Caching for Performance and Security :

When an ImageStream is used, OpenShift can cache the image inside the cluster. This:

  • Reduces pull time, especially if the external registry is slow.
  • Enhances security by restricting direct access to the external registry.

Automated CI/CD Workflows :

If developers push a new image to the registry, OpenShift can detect the change using an ImageStream and automatically trigger a deployment update.

Example:

  • A developer pushes a new image tagged as v2.
  • OpenShift detects the change using ImageStream.
  • OpenShift automatically updates the Deployment.

Better Version Control for Images :

With ImageStreams, OpenShift keeps track of different versions of an image. You can switch between versions without modifying the deployment configuration:

oc tag myregistry.com/app:v2 my-project/app:latest

All deployments referencing my-project/app:latest will now use v2.

Easy Rollback to Previous Versions :

Since OpenShift keeps a history of tags in the ImageStream, rolling back to a previous version is easier:

oc rollback dc/my-app

Recommended Setup for You :

Since your developers are already pushing images to an external registry and you are directly referencing them in Deployments, you can configure an ImageStream as follows:

apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  name: my-app
  namespace: my-project
spec:
  tags:
    - name: latest
      from:
        kind: DockerImage
        name: myregistry.com/my-app:latest
      importPolicy:
        scheduled: true
  • This ImageStream periodically checks (scheduled: true) for new versions in your external registry.
  • When an update is detected, it can automatically trigger a Deployment update.

Key Benefits of Using ImageStreams :

If none of these advantages are relevant to your setup, you can continue using DockerImage references in your Deployments without using ImageStreams. However, for large-scale environments, ImageStreams are highly recommended.

Categorized in:

linuxopenshift