From da3fe2bc4da005bb3426d020151397d84b72e853 Mon Sep 17 00:00:00 2001 From: Akshata Jadhav <107832257+aksjadha@users.noreply.github.com> Date: Thu, 29 Aug 2024 14:37:36 +0530 Subject: [PATCH] Updating images-configuration-allowed to correct mco workflow Adding/removing registries under `spec.registrySources.allowedRegistries` in `image.config.openshift.io/cluster` updates `/etc/containers/policy.json file` on each node. Changes to the `/etc/containers/policy.json` do not require node drain. --- modules/images-configuration-allowed.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/images-configuration-allowed.adoc b/modules/images-configuration-allowed.adoc index d890d9f3b7..59ad9b8dba 100644 --- a/modules/images-configuration-allowed.adoc +++ b/modules/images-configuration-allowed.adoc @@ -59,7 +59,7 @@ status: Either the `allowedRegistries` parameter or the `blockedRegistries` parameter can be set, but not both. ==== + -The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster` resource for any changes to the registries. When the MCO detects a change, it drains the nodes, applies the change, and uncordons the nodes. After the nodes return to the `Ready` state, the allowed registries list is used to update the image signature policy in the `/etc/containers/policy.json` file on each node. +The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster` resource for any changes to the registries. When the MCO detects a change, it triggers a rollout on nodes in machine config pool (MCP). The allowed registries list is used to update the image signature policy in the `/etc/containers/policy.json` file on each node. Changes to the `/etc/containers/policy.json` file do not require the node to drain. ifndef::openshift-rosa,openshift-dedicated[] .Verification