Using External Images in CI

How to mirror external images to the CI environments for use in jobs.

The ci-operator config only allows to reference ImageStreamTags, it does not allow to specify arbitrary Docker pull specs. In order to use external images, they need to be mirrored to the central CI registry.

Mirror Public Images

If the source image is open to the public, we can mirror the image by adding it into a mapping file in the core-services/image-mirroring/supplemental-ci-images folder of openshift/release repository. The following line in the mapping_supplemental_ci_images_ci file mirrors to The naming convention of the mapping file is mapping_supplemental_ci_images_<namespace>, e.g., the images in mapping_supplemental_ci_images_ci are mirrored to the namespace ci.


The hourly periodic job periodic-image-mirroring-supplemental-ci-images mirrors all the images defined in the mapping files. Note that it operates on the contents of the master branch, so the changes to the files have to be merged before the images can be used in jobs and/or pull request rehearsals. Once it is mirrored, you can use the image like this:

    namespace: ci
    name:  boskos
    tag: latest

Mirror Private Images

If the image is in a private registry that requires authentication to pull it, you will need to add your credentials and define a new periodic mirroring job with it.

We cannot reuse the existing job as the keys in the credentials config are registries and we might have to set up multiple credentials for the same registry.

Last modified September 20, 2022: Do not mirror images to promoted streams (47d96ce)