---
title: Using image streams with Kubernetes resources
---

# Using image streams with Kubernetes resources {#using-imagestreams-with-kube-resources}

To use image streams with both OpenShift Container Platform native resources and standard Kubernetes resources, reference them in your resource definitions. Image streams work with resources such as `Build`, `DeploymentConfigs`, `Job`, `ReplicationController`, `ReplicaSet`, and `Deployment` resources.

## Enabling image streams with Kubernetes resources {#images-managing-images-enabling-imagestreams-kube_using-imagestreams-with-kube-resources}

When using Kubernetes resources, you must reference image streams located within the same project by specifying a single segment value, such as `ruby:2.5`, which identifies the image stream name and its tag. This ensures the resource correctly targets the local image stream within its scope.

> [!IMPORTANT]
> Do not run workloads in or share access to default projects. Default projects are reserved for running core cluster components.
>
> The following default projects are considered highly privileged: `default`, `kube-public`, `kube-system`, `openshift`, `openshift-infra`, `openshift-node`, and other system-created projects that have the `openshift.io/run-level` label set to `0` or `1`. Functionality that relies on admission plugins, such as pod security admission, security context constraints, cluster resource quotas, and image reference resolution, does not work in highly privileged projects.

There are two ways to enable image streams with Kubernetes resources:

- Enabling image stream resolution on a specific resource. This allows only this resource to use the image stream name in the image field.
- Enabling image stream resolution on an image stream. This allows all resources pointing to this image stream to use it in the image field.

You can use `oc set image-lookup` to enable image stream resolution on a specific resource or image stream resolution on an image stream.

**Procedure**

1. To allow all resources to reference the image stream named `mysql`, enter the following command:

   ```terminal
   $ oc set image-lookup mysql
   ```

   This sets the `Imagestream.spec.lookupPolicy.local` field to true.

   ```yaml {title="Imagestream with image lookup enabled"}
   apiVersion: image.openshift.io/v1
   kind: ImageStream
   metadata:
     annotations:
       openshift.io/display-name: mysql
     name: mysql
     namespace: myproject
   spec:
     lookupPolicy:
       local: true
   ```

   When enabled, the behavior is enabled for all tags within the image stream.
2. Then you can query the image streams and see if the option is set:

   ```terminal
   $ oc set image-lookup imagestream --list
   ```
3. Optional: You can enable image lookup on a specific resource.

   To allow the Kubernetes deployment named `mysql` to use image streams, run the following command:

   ```terminal
   $ oc set image-lookup deploy/mysql
   ```

   This sets the `alpha.image.policy.openshift.io/resolve-names` annotation on the deployment.

   ```yaml {title="Deployment with image lookup enabled"}
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: mysql
     namespace: myproject
   spec:
     replicas: 1
     template:
       metadata:
         annotations:
           alpha.image.policy.openshift.io/resolve-names: '*'
       spec:
         containers:
         - image: mysql:latest
           imagePullPolicy: Always
           name: mysql
   ```
4. Optional: To disable image lookup, pass `--enabled=false`:

   ```terminal
   $ oc set image-lookup deploy/mysql --enabled=false
   ```