Manage container images

You can use Skopeo to copy container images from public registries to your private registry within the Mission Control environment. Skopeo is a command-line utility that lets you interact with container images and registries. You can copy images between different registries, inspect remote images, and more.

Storing container images in private registries enhances security by ensuring that your images are scanned and vetted within your controlled environment. Storing images locally also reduces latency and network dependency, improving system performance and reliability.

Prerequisites

To copy container images, you need the following:

  • Skopeo installed.

  • Credentials for the private registry.

  • Access to Mission Control and permissions to manage container images.

Container image tags

As of version 1.20.1, some Mission Control images are published to IBM Container Registry (ICR). Images in the public registry (icr.io) require no authentication. Images in the entitled registry (cp.icr.io) require an IBM entitlement key.

When you deploy a Mission Control cluster, Mission Control automatically creates a cqlsh-pod. The cqlsh-pod container runs the cqlsh utility. It exposes a CQL console through the Mission Control UI, allowing you to interact with your database cluster using CQL commands. The cqlsh-pod image is hosted at cp.icr.io/cp/ibm-ds-mission-control/cqlsh-pod and requires an IBM entitlement key. For more information, see Customize the cqlsh-pod.

To view the container images and specific versions included with each Mission Control release, see the Mission Control release notes.

Override registry credentials for airgap installations

You can configure custom image registries and repositories when deploying Mission Control with Helm. To do this, you need to set the image.registry and image.repository values in your values.yaml file. You can also set the image.tag value to specify the version of the image you want to use.

For more information, see Manage container images.

Global configuration patterns

You can specify image coordinates across the various charts and sub-charts in several ways.

  1. Direct image fields: Using image.registry, image.repository, and image.tag

  2. Global image config: Using global.imageConfig for unified image management in Mission Control version 1.15.0 and later

  3. Legacy image configs: Using imageConfigs.registryOverride and specific repository overrides (deprecated in version 1.15.0)

  4. Registry prefixing: Some components use a combined registry/repository pattern

  5. Sub-chart-specific patterns: Each sub-chart might implement its own configuration pattern

  6. Coordinate separation: For cqlsh-pod, you can specify registry, repository, and tag separately in Mission Control version 1.15.0 and later

  7. Individual component overrides: Override repositories for cqlsh-pod, cql-router, Medusa, and Reaper independently in Mission Control version 1.15.0 and later

Configure the main chart image

Specify the main chart image configuration using the image key in your values.yaml file.

# Main operator image configuration
image:
  registry: REGISTRY_ADDRESS:REGISTRY_PORT
  repository: datastax/mission-control
  pullPolicy: IfNotPresent
  tag: v1.20.1

# Global image config overrides for all images
global:
  imageConfig:
    overrides:
      registry: "REGISTRY_ADDRESS:REGISTRY_PORT"

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

Configure global image coordinates in version 1.15.0 and later

In version 1.15.0 and later, Mission Control has a unified global.imageConfig structure that allows you to manage image coordinates across all operators using a single configuration block. This structure is introduced with k8ssandra-operator version 1.27 and cass-operator version 1.27, which modify how image coordinates are defined across all operators using a unified structure. This provides better control over image management and simplifies airgap installations.

The global.imageConfig structure replaces the legacy imageConfigs approach. While legacy configurations continue to work, DataStax recommends upgrading to version 1.15.0 to use the new structure for better maintainability.

As of Mission Control version 1.20.1, all images are published to IBM Container Registry (ICR). Images are split between two registries based on entitlement:

Public images (no authentication required):

  • icr.io/datastax-mission-control/mission-control

  • icr.io/datastax-mission-control/mission-control-ui

  • icr.io/datastax-mission-control/mission-control-dex

  • icr.io/datastax-mission-control/k8ssandra-client

Entitled images (IBM entitlement key required):

  • cp.icr.io/cp/ibm-ds-mission-control/cql-router

  • cp.icr.io/cp/ibm-ds-mission-control/cqlsh

  • cp.icr.io/cp/ibm-ds-mission-control/hcd

  • cp.icr.io/cp/ibm-ds-mission-control/dse-mgmtapi

The global.imageConfig structure supports the following configuration options:

  • images: Individual image configurations with registry, repository, name, and tag

  • overrides: Global overrides that apply to all images

  • defaults: Default values used when no specific override is present

  • types: Image type configurations for different server types (hcd, cassandra, dse)

global:
  imageConfig:
    images:
      system-logger:
        registry: "icr.io"
        repository: "k8ssandra"
        name: "system-logger"
        tag: "v1.30.3"
      config-builder:
        registry: "icr.io"
        repository: "datastax"
        name: "cass-config-builder"
        tag: "1.0-ubi"
      k8ssandra-client:
        registry: "icr.io"
        repository: "k8ssandra"
        name: "k8ssandra-client"
        tag: "mission-control-1.20.1"
        # pullSecret: "k8ssandra-client-pull-secret" # Use of pullSecret removes the default pullSecrets for this image
        # pullPolicy: Always
      cql-router:
        registry: "cp.icr.io"
        repository: "cp/ibm-ds-mission-control"
        name: "cql-router"
        tag: "v1.20.0"
      cqlsh:
        registry: "cp.icr.io"
        repository: "cp/ibm-ds-mission-control"
        name: "cqlsh-pod"
        tag: "v1.20.1"
      data-api:
        registry: "icr.io"
        repository: "stargateio"
        name: "data-api"
        tag: "v1.0.48"
      reaper:
        registry: "icr.io"
        repository: "thelastpickle"
        name: "cassandra-reaper"
        tag: "5.0.0"
      medusa:
        registry: "icr.io"
        repository: "k8ssandra"
        name: "medusa"
        tag: "0.29.1"
    # overrides will apply to all images discarding the settings in defaults or what individual images might have.
    overrides:
      # registry to pull from
      registry: "private-registry.local"
      # repository to use discarding all the other settings. If set to empty, repository part will be removed from the image path.
      repository: "enterprise"
      # pullPolicy override the pullPolicy of images
      pullPolicy: Never
      # pullSecrets removes all the other pullSecrets when used. Setting as empty array will remove pullSecrets from use.
      pullSecrets:
        - "my-secret-pull-registry"
    # types are used as building blocks when serverVersion + serverType in the CassandraDatacenter is used
    # defaults are used when other no override is present for the configured image or image type. All these values can be overridden under any image or image type.
    defaults:
      registry: "icr.io"
      pullPolicy: IfNotPresent
      pullSecrets:
        - "{{ .Release.Name}}-registry"
    types:
      hcd:
        registry: "cp.icr.io"
        repository: "cp/ibm-ds-mission-control"
        name: "hcd"
        suffix: "-ubi"
      cassandra:
        registry: "icr.io"
        repository: "k8ssandra"
        name: "cass-management-api"
        suffix: "-ubi"
      dse:
        registry: "cp.icr.io"
        repository: "cp/ibm-ds-mission-control"
        name: "dse-mgmtapi"
        suffix: "-ubi"

Override registry for all images

To override the registry for all images (common for airgap installations), use the overrides section:

global:
  imageConfig:
    overrides:
      registry: "REGISTRY_ADDRESS:REGISTRY_PORT"

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

The above configuration overrides the registry for all images, including images that have specific registry overrides.

Override specific images while maintaining defaults

If you need to override the registry for specific images while others use defaults:

global:
  imageConfig:
    defaults:
      registry: "REGISTRY_ADDRESS:REGISTRY_PORT"
      pullPolicy: IfNotPresent
    images:
      cql-router:
        registry: "REGISTRY_ADDRESS_2:REGISTRY_PORT"
      cqlsh:
        registry: "REGISTRY_ADDRESS_3:REGISTRY_PORT"
    types:
      hcd:
        registry: "REGISTRY_ADDRESS_4:REGISTRY_PORT"

Replace the following:

  • REGISTRY_ADDRESS_2: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_ADDRESS_3: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_ADDRESS_4: The address of your registry

  • REGISTRY_PORT: The registry port

You can override each element (registry, repository, name, and tag) individually. The operators automatically merge the overrides with the default values.

Configure cqlsh-pod image coordinates (Legacy)

This section describes the legacy imageConfigs approach. For new installations, use the global.imageConfig structure described above.

You can specify the cqlsh-pod image coordinates separately using the legacy imageConfigs approach, allowing you to override the registry, repository, and tag independently.

For more information, see Configure cqlsh-pod image coordinates separately.

When using coordinate separation, ensure that:

  • All specified repositories exist in your registry

  • The image tags are valid and available

  • The custom images contain the necessary binaries and dependencies

 
global:
  imageConfig:
    images:
      cqlsh:
        registry: "REGISTRY_ADDRESS:REGISTRY_PORT"
        repository: CUSTOM_CQLSH_REPOSITORY
        tag: CUSTOM_TAG
      cql-router:
        registry: "REGISTRY_ADDRESS:REGISTRY_PORT"
        repository: CUSTOM_CQL_ROUTER_REPOSITORY
        tag: CUSTOM_TAG
      medusa:
        registry: "REGISTRY_ADDRESS:REGISTRY_PORT"
        repository: CUSTOM_MEDUSA_REPOSITORY
        tag: CUSTOM_TAG
      reaper:
        registry: "REGISTRY_ADDRESS:REGISTRY_PORT"
        repository: CUSTOM_REAPER_REPOSITORY
        tag: CUSTOM_TAG

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • CUSTOM_CQLSH_REPOSITORY: Your custom cqlsh-pod repository

  • CUSTOM_CQL_ROUTER_REPOSITORY: Your custom cql-router repository

  • CUSTOM_MEDUSA_REPOSITORY: Your custom Medusa repository

  • CUSTOM_REAPER_REPOSITORY: Your custom Reaper repository

  • CUSTOM_TAG: The image tag you want to use

Configure client and job images

Specify the client and CRD patch job images using the client and crdPatchJob keys in your values.yaml file.

# Client image configuration
client:
   image:
     registry: REGISTRY_ADDRESS:REGISTRY_PORT
     repository: icr.io/k8ssandra/k8ssandra-client
     tag: mission-control-1.20.1

# CRD patch job image configuration
crdPatchJob:
  image:
    registry: REGISTRY_ADDRESS:REGISTRY_PORT
    repository: bitnami/kubectl
    tag: 1.30.1

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

Configure the UI component image

Specify the UI component image using the ui key in your values.yaml file.

# UI component image configuration
ui:
  image:
    registry: REGISTRY_ADDRESS:REGISTRY_PORT
    repository: icr.io/datastax/mission-control-ui
    tag: v1.20.1

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

Configure the Grafana sub-chart image

Specify the Grafana sub-chart image using the grafana key in your values.yaml file.

grafana:
  # Global registry for Grafana's internal images
  imageRegistry: REGISTRY_ADDRESS:REGISTRY_PORT

  # Main Grafana image configuration
  image:
    repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/grafana

  # Sidecar container image configuration
  sidecar:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/k8s-sidecar

  # Download dashboards image configuration
  downloadDashboardsImage:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/curl

  # Init container image configuration
  initChownData:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_NAMESPACE: The namespace within your registry

Configure the K8ssandra operator sub-chart image

Specify the K8ssandra operator sub-chart image using the k8ssandra-operator key in your values.yaml file.

k8ssandra-operator:
  # Main operator registry configuration
  image:
    registry: REGISTRY_ADDRESS:REGISTRY_PORT
  cass-operator:
    # Cassandra operator image configuration
    image:
      registry: REGISTRY_ADDRESS:REGISTRY_PORT
    # System images used by the operator
    imageConfig:
      systemLogger: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/system-logger:v1.30.3
      configBuilder: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/cass-config-builder:1.0-ubi
      k8ssandraClient: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/k8ssandra-client:mission-control-1.20.1

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_NAMESPACE: The namespace within your registry

Configure K8ssandra operator system images with imageRegistry and imageNamespace

You can use the imageRegistry and imageNamespace parameters to configure system images. These parameters change the first and second parts of the image address, respectively.

k8ssandra-operator:
  cass-operator:
    imageRegistry: REGISTRY_ADDRESS:REGISTRY_PORT
    imageNamespace: REGISTRY_NAMESPACE

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_NAMESPACE: The namespace within your registry

You can configure the following system images:

  • systemLogger: icr.io/k8ssandra/system-logger

  • configBuilder: icr.io/datastax/cass-config-builder

  • k8ssandraClient: icr.io/k8ssandra/k8ssandra-client

Configure the Loki sub-chart image

Specify the Loki sub-chart image using the loki key in your values.yaml file.

loki:
  # Kubectl image used in Loki
  kubectlImage:
    registry: REGISTRY_ADDRESS:REGISTRY_PORT

  # Sidecar container image configuration
  sidecar:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/k8s-sidecar

  # Global registry for Loki's internal images
  global:
    image:
      registry: REGISTRY_ADDRESS:REGISTRY_PORT

  # MinIO images if using local storage
  minio:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/minio
    mcImage:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/mc

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_NAMESPACE: The namespace within your registry

Configure the Mimir sub-chart image

You specify the Mimir sub-chart image using the mimir key in your values.yaml file.

mimir:
  # Main Mimir image configuration
  image:
    repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/mimir

  # Memcached image configuration
  memcached:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE

  # Memcached exporter image configuration
  memcachedExporter:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/memcached-exporter

  # NGINX image configuration
  nginx:
    image:
      registry: REGISTRY_ADDRESS:REGISTRY_PORT

  # Gateway NGINX image configuration
  gateway:
    nginx:
      image:
        registry: REGISTRY_ADDRESS:REGISTRY_PORT

  # Enterprise metrics image configuration
  enterprise:
    image:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/enterprise-metrics
    mcImage:
      repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/mc

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_NAMESPACE: The namespace within your registry

Configure Vector component images

You specify the Vector component images using the agent and aggregator keys in your values.yaml file.

# Agent Vector image configuration
agent:
  image:
    repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/vector

# Aggregator Vector image configuration
aggregator:
  image:
    repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/vector

Replace the following:

  • REGISTRY_ADDRESS: The address of your registry

  • REGISTRY_PORT: The registry port

  • REGISTRY_NAMESPACE: The namespace within your registry

Configure additional components

Specify the additional components images using the kube-state-metrics and dex keys in your values.yaml file.

# Kube-state-metrics image configuration
kube-state-metrics:
  image:
    registry: REGISTRY_ADDRESS:REGISTRY_PORT

# Dex identity provider image configuration
dex:
  image:
    repository: REGISTRY_ADDRESS:REGISTRY_PORT/REGISTRY_NAMESPACE/mission-control-dex

Troubleshoot image registry overrides

If you encounter issues with image registry overrides, consider the following troubleshooting options:

  • After installation, list all container images used in your deployment:

    kubectl get deployments -n NAMESPACE -o jsonpath='{.items[].spec.template.spec.containers[].image}'

    Replace NAMESPACE with the namespace where Mission Control is installed.

  • Review the Helm chart templates to find all image references.

  • Check for init containers. Some components use init containers with their own image definitions.

  • Test your configuration to see all resources that would be created:

    helm install --dry-run --debug

Use Skopeo to copy container images

Use Skopeo to copy images from public registries to your private registry.

To copy an image from a public registry to your private registry in Mission Control, do the following:

  1. Authenticate to your private registry:

    skopeo login PRIVATE_REGISTRY_HOST

    Replace PRIVATE_REGISTRY_HOST with the host name of the private registry.

  2. Copy the container to your private registry. The following example uses the DSE registry. Replace the registry path with your target container image registry and tag.

    skopeo copy docker://icr.io/datastax/dse-mgmtapi-6_9:6.9.23-ubi docker://PRIVATE_REGISTRY_HOST/PRIVATE_REGISTRY_NAMESPACE/dse-mgmtapi-6_9:6.9.23-ubi

    Replace the following:

    • PRIVATE_REGISTRY_HOST: The host name of the private registry

    • PRIVATE_REGISTRY_NAMESPACE: The namespace of the private registry

  3. Verify the copied image in your private registry:

    skopeo inspect docker:/PRIVATE_REGISTRY/IMAGE_NAME:TAG

    Replace the following:

    • PRIVATE_REGISTRY: The private registry

    • IMAGE_NAME: The image name to inspect

    • TAG: The tag of the image

KOTS CLI (removed)

KOTS support was removed in Mission Control version 1.20.1, and the service is no longer available to earlier versions.

If you used the KOTS CLI previously, you must switch to Skopeo.

For more information, see Migrate your Mission Control installation from Replicated to ICR.

Troubleshoot registry issues

To troubleshoot connection issues, ensure you have network access to both the source and destination registries. If you encounter authentication problems, verify your credentials and permissions for the private registry in Mission Control. For command-related errors, carefully review the error messages and see the Skopeo documentation for more information.

Here are some common issues you might encounter when configuring image registry overrides:

  • Mixed registry patterns: Some sub-charts expect full image paths while others expect separate registry/repository values.

  • Missing namespace: In air-gapped environments, ensure all images include the appropriate namespace within your registry.

  • Version skew: Ensure that the image tags match the expected versions for the release you’re deploying.

  • Registry authentication: Ensure that your Kubernetes cluster has the necessary pull secrets for your registry.

Was this helpful?

Give Feedback

How can we improve the documentation?

© Copyright IBM Corporation 2026 | Privacy policy | Terms of use |  Manage Privacy Choices

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: Contact IBM