---
title: "Set up a private registry"
description: "Mirror Calico Cloud container images into a private registry so air-gapped clusters can install without reaching the public registry."
product: "Calico Cloud"
version: "v24.0.0"
section: "Install and upgrade"
canonical_url: "https://docs.tigera.io/calico-cloud/next/get-started/setup-private-registry"
---

# Set up a private registry

## Big picture

Add Calico Cloud images to a private registry to install new clusters or update existing ones.

## Value

In some deployments, installing Calico Cloud in clusters from third-party repos is not an option. Before you can install Calico Cloud from a private registry, you must first add Calico Cloud images to the registry.

## Concepts

A **container image registry** (often known as a **registry**), is a service where you can push, pull, and store container images. In Kubernetes, a registry is considered *private* if it is not publicly available.

A **private registry** is not publicly available. It must be accessible on a private network or with an **image pull secret** for authenticated access.

An **image path** is a directory in a registry that contains images required to install Calico Cloud.

## Before you begin

**Required**

- [Helm CLI](https://helm.sh/docs/intro/install/) command

- Use the [Crane command](https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md) to follow steps in this guide. (Other tools can be used, but commands be adjusted accordingly.)

- Image registry

  - Must be private (accessible only on a private network or using log in credentials)
  - Images copied to the registry must not be made publicly available
  - Push access to your registry

## How to

Add the required Calico Cloud images to a private registry.

### Set up registry credentials

1. Log into Calico Cloud and navigate to "Managed Clusters".
2. If your organization uses multiple projects to group managed clusters, click the **Project** menu and select the project you want your cluster to be part of.
3. Get the "Registry Credentials" by clicking on the icon. ![registry credentials](https://docs.tigera.io/assets/images/private-registry-icon-865a478b6480df31166ed0ad19c70167.png)
4. Apply the credentials so the Calico Cloud images can be accessed.

### Create the list of required images

### Select your version:

v24.0.0 (latest)Images for Calico Cloud v24.0.0 (latest)

```bash
IMAGES=(
quay.io/tigera/cc-operator:v24.0.0
quay.io/calico/istio-pilot:v3.32.0
quay.io/calico/istio-install-cni:v3.32.0
quay.io/calico/istio-ztunnel:v3.32.0
quay.io/calico/istio-proxyv2:v3.32.0
quay.io/calico/webhooks:v3.32.0
quay.io/tigera/calico:v3.24.0-1.0
quay.io/tigera/compliance-benchmarker:v3.24.0-1.0
quay.io/tigera/deep-packet-inspection:v3.24.0-1.0
quay.io/tigera/fluentd:v3.24.0-1.0
quay.io/tigera/fluentd-windows:v3.24.0-1.0
quay.io/tigera/intrusion-detection-controller:v3.24.0-1.0
quay.io/tigera/manager:v3.24.0-1.0
quay.io/tigera/egress-gateway:v3.24.0-1.0
quay.io/tigera/gateway-l7-collector:v3.24.0-1.0
quay.io/tigera/envoy:v3.24.0-1.0
quay.io/tigera/dikastes:v3.24.0-1.0
quay.io/tigera/prometheus:v3.24.0-1.0
quay.io/tigera/alertmanager:v3.24.0-1.0
quay.io/tigera/node:v3.24.0-1.0
quay.io/tigera/node-windows:v3.24.0-1.0
quay.io/tigera/cni-windows:v3.24.0-1.0
quay.io/tigera/third-party-cni-plugins:v3.24.0-1.0
quay.io/tigera/envoy-gateway:v3.24.0-1.0
quay.io/tigera/envoy-proxy:v3.24.0-1.0
quay.io/tigera/envoy-ratelimit:v3.24.0-1.0
quay.io/tigera/istio-pilot:v3.24.0-1.0
quay.io/tigera/istio-install-cni:v3.24.0-1.0
quay.io/tigera/istio-ztunnel:v3.24.0-1.0
quay.io/tigera/istio-proxyv2:v3.24.0-1.0
quay.io/tigera/operator:v1.43.0
quay.io/tigera/cc-core:v0.4.0
quay.io/tigera/prometheus-operator:v3.24.0-1.0
quay.io/tigera/prometheus-config-reloader:v3.24.0-1.0
quay.io/tigera/cc-cni-config-scanner:v0.7.4
)
```

### Set up the private registry

```bash
REGISTRY=<replace with your registry and include a trailing slash>
```

If you want all images to come from the same path in your registry, set this image path value. Otherwise unset this environment variable or set it to the empty string.

```bash
IMAGEPATH=""
```

#### Image examples

| Original image                      | Image Registry | Image Path    | Private registry image                       |
| ----------------------------------- | -------------- | ------------- | -------------------------------------------- |
| `quay.io/tigera/typha:v1.2.3`       | `my.registry/` |               | `my.registry/tigera/typha:v1.2.3`            |
| `quay.io/tigera/typha:v1.2.3`       | `my.registry/` | `custom-path` | `my.registry/custom-path/typha:v1.2.3`       |
| `quay.io/tigera/cc-operator:v4.5.6` | `my.registry/` |               | `my.registry/tigera/cc-operator:v4.5.6`      |
| `quay.io/tigera/cc-operator:v4.5.6` | `my.registry/` | `custom-path` | `my.registry/custom-path/cc-operator:v4.5.6` |

### Copy images to your registry

For Calico Cloud to install images from your registry, copy the images from the standard registries into your own registry.

<!-- tabs -->

**Tab: Registry only**

```bash
for image in ${IMAGES[@]}; do
  img_base=$(echo ${image} | sed "s#^.*/\([^/]*/[^/]*$\)#\1#")
  crane cp ${image} ${REGISTRY}${img_base} || break
done
```

**Tab: Registry and ImagePath**

```bash
for image in ${IMAGES[@]}; do
  img_base=$(echo ${image} | sed "s#^.*/##")
  crane cp ${image} ${REGISTRY}${IMAGEPATH}/${img_base} || break
done
```

<!-- /tabs -->

## Install using the private registry

Follow the directions [to connect a cluster to Calico Cloud](https://docs.tigera.io/calico-cloud/next/get-started/install-cluster.md).