# How can I separate the "push images" and "deploy" steps of installing an application using Replicated?

**URL:** <https://community.replicated.com/t/how-can-i-separate-the-push-images-and-deploy-steps-of-installing-an-application-using-replicated/781>\
**Category:** Supporting your customers\
**Tags:** kots\
**Created:** [April 25, 2022, 5:35pm UTC](https://community.replicated.com/t/how-can-i-separate-the-push-images-and-deploy-steps-of-installing-an-application-using-replicated/781 "2022-04-25T17:35:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamancini](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/adamancini/32/229_2.png) [@adamancini](https://community.replicated.com/u/adamancini)\
**Post date:** [April 25, 2022, 5:35pm UTC](https://community.replicated.com/t/how-can-i-separate-the-push-images-and-deploy-steps-of-installing-an-application-using-replicated/781/1 "2022-04-25T17:35:34Z")

</div>

I need to push all images into a registry before deploying an application in airgap mode because my organization requires that all images be scanned first. I noticed that `kots install` performs both functions. How can I perform these steps separately?

---

<div class="post-metadata">

**Author:** ![dmitriy](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dmitriy/32/16_2.png) [@dmitriy](https://community.replicated.com/u/dmitriy)\
**Post date:** [April 25, 2022, 5:43pm UTC](https://community.replicated.com/t/how-can-i-separate-the-push-images-and-deploy-steps-of-installing-an-application-using-replicated/781/2 "2022-04-25T17:43:25Z")

</div>

[kots admin-console push-images](https://docs.replicated.com/reference/kots-cli-admin-console-push-images) command can be used to push images from both kotadm and application airgap bundles. And the [kots install](https://docs.replicated.com/reference/kots-cli-install) command has the `--disable-image-push` flag.

---

<div class="post-metadata">

**Author:** ![adamancini](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/adamancini/32/229_2.png) [@adamancini](https://community.replicated.com/u/adamancini)\
**Post date:** [April 25, 2022, 7:15pm UTC](https://community.replicated.com/t/how-can-i-separate-the-push-images-and-deploy-steps-of-installing-an-application-using-replicated/781/3 "2022-04-25T19:15:19Z")

</div>

Prerequisites:

- registry address
- registry username
- registry password
- KOTS Admin Console airgap bundle file
- Application airgap bundle file

Procedure:

- First, upload all the images into the registry with the `kots admin-console push-images` command

```bash
kubectl kots admin-console push-images ./kotsadm.tar.gz <registry-address> --registry-username <username> --registry-password <password>
kubectl kots admin-console push-images ./application.airgap <registry-address> --registry-username <username> --registry-password <password>

```

- then perform any necessary steps on the registry to scan/validate images
- finally, perform an installation using KOTS and use the `--disable-image-push` flag since our images are already present in the registry

```bash
kubectl kots install <application> \
  --namespace <application> \
  --shared-password <admin-console-password> \
  --license-file ./license.yaml \
  --config-values ./configvalues.yaml \
  --airgap-bundle ./application.airgap \
  --kotsadm-registry <registry-address> \
  --kotsadm-namespace <application> \
  --registry-username <registry-username> \
  --registry-password <registry-password> \
  --disable-image-push \
  --no-port-forward

```

---

<div class="post-metadata">

**Author:** ![dex](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dex/32/26_2.png) [@dex](https://community.replicated.com/u/dex)\
**Post date:** [July 5, 2022, 12:46am UTC](https://community.replicated.com/t/how-can-i-separate-the-push-images-and-deploy-steps-of-installing-an-application-using-replicated/781/4 "2022-07-05T00:46:30Z")

</div>

I’ll add as an aside here an answer to a related question

> Do you have any recommendations for how customers can run image scanners (for security) on our images besides going through an airgapped flow?

In this case, you can always use the `Registry` tab to configure an intermediate image registry in which to store images, even if the installation is not airgapped. If you need to perform an initial scan before deploying, take the following steps:

1. Proceed with the regular install until you get to the “Preflight Checks” screen.
2. Once the Preflight checks have passed, do not click the “Deploy” button, instead click the app icon in the top left, this will take you to the main dashboard
3. From there, go to the registry tab and configure a custom registry
4. Clicking save on this page will trigger the following:  
a. App Manager will download each image, re-tag it, and push it to the configured registry  
b. App Manager will stage a new release for you to deploy in which all image manifests are rewritten to use the internal registry instead of a registry on the public internet
5. Review and deploy the newly staged release

 ![Screen Shot 2022-07-04 at 7.43.09 PM](https://canada1.discourse-cdn.com/flex030/uploads/replicated/original/1X/11ea5150368c184e3915de910d818fd3dc4aff67.jpeg)

For more information, see [Image Registry for Air Gap Clusters](https://docs.replicated.com/enterprise/image-registry-airgap) and [the docs on referencing images in operators](https://docs.replicated.com/vendor/operator-referencing-images#adding-a-reference-to-the-local-registry)