@@ -49,10 +49,10 @@ func (c *ImageChangeController) HandleImageStream(stream *imageapi.ImageStream)

 	}

 	for _, config := range bcs {

 		var (

-			from           *kapi.ObjectReference

-			shouldBuild    = false

-			triggeredImage = ""

-			latest         *imageapi.TagEvent

+			from            *kapi.ObjectReference

+			shouldBuild     = false

+			triggeredImage  = ""

+			latestReference string

 		)

 		// For every ImageChange trigger find the latest tagged image from the image stream and

 		// invoke a build using that image id. A new build is triggered only if the latest tagged image id or pull spec

@@ -90,8 +90,8 @@ func (c *ImageChangeController) HandleImageStream(stream *imageapi.ImageStream)

 			// This split is safe because ImageStreamTag names always have the form

 			// name:tag.

-			latest = imageapi.LatestTaggedImage(stream, tag)

-			if latest == nil {

+			latestReference, ok = imageapi.ResolveLatestTaggedImage(stream, tag)

+			if !ok {

 				glog.V(4).Infof("unable to find tagged image: no image recorded for %s/%s:%s", stream.Namespace, stream.Name, tag)

 				continue

 			}

@@ -99,7 +99,7 @@ func (c *ImageChangeController) HandleImageStream(stream *imageapi.ImageStream)

 			// (must be different) to trigger a build

 			last := trigger.ImageChange.LastTriggeredImageID

-			next := latest.DockerImageReference

+			next := latestReference

 			if len(last) == 0 || (len(next) > 0 && next != last) {

 				triggeredImage = next

@@ -123,7 +123,7 @@ func (c *ImageChangeController) HandleImageStream(stream *imageapi.ImageStream)

 					buildapi.BuildTriggerCause{

 						Message: buildapi.BuildTriggerCauseImageMsg,

 						ImageChangeBuild: &buildapi.ImageChangeCause{

-							ImageID: latest.DockerImageReference,

+							ImageID: latestReference,

 							FromRef: from,

 						},

 					},

@@ -56,8 +56,8 @@ func (g *DeploymentConfigGenerator) Generate(ctx kapi.Context, name string) (*de

 		}

 		// Find the latest tag event for the trigger tag

-		latestEvent := imageapi.LatestTaggedImage(imageStream, tag)

-		if latestEvent == nil {

+		latestReference, ok := imageapi.ResolveLatestTaggedImage(imageStream, tag)

+		if !ok {

 			f := field.NewPath("triggers").Index(i).Child("imageChange", "tag")

 			errs = append(errs, field.Invalid(f, tag, fmt.Sprintf("no image recorded for %s/%s:%s", imageStream.Namespace, imageStream.Name, tag)))

 			continue

@@ -72,12 +72,12 @@ func (g *DeploymentConfigGenerator) Generate(ctx kapi.Context, name string) (*de

 			if !names.Has(container.Name) {

 				continue

 			}

-			if len(latestEvent.DockerImageReference) > 0 &&

-				container.Image != latestEvent.DockerImageReference {

+			if len(latestReference) > 0 &&

+				container.Image != latestReference {

 				// Update the image

-				container.Image = latestEvent.DockerImageReference

+				container.Image = latestReference

 				// Log the last triggered image ID

-				params.LastTriggeredImage = latestEvent.DockerImageReference

+				params.LastTriggeredImage = latestReference

 				containerChanged = true

 			}

 		}

@@ -136,14 +136,13 @@ func processTriggers(config *deployapi.DeploymentConfig, isn client.ImageStreams

 		}

 		// Find the latest tag event for the trigger reference.

-		latestEvent := imageapi.LatestTaggedImage(stream, tag)

-		if latestEvent == nil {

+		latestReference, ok := imageapi.ResolveLatestTaggedImage(stream, tag)

+		if !ok {

 			continue

 		}

 		// Ensure a change occurred

-		latestRef := latestEvent.DockerImageReference

-		if len(latestRef) == 0 || latestRef == params.LastTriggeredImage {

+		if len(latestReference) == 0 || latestReference == params.LastTriggeredImage {

 			continue

 		}

@@ -155,11 +154,11 @@ func processTriggers(config *deployapi.DeploymentConfig, isn client.ImageStreams

 				continue

 			}

-			if container.Image != latestRef {

+			if container.Image != latestReference {

 				// Update the image

-				container.Image = latestRef

+				container.Image = latestReference

 				// Log the last triggered image ID

-				params.LastTriggeredImage = latestRef

+				params.LastTriggeredImage = latestReference

 			}

 		}

 	}

@@ -565,6 +565,55 @@ func LatestTaggedImage(stream *ImageStream, tag string) *TagEvent {

 	return nil

 }

+// ResolveLatestTaggedImage returns the appropriate pull spec for a given tag in

+// the image stream, handling the tag's reference policy if necessary to return

+// a resolved image. Callers that transform an ImageStreamTag into a pull spec

+// should use this method instead of LatestTaggedImage.

+func ResolveLatestTaggedImage(stream *ImageStream, tag string) (string, bool) {

+	if len(tag) == 0 {

+		tag = DefaultImageTag

+	}

+

+	// retrieve event

+	latest := LatestTaggedImage(stream, tag)

+	if latest == nil {

+		return "", false

+	}

+

+	// retrieve spec policy - if not found, we use the latest spec

+	ref, ok := stream.Spec.Tags[tag]

+	if !ok {

+		return latest.DockerImageReference, true

+	}

+

+	switch ref.ReferencePolicy.Type {

+	// the local reference policy attempts to use image pull through on the integrated

+	// registry if possible

+	case LocalTagReferencePolicy:

+		local := stream.Status.DockerImageRepository

+		if len(local) == 0 || len(latest.Image) == 0 {

+			// fallback to the originating reference if no local docker registry defined or we

+			// lack an image ID

+			return latest.DockerImageReference, true

+		}

+

+		ref, err := ParseDockerImageReference(local)

+		if err != nil {

+			// fallback to the originating reference if the reported local repository spec is not valid

+			return latest.DockerImageReference, true

+		}

+

+		// create a local pullthrough URL

+		ref.Tag = ""

+		ref.ID = latest.Image

+		return ref.Exact(), true

+

+	// the default policy is to use the originating image

+	default:

+		return latest.DockerImageReference, true

+	}

+}

+

 // DifferentTagEvent returns true if the supplied tag event matches the current stream tag event.

 // Generation is not compared.

 func DifferentTagEvent(stream *ImageStream, tag string, next TagEvent) bool {

@@ -839,6 +839,158 @@ func TestLatestTaggedImage(t *testing.T) {

 	}

 }

+func TestResolveLatestTaggedImage(t *testing.T) {

+	tests := []struct {

+		tag            string

+		statusRef      string

+		refs           map[string]TagReference

+		tags           map[string]TagEventList

+		expected       string

+		expectNotFound bool

+	}{

+		{

+			tag:            "foo",

+			tags:           map[string]TagEventList{},

+			expectNotFound: true,

+		},

+		{

+			tag: "foo",

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expectNotFound: true,

+		},

+		{

+			tag: "",

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expected: "latest-ref",

+		},

+		{

+			tag: "foo",

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref"},

+						{DockerImageReference: "older"},

+					},

+				},

+				"foo": {

+					Items: []TagEvent{

+						{DockerImageReference: "foo-ref"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expected: "foo-ref",

+		},

+

+		// the default reference policy does nothing

+		{

+			refs: map[string]TagReference{

+				"latest": {

+					ReferencePolicy: TagReferencePolicy{Type: SourceTagReferencePolicy},

+				},

+			},

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref", Image: "sha256:4ab15c48b859c2920dd5224f92aabcd39a52794c5b3cf088fb3bbb438756c246"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expected: "latest-ref",

+		},

+

+		// the local reference policy does nothing unless reference is set

+		{

+			refs: map[string]TagReference{

+				"latest": {

+					ReferencePolicy: TagReferencePolicy{Type: LocalTagReferencePolicy},

+				},

+			},

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref", Image: "sha256:4ab15c48b859c2920dd5224f92aabcd39a52794c5b3cf088fb3bbb438756c246"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expected: "latest-ref",

+		},

+

+		// the local reference policy does nothing unless the image id is set

+		{

+			statusRef: "test.server/a/b",

+			refs: map[string]TagReference{

+				"latest": {

+					ReferencePolicy: TagReferencePolicy{Type: LocalTagReferencePolicy},

+				},

+			},

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expected: "latest-ref",

+		},

+

+		// the local reference policy uses the output status reference and the image id

+		// and returns a pullthrough spec

+		{

+			statusRef: "test.server/a/b",

+			refs: map[string]TagReference{

+				"latest": {

+					ReferencePolicy: TagReferencePolicy{Type: LocalTagReferencePolicy},

+				},

+			},

+			tags: map[string]TagEventList{

+				"latest": {

+					Items: []TagEvent{

+						{DockerImageReference: "latest-ref", Image: "sha256:4ab15c48b859c2920dd5224f92aabcd39a52794c5b3cf088fb3bbb438756c246"},

+						{DockerImageReference: "older"},

+					},

+				},

+			},

+			expected: "test.server/a/b@sha256:4ab15c48b859c2920dd5224f92aabcd39a52794c5b3cf088fb3bbb438756c246",

+		},

+	}

+

+	for i, test := range tests {

+		stream := &ImageStream{}

+		stream.Status.DockerImageRepository = test.statusRef

+		stream.Status.Tags = test.tags

+		stream.Spec.Tags = test.refs

+

+		actual, ok := ResolveLatestTaggedImage(stream, test.tag)

+		if !ok {

+			if !test.expectNotFound {

+				t.Errorf("%d: unexpected nil result", i)

+			}

+			continue

+		}

+		if e, a := test.expected, actual; e != a {

+			t.Errorf("%d: expected %q, got %q", i, e, a)

+		}

+	}

+}

+

 func TestAddTagEventToImageStream(t *testing.T) {

 	tests := map[string]struct {

 		tags           map[string]TagEventList