|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * applications/pruning-objects.adoc |
| 4 | + |
| 5 | +:_mod-docs-content-type: PROCEDURE |
| 6 | +[id="pruning-images-job-cronjob_{context}"] |
| 7 | += Running image pruning as a Job or CronJob |
| 8 | + |
| 9 | +You can configure image pruning to run on a schedule by creating a `Job` or `CronJob` that invokes the pruning operation on the cluster. |
| 10 | +This approach allows administrators to automate pruning at regular intervals without relying on the image pruning custom resource. |
| 11 | + |
| 12 | + |
| 13 | +.Prerequisites |
| 14 | + |
| 15 | +* To prune images, you must first log in to the CLI as a user with an access token. The user must also have the `system:image-pruner` cluster role or greater (for example, `cluster-admin`). |
| 16 | +* Expose the image registry. |
| 17 | +
|
| 18 | +.Procedure |
| 19 | + |
| 20 | +To manually prune images that are no longer required by the system due to age, status, or exceed limits, use one of the following methods: |
| 21 | + |
| 22 | +* Run image pruning as a `Job` or `CronJob` on the cluster by creating a YAML file for the `pruner` service account, for example: |
| 23 | ++ |
| 24 | +[source,terminal] |
| 25 | +---- |
| 26 | +$ oc create -f <filename>.yaml |
| 27 | +---- |
| 28 | ++ |
| 29 | +.Example output |
| 30 | ++ |
| 31 | +[source,yaml] |
| 32 | +---- |
| 33 | +kind: List |
| 34 | +apiVersion: v1 |
| 35 | +items: |
| 36 | +- apiVersion: v1 |
| 37 | + kind: ServiceAccount |
| 38 | + metadata: |
| 39 | + name: pruner |
| 40 | + namespace: openshift-image-registry |
| 41 | +- apiVersion: rbac.authorization.k8s.io/v1 |
| 42 | + kind: ClusterRoleBinding |
| 43 | + metadata: |
| 44 | + name: openshift-image-registry-pruner |
| 45 | + roleRef: |
| 46 | + apiGroup: rbac.authorization.k8s.io |
| 47 | + kind: ClusterRole |
| 48 | + name: system:image-pruner |
| 49 | + subjects: |
| 50 | + - kind: ServiceAccount |
| 51 | + name: pruner |
| 52 | + namespace: openshift-image-registry |
| 53 | +- apiVersion: batch/v1 |
| 54 | + kind: CronJob |
| 55 | + metadata: |
| 56 | + name: image-pruner |
| 57 | + namespace: openshift-image-registry |
| 58 | + spec: |
| 59 | + schedule: "0 0 * * *" |
| 60 | + concurrencyPolicy: Forbid |
| 61 | + successfulJobsHistoryLimit: 1 |
| 62 | + failedJobsHistoryLimit: 3 |
| 63 | + jobTemplate: |
| 64 | + spec: |
| 65 | + template: |
| 66 | + spec: |
| 67 | + restartPolicy: OnFailure |
| 68 | + containers: |
| 69 | + - image: "quay.io/openshift/origin-cli:4.1" |
| 70 | + resources: |
| 71 | + requests: |
| 72 | + cpu: 1 |
| 73 | + memory: 1Gi |
| 74 | + terminationMessagePolicy: FallbackToLogsOnError |
| 75 | + command: |
| 76 | + - oc |
| 77 | + args: |
| 78 | + - adm |
| 79 | + - prune |
| 80 | + - images |
| 81 | + - --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt |
| 82 | + - --keep-tag-revisions=5 |
| 83 | + - --keep-younger-than=96h |
| 84 | + - --confirm=true |
| 85 | + name: image-pruner |
| 86 | + serviceAccountName: pruner |
| 87 | +---- |
| 88 | +
|
| 89 | +* Run the `oc adm prune images [<options>]` command: |
| 90 | ++ |
| 91 | +[source,terminal] |
| 92 | +---- |
| 93 | +$ oc adm prune images [<options>] |
| 94 | +---- |
| 95 | ++ |
| 96 | +Pruning images removes data from the integrated registry unless `--prune-registry=false` is used. |
| 97 | ++ |
| 98 | +Pruning images with the `--namespace` flag does not remove images, only image streams. Images are non-namespaced resources. Therefore, limiting pruning to a particular namespace makes it impossible to calculate its current usage. |
| 99 | ++ |
| 100 | +By default, the integrated registry caches metadata of blobs to reduce the number of requests to storage, and to increase the request-processing speed. Pruning does not update the integrated registry cache. Images that still contain pruned layers after pruning will be broken because the pruned layers that have metadata in the cache will not be pushed. Therefore, you must redeploy the registry to clear the cache after pruning: |
| 101 | ++ |
| 102 | +[source,terminal] |
| 103 | +---- |
| 104 | +$ oc rollout restart deployment/image-registry -n openshift-image-registry |
| 105 | +---- |
| 106 | ++ |
| 107 | +If the integrated registry uses a Redis cache, you must clean the database manually. |
| 108 | ++ |
| 109 | +If redeploying the registry after pruning is not an option, then you must permanently disable the cache. |
| 110 | ++ |
| 111 | +`oc adm prune images` operations require a route for your registry. Registry routes are not created by default. |
| 112 | ++ |
| 113 | +The *Prune images CLI configuration options* table describes the options you can use with the `oc adm prune images <options>` command. |
| 114 | ++ |
| 115 | +.Prune images CLI configuration options |
| 116 | +[cols="4,8",options="header"] |
| 117 | +|=== |
| 118 | +
|
| 119 | +|Option |Description |
| 120 | + |
| 121 | +.^|`--all` |
| 122 | +|Include images that were not pushed to the registry, but have been mirrored by |
| 123 | +pullthrough. This is on by default. To limit the pruning to images that were |
| 124 | +pushed to the integrated registry, pass `--all=false`. |
| 125 | + |
| 126 | +.^|`--certificate-authority` |
| 127 | +|The path to a certificate authority file to use when communicating with the |
| 128 | +{product-title}-managed registries. Defaults to the certificate authority data |
| 129 | +from the current user's configuration file. If provided, a secure connection is |
| 130 | +initiated. |
| 131 | + |
| 132 | +.^|`--confirm` |
| 133 | +|Indicate that pruning should occur, instead of performing a test-run. This |
| 134 | +requires a valid route to the integrated container image registry. If this |
| 135 | +command is run outside of the cluster network, the route must be provided |
| 136 | +using `--registry-url`. |
| 137 | + |
| 138 | +.^|`--force-insecure` |
| 139 | +|Use caution with this option. Allow an insecure connection to the container |
| 140 | +registry that is hosted via HTTP or has an invalid HTTPS certificate. |
| 141 | + |
| 142 | +.^|`--keep-tag-revisions=<N>` |
| 143 | +|For each imagestream, keep up to at most `N` image revisions per tag (default |
| 144 | +`3`). |
| 145 | + |
| 146 | +.^|`--keep-younger-than=<duration>` |
| 147 | +|Do not prune any image that is younger than `<duration>` relative to the |
| 148 | +current time. Alternately, do not prune any image that is referenced by any other object that |
| 149 | +is younger than `<duration>` relative to the current time (default `60m`). |
| 150 | + |
| 151 | +.^|`--prune-over-size-limit` |
| 152 | +|Prune each image that exceeds the smallest limit defined in the same project. |
| 153 | +This flag cannot be combined with `--keep-tag-revisions` nor |
| 154 | +`--keep-younger-than`. |
| 155 | + |
| 156 | +.^|`--registry-url` |
| 157 | +|The address to use when contacting the registry. The command attempts to use a |
| 158 | +cluster-internal URL determined from managed images and image streams. In case |
| 159 | +it fails (the registry cannot be resolved or reached), an alternative route that |
| 160 | +works needs to be provided using this flag. The registry hostname can be |
| 161 | +prefixed by `https://` or `http://`, which enforces particular connection |
| 162 | +protocol. |
| 163 | + |
| 164 | +.^|`--prune-registry` |
| 165 | +|In conjunction with the conditions stipulated by the other options, this option |
| 166 | +controls whether the data in the registry corresponding to the {product-title} |
| 167 | +image API object is pruned. By default, image pruning processes both the image |
| 168 | +API objects and corresponding data in the registry. |
| 169 | + |
| 170 | +This option is useful when you are only concerned with removing etcd content, to reduce the number of image objects but are not concerned with cleaning up registry storage, or if you intend to do that separately by hard pruning the registry during an appropriate maintenance window for the registry. |
| 171 | +|=== |
| 172 | + |
0 commit comments