You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/image-cleaner.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,20 +1,20 @@
1
1
---
2
-
title: Use ImageCleaner on Azure Kubernetes Service (AKS)
3
-
description: Learn how to use ImageCleaner to clean up stale images on Azure Kubernetes Service (AKS)
2
+
title: Use Image Cleaner on Azure Kubernetes Service (AKS)
3
+
description: Learn how to use Image Cleaner to clean up stale images on Azure Kubernetes Service (AKS)
4
4
ms.author: nickoman
5
5
author: nickomang
6
6
services: container-service
7
7
ms.topic: article
8
8
ms.date: 12/14/2022
9
9
---
10
10
11
-
# Use ImageCleaner to clean up stale images on your Azure Kubernetes Service cluster (preview)
11
+
# Use Image Cleaner to clean up stale images on your Azure Kubernetes Service cluster (preview)
12
12
13
-
It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which ImageCleaner can mitigate via automatic image identification and removal.
13
+
It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which Image Cleaner can mitigate via automatic image identification and removal.
14
14
15
15
> [!NOTE]
16
-
> ImageCleaner is a feature based on [Eraser](https://github.com/Azure/eraser).
17
-
> On an AKS cluster, the feature name and property name is `ImageCleaner` while the relevant ImageCleaner pods' names contain `Eraser`.
16
+
> Image Cleaner is a feature based on [Eraser](https://github.com/Azure/eraser).
17
+
> On an AKS cluster, the feature name and property name is `Image Cleaner` while the relevant Image Cleaner pods' names contain `Eraser`.
18
18
19
19
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
* ARM64 node pools. For more information, see [Azure Virtual Machines with ARM-based processors][arm-vms].
87
87
* Windows node pools.
88
88
89
-
## How ImageCleaner works
89
+
## How Image Cleaner works
90
90
91
-
When enabled, an `eraser-controller-manager` pod is deployed on each agent node, which will use an `ImageList` CRD to determine unreferenced and vulnerable images. Vulnerability is determined based on a [trivy][trivy] scan, after which images with a `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` classification are flagged. An updated `ImageList` will be automatically generated by ImageCleaner based on a set time interval, and can also be supplied manually.
91
+
When enabled, an `eraser-controller-manager` pod is deployed on each agent node, which will use an `ImageList` CRD to determine unreferenced and vulnerable images. Vulnerability is determined based on a [trivy][trivy] scan, after which images with a `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` classification are flagged. An updated `ImageList` will be automatically generated by Image Cleaner based on a set time interval, and can also be supplied manually.
92
92
93
-
Once an `ImageList` is generated, ImageCleaner will remove all the images in the list from node VMs.
93
+
Once an `ImageList` is generated, Image Cleaner will remove all the images in the list from node VMs.
94
94
95
95
96
96
:::image type="content" source="./media/image-cleaner/image-cleaner.jpg" alt-text="A diagram showing ImageCleaner's workflow. The ImageCleaner pods running on the cluster can generate an ImageList, or manual input can be provided.":::
97
97
98
98
## Configuration options
99
99
100
-
In addition to choosing between manual and automatic mode, there are several options for ImageCleaner:
100
+
In addition to choosing between manual and automatic mode, there are several options for Image Cleaner:
101
101
102
102
|Name|Description|Required|
103
103
|----|-----------|--------|
104
-
|--enable-image-cleaner|Enable the ImageCleaner feature for an AKS cluster|Yes, unless disable is specified|
105
-
|--disable-image-cleaner|Disable the ImageCleaner feature for an AKS cluster|Yes, unless enable is specified|
106
-
|--image-cleaner-interval-hours|This parameter determines the interval time (in hours) ImageCleaner will use to run. The default value for Azure CLI is one week, the minimum value is 24 hours and the maximum is three months.|Not required for Azure CLI, required for ARM template or other clients|
104
+
|--enable-image-cleaner|Enable the Image Cleaner feature for an AKS cluster|Yes, unless disable is specified|
105
+
|--disable-image-cleaner|Disable the Image Cleaner feature for an AKS cluster|Yes, unless enable is specified|
106
+
|--image-cleaner-interval-hours|This parameter determines the interval time (in hours) Image Cleaner will use to run. The default value for Azure CLI is one week, the minimum value is 24 hours and the maximum is three months.|Not required for Azure CLI, required for ARM template or other clients|
107
107
108
108
> [!NOTE]
109
-
> After disabling ImageCleaner, the old configuration still exists. This means that if you enable the feature again without explicitly passing configuration, the existing value will be used rather than the default.
109
+
> After disabling Image Cleaner, the old configuration still exists. This means that if you enable the feature again without explicitly passing configuration, the existing value will be used rather than the default.
110
110
111
-
## Enable ImageCleaner on your AKS cluster
111
+
## Enable Image Cleaner on your AKS cluster
112
112
113
113
To create a new AKS cluster using the default interval, use [az aks create][az-aks-create]:
114
114
@@ -124,19 +124,19 @@ az aks update -g MyResourceGroup -n MyManagedCluster \
124
124
--enable-image-cleaner
125
125
```
126
126
127
-
The `--image-cleaner-interval-hours` parameter can be specified at creation time or for an existing cluster. For example, the following command updates the interval for a cluster with ImageCleaner already enabled:
127
+
The `--image-cleaner-interval-hours` parameter can be specified at creation time or for an existing cluster. For example, the following command updates the interval for a cluster with Image Cleaner already enabled:
128
128
129
129
```azurecli-interactive
130
130
az aks update -g MyResourceGroup -n MyManagedCluster \
131
131
--image-cleaner-interval-hours 48
132
132
```
133
133
134
134
After the feature is enabled, the `eraser-controller-manager-xxx` pod and `collector-aks-xxx` pod will be deployed.
135
-
Based on your configuration, ImageCleaner will generate an `ImageList` containing non-running and vulnerable images at the desired interval. ImageCleaner will automatically remove these images from cluster nodes.
135
+
Based on your configuration, Image Cleaner will generate an `ImageList` containing non-running and vulnerable images at the desired interval. Image Cleaner will automatically remove these images from cluster nodes.
136
136
137
137
## Manually remove images
138
138
139
-
To manually remove images from your cluster using ImageCleaner, first create an `ImageList`. For example, save the following as `image-list.yml`:
139
+
To manually remove images from your cluster using Image Cleaner, first create an `ImageList`. For example, save the following as `image-list.yml`:
140
140
141
141
```yml
142
142
apiVersion: eraser.sh/v1alpha1
@@ -154,11 +154,11 @@ And apply it to the cluster:
154
154
kubectl apply -f image-list.yml
155
155
```
156
156
157
-
A job named `eraser-aks-xxx`will be triggered which causes ImageCleaner to remove the desired images from all nodes.
157
+
A job named `eraser-aks-xxx`will be triggered which causes Image Cleaner to remove the desired images from all nodes.
158
158
159
-
## Disable ImageCleaner
159
+
## Disable Image Cleaner
160
160
161
-
To stop using ImageCleaner, you can disable it via the `--disable-image-cleaner` flag:
161
+
To stop using Image Cleaner, you can disable it via the `--disable-image-cleaner` flag:
162
162
163
163
```azurecli-interactive
164
164
az aks update -g MyResourceGroup -n MyManagedCluster
0 commit comments