Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for ImageCleaner on AKS #19916

Merged
merged 2 commits into from
Aug 1, 2022
Merged

Add support for ImageCleaner on AKS #19916

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b4b0ae
Add support for ImageCleaner on AKS
jiashun0011 Jul 25, 2022
4da4ac3
add more context in ImageCleaner description
jiashun0011 Jul 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions ...source-manager/Microsoft.ContainerService/preview/2022-07-02-preview/managedClusters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6039,6 +6039,10 @@
"$ref": "#/definitions/ManagedClusterSecurityProfileWorkloadIdentity",
"description": "[Workload Identity](https://azure.github.io/azure-workload-identity/docs/) settings for the security profile."
},
"imageCleaner": {
"$ref": "#/definitions/ManagedClusterSecurityProfileImageCleaner",
"description": "ImageCleaner settings for the security profile."
},
"nodeRestriction": {
"$ref": "#/definitions/ManagedClusterSecurityProfileNodeRestriction",
"description": "[Node Restriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) settings for the security profile."
Expand Down Expand Up @@ -6158,6 +6162,21 @@
},
"description": "Workload Identity settings for the security profile."
},
"ManagedClusterSecurityProfileImageCleaner": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether to enable ImageCleaner on AKS cluster."
},
"intervalHours": {
"type": "integer",
"format": "int32",
"description": "ImageCleaner scanning interval."
}
},
"description": "ImageCleaner settings for the security profile."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@miwithro - do we want to actually document/link to the underlying implementation here? Or do we have a documentation page we can link to that explains what this does?

IMO we need to say a bit more about what ImageCleaner is doing. Something like: `ImageCleaner removes unused images from nodes, freeing up disk space and helping to reduce attack surface area. For more information see this article

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@matthchr @jiashun0011 I agree with adding more context in the API. Worst case we can add a link to the document.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@matthchr @miwithro

Fixed and because we don't have any external docs to clients, so I didn't attach the doc link in the description.

},
"ManagedClusterSecurityProfileNodeRestriction": {
"type": "object",
"properties": {
Expand Down