#Managing Access and Cleanup

Use this page for Alauda Container Platform Registry administrator and namespace administrator tasks, including namespace image access, usage reporting, image pruning, registry garbage collection, and image signature verification.

#Task Index

#Prerequisites

• Registry is installed and available.
• You have kubectl and ac access to the target cluster.
• You have permission to create RoleBindings in the image namespace.
• You have administrator permissions for usage reporting, image pruning, registry garbage collection, and signature verification.

Select the ACP 4.4 Registry backend before using the ac administrative commands:

ac config set-registry-mode modern

Expected result:

• Subsequent ac Image API, pruning, garbage-collection, and signature commands use the ACP 4.4 Registry.

#Grant Namespace Permissions

Grant pull permission to a user:

kubectl create rolebinding image-puller-user \
  --clusterrole=system:image-puller \
  --user=<username> \
  -n <image-namespace>

Grant push permission to a user:

kubectl create rolebinding image-pusher-user \
  --clusterrole=system:image-pusher \
  --user=<username> \
  -n <image-namespace>

Grant pull permission to a service account in another namespace:

kubectl create rolebinding image-puller-sa \
  --clusterrole=system:image-puller \
  --serviceaccount=<workload-namespace>:<serviceaccount-name> \
  -n <image-namespace>

Verify the RoleBinding and effective access:

kubectl -n <image-namespace> get rolebinding

kubectl auth can-i get imagestreams/layers.image.alauda.io \
  -n <image-namespace> \
  --as=system:serviceaccount:<workload-namespace>:<serviceaccount-name>

Expected results:

• The RoleBinding exists in the image namespace.
• The kubectl auth can-i command returns yes for the service account that should pull images.

The Registry uses ImageStream layer authorization:

The system:image-pruner ClusterRole is reserved for the Operator-managed pruner ServiceAccount. It is not a namespace access role. Manual pruning and garbage collection require the corresponding administrator permissions.

For roles other than Pull and Push, grant the corresponding platform role or ClusterRole according to your authorization model, then verify the effective permission. The metrics permission is cluster-scoped; the other checks are scoped to the image namespace where applicable:

kubectl auth can-i delete images.image.alauda.io \
  --as=<username>
kubectl auth can-i create imagesignatures.image.alauda.io \
  --as=<username>
kubectl auth can-i list imagestreams.image.alauda.io \
  -n <image-namespace> \
  --as=<username>
kubectl auth can-i get registry/metrics.image.alauda.io \
  --as=<username>

Expected result:

• Each command returns yes for a principal with the corresponding effective permission. The permission can also be granted by another role.

#View Usage

Show storage and usage statistics for Images:

ac adm top images

Show storage and usage statistics for ImageStreams:

ac adm top imagestreams

Expected result:

• The command prints usage rows for Image or ImageStream resources visible to the current administrator.

#Verify Image Signatures

Verify the image signature identity recorded on an Image object:

ac adm verify-image-signature sha256:<digest> \
  --expected-identity=registry.example.com/team-a/demo:latest

Save trusted conditions back to the Image object:

ac adm verify-image-signature sha256:<digest> \
  --expected-identity=registry.example.com/team-a/demo:latest \
  --save

Verify the saved condition:

ac get images.image.alauda.io sha256:<digest> -o yaml

Expected result:

• The Image object contains the trusted signature condition saved by the verification command.

Saving trust conditions changes Image API metadata. To roll back a saved condition, edit the Image object and remove the saved condition, or restore the Image object from a known-good backup.

Remove all signature records from an Image object only when the records are no longer required:

ac adm verify-image-signature sha256:<digest> --remove-all

Warning: --remove-all removes every signature record from the Image object. This operation is not reversible through the Registry. Verify the Image object after the command and restore the metadata from a known-good backup if the records were removed by mistake.

ac get images.image.alauda.io sha256:<digest> -o yaml

#Prune Images

Confirmed pruning can permanently remove unused image metadata. If you also run registry garbage collection, unreferenced blobs can be permanently reclaimed from storage. Run these commands during a maintenance window, keep required backups, and review dry-run output before adding --confirm.

Preview image pruning:

ac adm prune images

Expected result:

• The dry run lists prune candidates and does not delete image metadata.

Run pruning after reviewing the dry-run output:

ac adm prune images \
  --keep-tag-revisions=5 \
  --keep-younger-than=72h \
  --confirm

Verify pruning:

ac adm prune images \
  --keep-tag-revisions=5 \
  --keep-younger-than=72h

Expected result:

• A follow-up dry run no longer lists the metadata that was pruned by the confirmed command.

Exclude repositories with an allow-list pattern by using --whitelist:

# Preview the effect of the allow-list pattern
ac adm prune images \
  --whitelist='^cpaas-system/.*'

# Confirm pruning only after reviewing the preview
ac adm prune images \
  --whitelist='^cpaas-system/.*' \
  --confirm

For scheduled pruning, see Setting up and configuring the registry.

Confirmed pruning is not automatically reversible. Restore pruned metadata from backup, recreate metadata from a trusted image source, or re-import the image when recovery is required.

#Run Registry Garbage Collection

Registry garbage collection reclaims unreferenced blobs from Registry storage. Blob reclamation is not reversible from the Registry after it is confirmed.

Preview registry garbage collection after metadata cleanup:

ac adm registry gc

Expected result:

• The command previews eligible unreferenced blobs and does not delete them.

Run registry garbage collection only after reviewing the preview:

ac adm registry gc --confirm

Expected result:

• The command removes eligible unreferenced blobs from Registry storage.

You can also trigger registry garbage collection as part of pruning:

ac adm prune images --confirm --prune-registry

Both ac adm prune images and ac adm registry gc are dry-run by default. Review the preview before adding --confirm. Confirmed blob reclamation is irreversible from the Registry; restore data from a storage backup or copy the image again from a trusted source if a required blob was reclaimed.

After confirmed garbage collection, verify critical images by pulling or inspecting them:

mkdir -p /tmp/registry-auth
ac registry login \
  --registry registry.example.com \
  --to /tmp/registry-auth/config.json

ac image info registry.example.com/team-a/demo:latest \
  --registry-config=/tmp/registry-auth/config.json