ECR lifecycle policy support

[kichik]

I have an ECR lifecycle policy that only keeps the two latest images in certain repositories. It doesn't seem to apply to the image indexes pushed for SOCI. Is there a way to configure the policy to delete the indexes along with their images? The indexes are not huge, but they can add up.

Hopefully there is a good way in the policy itself without creating a separate cron job to clean it up.

[jlbutler]

Hi @kichik

Depending on how you've configured your LCP, it could be that you're missing the indexes based on their tag values. The index should be tagged with a sha256-N tag, where N is the digest of the subject image.

You can try an create a rule with a sha256- prefix, and set that at a higher priority in the policy. That should clear out the index manifests (and if those align with your image, then you'd retain the two latest along w/ their indices).

Hope that helps, holler back if not. Thanks!

[kichik]

Thanks @jlbutler!

I didn't even consider I can control this. My assumption was it's objects attached to my image and therefore out of my control. To be honest, I do wish it was that way.

Your suggestion about creating a rule for sha256- prefix does help with the image index, but I am still having trouble with the soci index. My current rule, before any soci related changes, is to expire any untagged image older than a day. In this case only one of my images has the latest tag and the rest of the images are not important. I set the 1 day rule so anything still using the image while it's being replaced doesn't get caught off guard.

I think I'm going to try to modify the way I push soci indexes to add a tag there as well. Something like soci-N should allow me to create another rule like the one you suggested for the image index.

[kichik]

I couldn't figure out how to tag the soci index. I ended up trying your solution verbatim and I was surprised to learn it just works.

I don't understand why it works. Which part of the policy above deletes the old soci index but keeps the new one? Does LCP automatically delete the soci index attached to the deleted index manifest? That's the only explanation I could think of. But when I delete the index manifest manually, it doesn't also delete the soci index, so I feel like I'm missing something.