Image management features

The SC//Reliant™ platform provides three container image management features that work together to keep your container images secure, fast to deploy, and tidy on disk.

• Image Signing enforces signature validation on all container images, so only images signed by your trusted keys are allowed to run.
• Image Pruning schedules automatic removal of unused container images, keeping local storage clean over time.
• Image Staging pre-pulls container images in the background before version updates, which makes deployments faster on slower network links.

All three features are configured through the Image Management hash on a node group. Each feature has its own deep-dive page with parameter reference, enabling and disabling procedures, and troubleshooting guidance.

Going deeper

• Using container image signing: how to sign your images with Cosign, add your public key to RPM, and turn on signature validation across the fleet.
• Using container image pruning: how to schedule automatic cleanup of unused container images.
• Using container image staging: how to pre-pull container images in the background ahead of deployments.

Considerations that apply to all three features

• If image signature validation fails during a Puppet run, no containers are updated.
• If you turn on signature validation, all of your container images that are pulled will be validated on each Puppet run. It is not possible to disable signature validation on specific images.
• While there is no hard limit on the number of public keys you can add to your tenant in RPM, we recommend limiting the keys to five to keep image pulls fast.

Cron expression reference

Image Pruning and Image Staging both use standard cron expressions to define their schedules. The table below shows common patterns.

Inheritance dropdown

Each parameter field in the Image Management hash includes a small gray ▾ (dropdown) button to its left. This control determines how the value for that parameter is inherited across the node group hierarchy, for example whether the value is set explicitly at this hash level or inherited from a parent group.

Profile version migration: Image Management hash location

Overview of change

The location of the Image Management hash has changed between profile versions.

Impact

In profiles prior to 9.4.0, the Image Management settings were a child of the Cluster Docker Resources hash. Beginning with profiles 9.4.0, Image Management has been promoted to its own top-level hash, independent of Cluster Docker Resources.

This structural change means that any Image Management configuration that existed under the old nested location will not be automatically carried over. If the settings are not manually copied to the new top-level hash, they will not be applied when Puppet runs against nodes using profiles 9.4.0 or later.

Migration procedure

When adopting profiles 9.4.0, complete the following steps to ensure your Image Management settings are preserved and applied correctly.

1. Locate the existing settings. In your current node group configuration, navigate to the Cluster Docker Resources hash and open the nested Image Management hash. Note or record all configured values for Image Signing, Image Pruning, and Image Staging.
2. Open the new top-level hash. Navigate to the Image Management hash at the top level of the node group hash configuration.
3. Re-enter all settings. Using the values recorded in Step 1, re-configure each setting in the new top-level Image Management hash. Refer to the Using container image signing, Using container image pruning, and Using container image staging pages for field-by-field guidance.
4. Verify the configuration. Confirm that all three features (Image Signing, Image Pruning, Image Staging) reflect the intended state (enabled or disabled) and that all parameter values match what was previously configured.
5. Save the configuration. Save the new top-level Image Management hash settings.
6. Run Puppet. Trigger a Puppet run and confirm that the Image Management policies are applied as expected on the target nodes.