// Module included in the following assemblies:
//
// * applications/pruning-objects.adoc

:_mod-docs-content-type: REFERENCE
[id="pruning-images-troubleshooting_{context}"]
= Image pruning issues

[role="_abstract"]
Identify the image pruning issues in your cluster to diagnose unpruned images, manage tag revision thresholds, and fix connection or certificate authority errors between the CLI client and registry.

Images not being pruned::

If your images keep accumulating and the `prune` command removes just a small
portion of what you expect, ensure that you understand the image prune
conditions that must apply for an image to be considered a candidate for
pruning.
+
Ensure that images you want removed occur at higher positions in each tag
history than your chosen tag revisions threshold. For example, consider an old
and obsolete image named `sha256:abz`. By running the following command in your
namespace, where the image is tagged, the image is tagged three times in a
single image stream named `myapp`:
+
[source,terminal]
----
$ oc get is -n <namespace> -o go-template='{{range $isi, $is := .items}}{{range $ti, $tag := $is.status.tags}}'\
'{{range $ii, $item := $tag.items}}{{if eq $item.image "sha256:<hash>"}}{{$is.metadata.name}}:{{$tag.tag}} at position {{$ii}} out of {{len $tag.items}}\n'\
'{{end}}{{end}}{{end}}{{end}}'
----
+
.Example output
[source,terminal]
----
myapp:v2 at position 4 out of 5
myapp:v2.1 at position 2 out of 2
myapp:v2.1-may-2016 at position 0 out of 1
----
+
When default options are used, the image is never pruned because it occurs at
position `0` in a history of `myapp:v2.1-may-2016` tag. For an image to be
considered for pruning, the administrator must either:
+
* Specify `--keep-tag-revisions=0` with the `oc adm prune images` command.
+
[WARNING]
====
This action removes all the tags from all the namespaces with underlying images, unless they are younger or they are referenced by objects younger than the specified threshold.
====

* Delete all the `istags` where the position is below the revision threshold,
which means `myapp:v2.1` and `myapp:v2.1-may-2016`.

* Move the image further in the history, either by running new builds pushing to
the same `istag`, or by tagging other image. This is not always
desirable for old release tags.
+
Tags having a date or time of a particular image's build in their names should
be avoided, unless the image must be preserved for an undefined amount of time.
Such tags tend to have just one image in their history, which prevents
them from ever being pruned.

Secure connection to an insecure registry::

If you see a message similar to the following in the output of the `oc adm prune images`
command, then your registry is not secured and the `oc adm prune images`
client attempts to use a secure connection:
+
[source,terminal]
----
error: error communicating with registry: Get https://172.30.30.30:5000/healthz: http: server gave HTTP response to HTTPS client
----
+
* The recommended solution is to secure the registry. Otherwise, you can force the
client to use an insecure connection by appending `--force-insecure`  to the
command; however, this is not recommended.

Insecure connection to a secured registry::

If you see one of the following errors in the output of the `oc adm prune images`
command, it means that your registry is secured using a certificate signed by a
certificate authority other than the one used by `oc adm prune images` client for
connection verification:
+
[source,terminal]
----
error: error communicating with registry: Get http://172.30.30.30:5000/healthz: malformed HTTP response "\x15\x03\x01\x00\x02\x02"
error: error communicating with registry: [Get https://172.30.30.30:5000/healthz: x509: certificate signed by unknown authority, Get http://172.30.30.30:5000/healthz: malformed HTTP response "\x15\x03\x01\x00\x02\x02"]
----
+
By default, the certificate authority data stored in the user's configuration files is used; the same is true for communication with the control plane API.
+
Use the `--certificate-authority` option to provide the right certificate authority for the container image registry server.

Wrong certificate authority::

The following error means that the certificate authority used to sign the certificate of the secured container image registry is different from the authority used by the client:
+
[source,terminal]
----
error: error communicating with registry: Get https://172.30.30.30:5000/: x509: certificate signed by unknown authority
----
+
Make sure to provide the right one with the flag `--certificate-authority`.
+
As a workaround, the `--force-insecure` flag can be added instead. However, this is not recommended.
