feat: support Minimum Image Age

README.md

@@ -3,8 +3,8 @@
 This cleans up an ECR repo based on the following rules.
 
 1. Is a container currently referenced in the same K8s cluster that this job is running in
-1. Has the container been pushed in the last 7 days
-1. Has the container been pulled in the last 7 days
+1. Has the container been pushed in the last MINIMUM_IMAGE_AGE days (default: 7)
+1. Has the container been pulled in the last MINIMUM_IMAGE_AGE days (default: 7)
 1. Has the container been tagged with the word `keep`
 1. Is the container the only tag in the ECR repository
 

charts/ecr-cleanup/Chart.yaml

@@ -3,7 +3,7 @@ name: ecr-cleanup
 description: |
   Deploys a job that cleans up an ECR repo based on the following rules.
   1. Is a container currently referenced in the same K8s cluster that this job is running in
-  2. Has the container been pulled in the last 7 days
+  2. Has the container been pulled in the last MINIMUM_IMAGE_AGE days (default: 7)
   3. Has the container been tagged with the word `keep`
   4. Is the container the only tag in the ECR repository
 

charts/ecr-cleanup/README.md

@@ -2,7 +2,7 @@
 
 Deploys a job that cleans up an ECR repo based on the following rules.
 1. Is a container currently referenced in the same K8s cluster that this job is running in
-2. Has the container been pulled in the last 7 days
+2. Has the container been pulled in the last MINIMUM_IMAGE_AGE days (default: 7)
 3. Has the container been tagged with the word `keep`
 4. Is the container the only tag in the ECR repository
 
@@ -23,6 +23,7 @@ Deploys a job that cleans up an ECR repo based on the following rules.
 | image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
 | imagePullSecrets | list | `[]` | List of imagePullSecrets to use when getting images |
 | logLevel | string | `"INFO"` | Configure Log level of application |
+| minimumImageAge | int | `7` | Minimum image age in days to consider for cleanup |
 | nameOverride | string | `""` | Overriding the Name |
 | podAnnotations | object | `{}` | Annotations to add to the pod |
 | podSecurityContext | object | `{}` | Security Context for Pod |

charts/ecr-cleanup/templates/cronjob.yaml

@@ -33,6 +33,8 @@ spec:
                   value: "{{ .Values.awsRegistryId }}"
                 - name: LOG_LEVEL
                   value: "{{ .Values.logLevel }}"
+                - name: MINIMUM_IMAGE_AGE
+                  value: "{{ .Values.minimumImageAge }}"
                 {{- if .Values.dryRun }}
                 - name: DRY_RUN
                   value: "{{ .Values.dryRun }}"

charts/ecr-cleanup/values.yaml

@@ -46,13 +46,11 @@ serviceAccount:
 podAnnotations: {}
 
 # -- Security Context for Pod
-podSecurityContext:
-  {}
+podSecurityContext: {}
   # fsGroup: 2000
 
 # -- Security Context for container in cronjob
-securityContext:
-  {}
+securityContext: {}
   # capabilities:
   #   drop:
   #   - ALL
@@ -61,8 +59,7 @@ securityContext:
   # runAsUser: 1000
 
 # -- Resources for container in cronjob
-resources:
-  {}
+resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
   # resources, such as Minikube. If you do want to specify resources, uncomment the following
@@ -76,3 +73,6 @@ resources:
 
 ## -- ENV variables to pass to cronjob
 extraEnvs: []
+
+# -- Minimum image age in days to consider for cleanup
+minimumImageAge: 7

main.py

@@ -260,7 +260,7 @@ def get_ecr_repositories(
 
 
 def get_ecr_images(
-    client: boto3.client, registry_id: str, repositories: list
+    client: boto3.client, registry_id: str, repositories: list, minimum_image_age: int
 ) -> tuple[list, dict]:  # pragma: no cover
     """
     :param client boto3.client:
@@ -283,9 +283,13 @@ def get_ecr_images(
                 )
                 if "lastRecordedPullTime" in imageDetails:
                     last_pull_time = imageDetails["lastRecordedPullTime"]
-                    localized_now_ts = UTC.localize(datetime.now() - timedelta(7))
+                    localized_now_ts = UTC.localize(
+                        datetime.now() - timedelta(minimum_image_age)
+                    )
                     if last_pull_time > localized_now_ts:
-                        logger.debug("The last pulltime was more than 7 days ago")
+                        logger.debug(
+                            f"The last pulltime was more than {minimum_image_age} days ago. Skipping image."
+                        )
                         logger.info(
                             f"Image {repository['repository_uri']}@{imageDetails[0]['imageDigest']} is the only image in the repository skipping and hasn't been pulled in 7 days, consider deleting"
                         )
@@ -476,6 +480,7 @@ def main():  # pragma: no cover
     except config.config_exception.ConfigException:
         config.load_incluster_config()
 
+    minimum_image_age: int = int(os.getenv("MINIMUM_IMAGE_AGE", "7"))
     client = boto3.client("ecr")
     if os.getenv("AWS_REGISTRY_ID"):
         registry_id = os.getenv("AWS_REGISTRY_ID")
@@ -488,7 +493,9 @@ def main():  # pragma: no cover
             )
             sys.exit(1)
     repositories = get_ecr_repositories(client, registry_id)
-    ecr_images, artifact_index = get_ecr_images(client, registry_id, repositories)
+    ecr_images, artifact_index = get_ecr_images(
+        client, registry_id, repositories, minimum_image_age
+    )
     k8s_images = get_images_from_workloads()
     for image in ecr_images:
         logger.debug(f"{image=}")