Use secure or insecure connections

Configure secure or insecure flags when pruning images to communicate with image registries. Setting custom CA certificates or bypassing HTTPS verification prevents connection failures during pruning.

The secure connection is the preferred and recommended approach. It is done over HTTPS protocol with a mandatory certificate verification. The prune command always attempts to use it if possible. If it is not possible, in some cases it can fall-back to insecure connection, which is dangerous. In this case, either certificate verification is skipped or plain HTTP protocol is used.

The fall-back to insecure connection is allowed in the following cases unless --certificate-authority is specified:

  1. The prune command is run with the --force-insecure option.

  2. The provided registry-url is prefixed with the http:// scheme.

  3. The provided registry-url is a local-link address or localhost.

  4. The configuration of the current user allows for an insecure connection. This can be caused by the user either logging in using --insecure-skip-tls-verify or choosing the insecure connection when prompted.

Important

If the registry is secured by a certificate authority different from the one used by Red Hat OpenShift Container Platform, it must be specified using the --certificate-authority flag. Otherwise, the prune command fails with an error.

← Previous: Run image prune operations | ↑ Up: Manually pruning images | ⌂ Home: Red Hat OpenShift Container Platform | Next: Image pruning CLI options →