Artifact Lifecycle Policies

Artifact Lifecycle Policies are rules that delete data from Anchore Enterprise automatically once it is no longer needed. A system administrator creates a rule, and Anchore Enterprise evaluates it on a schedule and deletes everything it selects. For example, a rule can delete any image analyzed more than 180 days ago, or any Application Version that has been end-of-life (EOL) for more than 90 days.

There are two kinds of rule, one for each kind of data:

• Application Version rules delete Application Versions that have been marked EOL for at least a given number of days, together with their assets. Application Version rules were introduced in Anchore Enterprise v6.3.0.
• Image rules delete images in the image catalog that were analyzed more than a given number of days ago. An image used by an Application Version asset is never selected by an image rule.

Artifact Lifecycle Policies operate on the working set (the catalog of currently tracked artifacts), not on any archived data. When artifacts are added or updated in the working set, they are added to the reporting dataset. When artifacts are removed from the working set (for example, by a lifecycle policy deletion), they are removed from the reporting dataset, provided enable_data_egress is enabled in the reporting service configuration.

Warnings

How Rules Are Evaluated

Anchore Enterprise evaluates the enabled rules every 12 hours by default, and deletes everything a rule selects at that moment. Each run reads the current state of the system, so a change to a rule, or to an Application Version’s status, takes effect at the next run.

• Rules are created disabled. A rule does nothing until you enable it, so you can create it, check what it would delete with a dry run, and then enable it.
• Several rules combine. When more than one rule of the same kind is enabled, an item is deleted if any rule selects it. With two Application Version rules of 30 and 60 days, the effective threshold is 30 days.
• Thresholds are whole days. The threshold is measured to midnight UTC, so an item becomes eligible on the first run after midnight UTC once the full number of days has passed. An item is never deleted early.
• Every rule change is recorded. Updating a rule’s rule set creates a new rule-set version. Earlier versions remain readable, so you can see which version of a rule deleted an item.
• There is a limit of 100 rules across both kinds of rule, for the whole installation.

Each deletion raises an event for audit and notification purposes. See Events.

Application Version Rules

An Application Version rule selects every Application Version whose status is eol and has been eol for at least days_since_eol days. For each selected version, Anchore Enterprise deletes:

• the Application Version itself, and all of its metadata, including its VEX annotations
• every asset attached to the version
• any image or imported SBOM that the deleted assets used, if no other asset still uses it

The Application that owns the version is not deleted, even when its last version is removed. Delete empty Applications yourself. For more on Application Version statuses, see Creating and Managing App Versions.

Moving a version out of eol and back again restarts its EOL time.

Create an Application Version Rule

anchorectl system artifact-lifecycle-policy app-versions add \
  --action=delete \
  --name="delete-eol-versions" \
  --description="Delete versions EOL for 90 days" \
  --days-since-eol=90 \
  --enable=false

--action, --name and --days-since-eol are required. --days-since-eol must be at least 1. Leave --enable at its default of false until you have checked the rule with a dry run.

Update an Application Version Rule

Every parameter that decides what is deleted must be given again on an update, including --enable:

anchorectl system artifact-lifecycle-policy app-versions update <policy-uuid> \
  --action=delete \
  --name="delete-eol-versions" \
  --days-since-eol=90 \
  --enable=true

Pass --description="" to clear the description. Omit --description to leave it unchanged.

List, Get and Delete Application Version Rules

anchorectl system artifact-lifecycle-policy app-versions list
anchorectl system artifact-lifecycle-policy app-versions get <policy-uuid>
anchorectl system artifact-lifecycle-policy app-versions delete <policy-uuid>

Image Rules

An image rule selects images in the image catalog by the date of their latest analysis. An image that is used by any Application Version asset is never selected, whatever the rule’s settings. It becomes eligible once no asset uses it.

Inclusion Rules

All of these criteria must be met for an image rule to select an image:

• days_since_analyzed
  • Selects images whose latest analysis is at least n days old. Must be at least 1.
  • An image that has not been analyzed, because it failed analysis or its analysis is pending, is not selected unless include_failed_analysis is true.
• even_if_exists_in_runtime_inventory
  • When true, an image is selected even if it exists in the Runtime Inventory.
  • When false, an image is not selected if it exists in the Runtime Inventory, which protects images found in your runtime inventory. This is the default. See Inventory Time-To-Live for how to prune the Runtime Inventory.
• include_base_images
  • When true, images that have ancestral children are selected. This is the default.
  • When false, images that have ancestral children are not selected. These are evaluated on every run, so as children are deleted, a previously excluded parent image can become eligible.
• include_failed_analysis
  • When true, images in a failed analysis state are selected. When an image has no analyzed_at date, its created_at date is used.
  • When false, images in a failed analysis state are not selected. This is the default.

Create an Image Rule

Because of the destructive nature of these rules, AnchoreCTL requires every inclusion rule to be set explicitly:

anchorectl system artifact-lifecycle-policy images add \
  --action=delete \
  --name="delete-old-images" \
  --description="Delete images analyzed more than 180 days ago" \
  --days-since-analyzed=180 \
  --even-if-exists-in-runtime=false \
  --include-base-images=false \
  --include-failed-analysis=false \
  --enable=false

Update an Image Rule

anchorectl system artifact-lifecycle-policy images update <policy-uuid> \
  --action=delete \
  --name="delete-old-images" \
  --days-since-analyzed=120 \
  --even-if-exists-in-runtime=false \
  --include-base-images=false \
  --include-failed-analysis=false \
  --enable=true

List, Get and Delete Image Rules

anchorectl system artifact-lifecycle-policy images list
anchorectl system artifact-lifecycle-policy images get <policy-uuid>
anchorectl system artifact-lifecycle-policy images delete <policy-uuid>

Deleting a rule stops it being evaluated. It does not restore anything the rule has already deleted.

Preview a Rule with a Dry Run

A dry run evaluates a rule set without creating it and reports what it would delete if it ran now. Nothing is stored, no rule is created, and no event is raised. Send the same body you would use to create the rule:

• POST /v2/system/artifact-lifecycle-policies/app-versions/dry-run
• POST /v2/system/artifact-lifecycle-policies/images/dry-run

The response gives the number of items the rule would delete (selected_count) out of the items it could ever select (qualifying_count) - for example, 3 of 24 EOL Application Versions - along with the total number of items of that kind (total_count) and a list of the selected items. Each Application Version item names the version and the Application that owns it.

A dry run evaluates only the rule you submit. It does not account for other rules that are already enabled, so selected_count is not necessarily the number of additional items that enabling the rule would delete.

Manage Rules with the API

Each kind of rule has its own set of endpoints:

The list responses include policy_count and policy_limit, which describe the installation-wide rule limit across both kinds of rule. See the API browser for request and response schemas; search for the Artifact Lifecycle tag.

Events

Artifact Lifecycle Policies raise system events of type system.artifact_lifecycle_policy.<event>, which you can deliver through Notifications. Every event names the rule that produced it and the rule-set version that was in force.