The vulnerability checks is picking up older version of apps/software which are from /apps/data/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/XX/fs/usr/lib on our Kubernetes nodes.
We cannot manually clean up snapshots folder in kubernetes cluster, so how do we trigger GC or any other process to clean older images?
pods are prepared using latest apps/software and redeployed.
kubectl -n my_ns get pods
This returns latest pods.
kubectl -n my_ns exec -it <pod> /bin/bash
$openssh version
When going inside, check the latest version (above is just one example).
So the above location (/apps/data/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/XX/fs/usr/lib) picked up is older version and not the active pod.
How do we ask kubectl to remove anything from snapshots folder not used by current pods in cluster?
If i check https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/#create-the-config-file to change config file of kubectl , all evictionHard parameters are based on memory or fs size. Nothing for older containers/pods or such condition.
Even if restarting the pods helps with some config (kubectl delete ), helps, it will be useful.
Please help.
