Cleaning up of old image versions

[dnaeon]

/kind cleanup

What would you like to be added:

In #5262 we have been discussing whether old images should be kept or cleaned up from the config/images/images.yaml file.

Several points have been raised:

• Whether an image should be kept only if still being used by the last 3 Gardener releases (according to the supported release cycle)
• Whether we should cleanup images at all

Why is this needed:

Cleaning up images is needed, because we don't want to vendor every single version of an upstream image.

Not cleaning them up means that Gardener is potentially serving vulnerable images to anyone running an old(er) release of Gardener.

[dnaeon]

cc: @dimityrmirchev , @rrhubenov , @rfranzke

[rfranzke]

Whether an image should be kept only if still being used by the last 3 Gardener releases (according to the supported release cycle)
Not cleaning them up means that Gardener is potentially serving vulnerable images to anyone running an old(er) release of Gardener.

Maybe, but even old (maybe vulnerable) Kubernetes images are not cleaned up. In the end, this probably should be the decision of the one (indirectly) deploying the images. If they use an old version of Gardener, obviously, the deployed images might also be old.

We can think about a garbage collection policy, but I would vote for long periods to give everybody enough time to upgrade.

[gardener-ci-robot]

The Gardener project currently lacks enough active contributors to adequately respond to all issues.
This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 60d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 60d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as active with /lifecycle active
• Mark this issue as frozen with /lifecycle frozen
• Mark this issue as fresh with /remove-lifecycle stale
• Mark this issue as rotten with /lifecycle rotten
• Close this issue with /close

/lifecycle stale