Confirmed with latest oc client, the issue has fixed: [root@dhcp-140-138 roottest]# oc version -o yaml clientVersion: buildDate: "2020-04-04T06:05:10Z" compiler: gc gitCommit: 081196cac40a01e541152175cc4da92d3a5ab07d gitTreeState: clean gitVersion: 4.3.11-202004040552-081196c goVersion: go1.12.12 major: "" minor: "" platform: linux/amd64 openshiftVersion: 4.3.12 serverVersion: buildDate: "2020-04-09T20:15:09Z" compiler: gc gitCommit: 65ad866 gitTreeState: clean gitVersion: v1.16.2 goVersion: go1.12.12 major: "1" minor: 16+ platform: linux/amd64 Bind the default account with role system:image-pruner [root@dhcp-140-138 roottest]# cat /tmp/role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: testzy subjects: - kind: ServiceAccount namespace: testzy name: default roleRef: kind: ClusterRole name: system:image-pruner create the pod: [root@dhcp-140-138 roottest]# cat /tmp/ccci.yaml apiVersion: v1 kind: Pod metadata: name: cli labels: name: cli spec: containers: - name: cli image: docker.io/zhouying7780/cli command: [ "oc" ] args: - "adm" - "prune" - "images" - "--force-insecure=true" - "--prune-registry=false" - "--confirm" [root@dhcp-140-138 roottest]# oc logs -f po/cli Only API objects will be removed. No modifications to the image registry will be made. Deleted 0 objects.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1393