---
name: containers-ts-cluster-portieris
title: Why is my Portieris cluster image security enforcement installation canceled?
description: '[Virtual Private Cloud] [Classic infrastructure]'
last-updated: 2025-03-13
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why is my Portieris cluster image security enforcement installation canceled?
{: #portieris_enable}
{: support}

[Virtual Private Cloud]{: tag-vpc} [Classic infrastructure]{: tag-classic-inf}


Portieris image security enforcement add-on does not install.  You see a master status similar to the following:
{: tsSymptoms}

```sh
Image security enforcement update canceled. CAE008: can't enable Portieris image security enforcement because the cluster already has a conflicting image admission controller installed. For more information, see the troubleshooting docs: 'https://ibm.biz/portieris_enable'
```
{: screen}


Your cluster has a conflicting image admission controller already installed, which prevents the image security enforcement cluster add-on from installing.
{: tsCauses}

When you have more than one image admission controller in your cluster, pods might not run.

Potential conflicting image admission controller sources include:
*   The deprecated container image security enforcement Helm chart.
*   A previous manual installation of the open source [Portieris](https://github.com/IBM/portieris){: external} project.


Identify and remove the conflicting image admission controller.
{: tsResolve}

1. Check for existing image admission controllers.
    *   Check if you have an existing container image security enforcement deployment in your cluster. If no output is returned, you don't have the deployment.
        ```sh
        kubectl get deploy cise-ibmcloud-image-enforcement -n ibm-system
        ```
        {: pre}

        Example output
        ```sh
        NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
        cise-ibmcloud-image-enforcement   3/3     3            3           129m
        ```
        {: pre}

    *   Check if you have an existing Portieris deployment in your cluster. If no output is returned, you don't have the deployment.
        ```sh
        kubectl get deployment --all-namespaces -l app=portieries
        ```
        {: pre}

        Example output
        ```sh
        NAMESPACE     NAME        READY   UP-TO-DATE   AVAILABLE   AGE
        portieris     portieris   3/3     3            3           8m8s
        ```
        {: pre}

2. Uninstall the conflicting deployment.
    ```sh
    kubectl delete deployment <deployment> -n <namespace>
    ```
    {: pre}
    
3. Confirm that conflicting admission controllers are removed by checking that the cluster no longer has a mutating webhook configuration for an image admission controller.
    ```sh
    kubectl get MutatingWebhookConfiguration image-admission-config
    ```
    {: pre}

    Example output

    ```sh
    Error from server (NotFound): mutatingwebhookconfigurations.admissionregistration.k8s.io "image-admission-config" not found
    ```
    {: pre}

4. Retry the installing the add-on by running the `ibmcloud ks cluster image-security enable` command.