{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled -}}
{{- $component := "enterprise-rbac" -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "anchore-engine.enterprise.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
data:
  config.yaml: |
    # Anchore Enterprise Service Configuration File

    # General system-wide configuration options, these should not need to
    # be altered for basic operation
    #
    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ default "/scratch" .Values.anchoreAnalyzer.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}

    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: False
    license_file: "/license.yaml"

    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}

    credentials:
      database:
        db_connect: "postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        db_connect_args:
          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
          ssl: {{ .Values.anchoreGlobal.dbConfig.ssl }}
        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}

    services:
      # This should never be exposed outside of linked containers/localhost. It is used only for internal service access
      rbac_authorizer:
        enabled: True
        require_auth: True
        endpoint_hostname: localhost
        listen: 127.0.0.1
        port: {{ .Values.anchoreEnterpriseRbac.service.authPort }}
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
      rbac_manager:
        enabled: True
        require_auth: True
        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}"
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
{{- end -}}
