kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ template "anchore-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
data:
  ANCHORE_DB_NAME: {{ index .Values "postgresql" "postgresDatabase" | quote }}
  ANCHORE_DB_USER: {{ index .Values "postgresql" "postgresUser" | quote }}
  {{- if and (index .Values "postgresql" "externalEndpoint") (not (index .Values "postgresql" "enabled")) }}
  ANCHORE_DB_HOST: {{ index .Values "postgresql" "externalEndpoint" | quote }}
  {{- else }}
  ANCHORE_DB_HOST: "{{ template "postgres.fullname" . }}:5432"
  {{- end }}

  config.yaml: |
    # Anchore Service Configuration File from ConfigMap

    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ default "/scratch" .Values.anchoreAnalyzer.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}

    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: false

    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}

    # Uncomment if you have a local endpoint that can accept
    # notifications from the anchore-engine, as configured below
    #
    {{ if .Values.anchoreGlobal.webhooksEnabled }}
    webhooks:
{{ toYaml .Values.anchoreGlobal.webhooks | indent 6 }}
    {{ end }}

    # Configure what feeds to sync. The 'admin' anchoreIO credentials are used if present, but not required.
    # The 'anonymous' user is used for the sync otherwise.
    # The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
    feeds:
      sync_enabled: true
      selective_sync:
        # If enabled only sync specific feeds instead of all that are found.
        enabled: true
        feeds:
          # Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
          vulnerabilities: {{ default "true" .Values.anchoreGlobal.syncVulnerabilites }}
          # NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
          nvd: {{ default "true" .Values.anchoreGlobal.syncNvd }}
          # Warning: enabling the package sync causes the service to require much
          #   more memory to do process the significant data volume. We recommend at least 4GB available for the container
          {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
          packages: true
          {{- else }}
          packages: {{ default "false" .Values.anchoreGlobal.syncPackages }}
          {{- end }}
          # Enabling snyk syncs snyk vulnerability data from an on-premise anchore enterprise feeds service. Please contact
          # anchore support for finding out more about this service
          {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
          snyk: {{ default "true" .Values.anchoreEnterpriseFeeds.synkDriverEnabled }}
          {{- else }}
          snyk: false
          {{- end }}
      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
      url: "http://{{ template "anchore-engine.enterprise-feeds.fullname" . }}:{{ .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
      client_url:
      token_url:
      {{- else }}
      client_url: "https://ancho.re/v1/account/users"
      token_url: "https://ancho.re/oauth/token"
      anonymous_user_username: anon@ancho.re
      anonymous_user_password: pbiU2RYZ2XrmYQ
      {{- end }}
      connection_timeout_seconds: {{ default 3 .Values.anchoreGlobal.feedsConnectionTimeout }}
      read_timeout_seconds: {{ default 60 .Values.anchoreGlobal.feedsReadTimeout }}

    default_admin_password: ${ANCHORE_ADMIN_PASSWORD}
    default_admin_email: {{ .Values.anchoreGlobal.defaultAdminEmail }}

    credentials:
      database:
        db_connect: "postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        db_connect_args:
          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
          ssl: {{ .Values.anchoreGlobal.dbConfig.ssl }}
        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}

    services:
      apiext:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreApi.service.port }}
        {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}"
        {{- end }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
      analyzer:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.analyzer.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreAnalyzer.containerPort }}
        cycle_timer_seconds: 1
        cycle_timers:
{{ toYaml .Values.anchoreAnalyzer.cycleTimers | indent 10 }}
        max_threads: {{ .Values.anchoreAnalyzer.concurrentTasksPerWorker }}
        analyzer_driver: 'nodocker'
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{ .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
      catalog:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.catalog.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreCatalog.service.port }}
        cycle_timer_seconds: 1
        cycle_timers:
{{ toYaml .Values.anchoreCatalog.cycleTimers | indent 10 }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        event_log:
{{ toYaml .Values.anchoreCatalog.events | indent 10 }}
        archive:
{{ toYaml .Values.anchoreCatalog.archive | indent 10 }}
      simplequeue:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.simplequeue.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreSimpleQueue.service.port }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
      policy_engine:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.policy-engine.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchorePolicyEngine.service.port }}
        cycle_timer_seconds: 1
        cycle_timers:
{{ toYaml .Values.anchorePolicyEngine.cycleTimers | indent 10 }}
        ssl_cert: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "{{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
