kind: ConfigMap
apiVersion: v1
metadata:
  name: "{{ template "core.fullname" . }}"
  labels:
    app: "{{ template "fullname" . }}"
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    component: core
data:
  config.yaml: |
    # Anchore Service Configuration File from ConfigMap
    service_dir: {{ .Values.globalConfig.configDir }}
    tmp_dir: "/tmp"

    allow_awsecr_iam_auto: {{ .Values.globalConfig.allowECRUseIAMRole }}
    cleanup_images: {{ .Values.globalConfig.cleanupImages }}

    log_level: {{ .Values.coreConfig.logLevel }}
    host_id: ${ANCHORE_POD_NAME}
    internal_ssl_verify: {{ .Values.globalConfig.internalServicesSslVerifyCerts }}

    metrics:
      enabled: {{ .Values.globalConfig.enableMetrics }}

    # Uncomment if you have a local endpoint that can accept
    # notifications from the anchore-engine, as configured below
    #
    {{ if .Values.coreConfig.webhooks.enabled }}
    webhooks:
{{ toYaml .Values.coreConfig.webhooks.config | indent 6 }}
    {{ end }}

    # Configure what feeds to sync. The 'admin' anchoreIO credentials are used if present, but not required.
    # The 'anonymous' user is used for the sync otherwise.
    # The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
    feeds:
      selective_sync:
        # If enabled only sync specific feeds instead of all that are found.
        enabled: True
        feeds:
          # Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
          vulnerabilities: True
          # NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
          nvd: True
          # Warning: enabling the package sync causes the service to require much
          #   more memory to do process the significant data volume. We recommend at least 4GB available for the container
          packages: False
    #  anonymous_user_username: anon@ancho.re
    #  anonymous_user_password: pbiU2RYZ2XrmYQ
    #  url: 'https://ancho.re/v1/service/feeds'
    #  client_url: 'https://ancho.re/v1/account/users'
    #  token_url: 'https://ancho.re/oauth/token'
    #  connection_timeout_seconds: 3
    #  read_timeout_seconds: 60

    credentials:
      users:
        admin:
          password: ${ANCHORE_ADMIN_PASSWORD}
          email: {{ .Values.globalConfig.users.admin.email }}
          external_service_auths:
          {{ if not .Values.globalConfig.users.admin.anchoreIOCredentials.useAnonymous }}
            anchoreio:
              anchorecli:
                auth: "${ANCHORE_IO_USER}:${ANCHORE_IO_PASSWORD}"
          {{ end }}
          auto_policy_sync: {{ .Values.coreConfig.policyBundleSyncEnabled }}

      database:
        {{ if .Values.postgresql.enabled }}
        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@{{ template "postgres.fullname" . }}:5432/{{ .Values.postgresql.postgresDatabase }}'
        {{ else }}
        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@{{ .Values.postgresql.externalEndpoint}}/{{ .Values.postgresql.postgresDatabase }}'
        {{ end }}
        db_connect_args:
          timeout: 120
          ssl: {{ .Values.postgresql.sslEnabled }}
        db_pool_size: {{ .Values.globalConfig.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.globalConfig.dbConfig.connectionPoolSize }}
    services:
      apiext:
        enabled: True
        require_auth: True
        endpoint_hostname: {{ template "fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.service.ports.api }}
        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
      kubernetes_webhook:
        enabled: True
        require_auth: False
        endpoint_hostname: {{ template "fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.service.ports.k8sImagePolicyWebhook }}
        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
      catalog:
        enabled: True
        require_auth: True
        endpoint_hostname: {{ template "fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.service.ports.catalog }}
        use_db: True
        cycle_timer_seconds: '1'
        cycle_timers:
{{ toYaml .Values.globalConfig.cycleTimers | indent 10 }}
        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
        event_log:
{{ toYaml .Values.coreConfig.events | indent 10 }}
        archive:
{{ toYaml .Values.coreConfig.archive | indent 10 }}
      simplequeue:
        enabled: True
        require_auth: True
        endpoint_hostname: {{ template "fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.service.ports.queue }}
        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
      policy_engine:
        enabled: True
        require_auth: True
        endpoint_hostname: {{ template "fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.service.ports.policy }}
        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
