github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update to Anchore Engine v0.3.3 (#12014)

Browse Source 
* Update anchore engine image to use v0.3.3
* Consolidate all ingress resource values
* Upgrade to latest Redis chart version
* Increase postgres persistence to 20Gi
* Allow additional env vars from values

Signed-off-by: Brady Todhunter <bradyt@anchore.com>
This commit is contained in:
Brady Todhunter
2019-03-13 18:00:53 -07:00
committed by Kubernetes Prow Robot
parent 3a8e1c6ead
commit 2c651a910a
13 changed files with 202 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/anchore-engine/Chart.yaml
+4 -2
View File
@@ -1,6 +1,6 @@
name: anchore-engine
version: 0.11.0
appVersion: 0.3.2
version: 0.12.0
appVersion: 0.3.3
description: Anchore container analysis and policy evaluation engine service
keywords:
- analysis
@@ -9,6 +9,8 @@ keywords:
- "anchore-engine"
- image
- security
- vulnerability
- scanner
home: https://anchore.com
sources:
- https://github.com/anchore/anchore-engine
stable/anchore-engine/README.md
+35 -26
View File
@@ -43,11 +43,30 @@ The recommended way to install the Anchore Engine Chart is with a customized val
defaultAdminPassword: <PASSWORD>
defaultAdminEmail: <EMAIL>
```
## Upgrading to Chart version 0.12.0
Redis dependency chart major version updated to v6.1.3 - check redis chart readme for instructions for upgrade.
The ingress configuration has been consolidated to a single global section. This should make it easier to manage the ingress resource. Before performing an upgrade ensure you update your custom values file to reflect this change.
#### Chart v0.12.0 ingress config
```
ingress:
enabled: true
annotations:
kubernetes.io/ingress.class: gce
apiPath: /v1/*
uiPath: /*
apiHosts:
- anchore-api.example.com
uiHosts:
- anchore-ui.example.com
```
## Upgrading to Chart version 0.11.0
The image map has been removed in all configuration sections in favor of individual keys. This should make configuration for tools like skaffold simpler. If using a custom values file, update your `image.repository`, `image.tag`, & `image.pullPolicy` values with `image` & `imagePullPolicy`.
##### v0.11.0 image config
#### Chart v0.11.0 image config
```
anchoreGlobal:
image: docker.io/anchore/anchore-engine:v0.3.2
@@ -69,16 +88,7 @@ Ingress resources have been changed to work natively with NGINX ingress controll
Service configs have been moved from the anchoreGlobal section, to individual component sections in the values.yaml file. If you're upgrading from a previous install and are using custom ports or serviceTypes, be sure to update your values.yaml file accordingly.
##### v0.9.0 service config
```
anchoreGlobal:
service:
type: ClusterIP
apiPort: 8228
```
##### v0.10.0 service config
#### Chart v0.10.0 service config
```
anchoreApi:
service:
@@ -107,33 +117,32 @@ All configurations should be appended to your custom `anchore_values.yaml` file
#### Using Ingress
This configuration allows SSL termination at the LB.
*Note: Ingress controllers can use custom hosts or paths for routing requests. Custom paths or hosts should be set in the corresponding component configuration - anchoreEnterpriseUI.ingress or anchoreApi.ingress*
This configuration allows SSL termination using your chosen ingress controller.
##### NGINX Ingress Controller
```
anchoreGlobal:
ingress:
enabled: true
ingress:
enabled: true
```
##### GCE Ingress Controller
```
anchoreGlobal:
ingress:
enabled: true
annotations: null
ingress:
enabled: true
annotations:
kubernetes.io/ingress.class: gce
apiPath: /v1/*
uiPath: /*
apiHosts:
- anchore-api.example.com
uiHosts:
- anchore-ui.example.com
anchoreApi:
ingress:
path: /v1/*
service:
type: NodePort
anchoreEnterpriseUi:
ingress:
path: /*
service
type: NodePort
```
stable/anchore-engine/requirements.lock
+2 -2
View File
@@ -7,6 +7,6 @@ dependencies:
version: 1.0.0
- name: redis
repository: https://kubernetes-charts.storage.googleapis.com
version: 5.1.0
version: 6.1.3
digest: sha256:c72be0f60c6cb3d764e444e77a51eae11beb0b782bde8c528cb61783dab18e67
generated: 2018-12-05T18:50:35.229545-08:00
generated: 2019-02-25T18:00:45.332618-08:00
stable/anchore-engine/templates/NOTES.txt
+1 -1
View File
@@ -9,7 +9,7 @@ To configure your anchore-cli run:
ANCHORE_CLI_USER=admin
ANCHORE_CLI_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "anchore-engine.fullname" . }} -o jsonpath="{.data.ANCHORE_ADMIN_PASSWORD}" | base64 --decode; echo)
{{ if .Values.anchoreApi.ingress.enabled }}
{{ if .Values.ingress.enabled }}
ANCHORE_CLI_URL=http://$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "anchore-engine.api.fullname" . }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")/v1/
{{ else }}
Using the service endpoint from within the cluster you can use:
stable/anchore-engine/templates/analyzer_deployment.yaml
+8
View File
@@ -37,6 +37,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreAnalyzer.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
stable/anchore-engine/templates/api_deployment.yaml
+24
View File
@@ -54,6 +54,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreApi.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
@@ -102,6 +110,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreEnterpriseRbac.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
@@ -152,6 +168,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreEnterpriseRbac.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
stable/anchore-engine/templates/catalog_deployment.yaml
+8
View File
@@ -37,6 +37,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreCatalog.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
stable/anchore-engine/templates/enterprise_feeds_deployment.yaml
+8
View File
@@ -50,6 +50,14 @@ spec:
- secretRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreEnterpriseFeeds.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- if and (index .Values "anchore-feeds-db" "externalEndpoint") (not (index .Values "anchore-feeds-db" "enabled")) }}
- name: ANCHORE_DB_HOST
value: {{ index .Values "anchore-feeds-db" "externalEndpoint" | quote }}
stable/anchore-engine/templates/enterprise_ui_deployment.yaml
+9 -1
View File
@@ -41,6 +41,14 @@ spec:
image: {{ .Values.anchoreEnterpriseUi.image }}
imagePullPolicy: {{ .Values.anchoreEnterpriseUi.imagePullPolicy }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreEnterpriseUi.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
@@ -121,7 +129,7 @@ metadata:
{{ toYaml .Values.anchoreEnterpriseUi.service.annotations | indent 4 }}
{{- end }}
spec:
sessionAffinity: ClientIP
sessionAffinity: {{ .Values.anchoreEnterpriseUi.service.sessionAffinity }}
type: {{ .Values.anchoreEnterpriseUi.service.type }}
ports:
- name: enterprise-ui
stable/anchore-engine/templates/ingress.yaml
+15 -15
View File
@@ -1,4 +1,4 @@
{{- if .Values.anchoreGlobal.ingress.enabled -}}
{{- if .Values.ingress.enabled -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
@@ -8,14 +8,14 @@ metadata:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- if .Values.anchoreGlobal.ingress.annotations }}
{{- if .Values.ingress.annotations }}
annotations:
{{ toYaml .Values.anchoreGlobal.ingress.annotations | indent 4 }}
{{ toYaml .Values.ingress.annotations | indent 4 }}
{{- end }}
spec:
{{- if .Values.anchoreGlobal.ingress.tls }}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.anchoreGlobal.ingress.tls }}
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
@@ -24,36 +24,36 @@ spec:
{{- end }}
{{- end }}
rules:
{{- if .Values.anchoreApi.ingress.hosts }}
{{- range .Values.anchoreApi.ingress.hosts }}
{{- if .Values.ingress.apiHosts }}
{{- range .Values.ingress.apiHosts }}
- host: {{ . | quote }}
http:
paths:
- path: {{ $.Values.anchoreApi.ingress.path }}
- path: {{ $.Values.ingress.apiPath }}
backend:
serviceName: {{ template "anchore-engine.api.fullname" $ }}
servicePort: {{ $.Values.anchoreApi.service.port }}
{{- end }}
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.anchoreEnterpriseUi.ingress.hosts }}
{{- range .Values.anchoreEnterpriseUi.ingress.hosts }}
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.ingress.uiHosts }}
{{- range .Values.ingress.uiHosts }}
- host: {{ . | quote }}
http:
paths:
- path: {{ $.Values.anchoreEnterpriseUi.ingress.path }}
- path: {{ $.Values.ingress.uiPath }}
backend:
serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }}
servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
{{- end }}
{{- end }}
{{- else }}
{{- end }}
{{- else }}
- http:
paths:
- path: {{ $.Values.anchoreApi.ingress.path }}
- path: {{ $.Values.ingress.apiPath }}
backend:
serviceName: {{ template "anchore-engine.api.fullname" $ }}
servicePort: {{ $.Values.anchoreApi.service.port }}
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }}
- path: {{ $.Values.anchoreEnterpriseUi.ingress.path }}
- path: {{ $.Values.ingress.uiPath }}
backend:
serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }}
servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
stable/anchore-engine/templates/policy_engine_deployment.yaml
+8
View File
@@ -37,6 +37,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchorePolicyEngine.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
stable/anchore-engine/templates/simplequeue_deployment.yaml
+8
View File
@@ -37,6 +37,14 @@ spec:
- configMapRef:
name: {{ template "anchore-engine.fullname" . }}
env:
{{- range $key, $value := .Values.anchoreGlobal.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
{{- range $key, $value := .Values.anchoreSimpleQueue.extraEnv }}
- name: {{ $key }}
value: {{ $value }}
{{- end }}
- name: ANCHORE_POD_NAME
valueFrom:
fieldRef:
stable/anchore-engine/values.yaml
+72 -44
View File
@@ -14,41 +14,55 @@ postgresql:
externalEndpoint: Null
# Configure size of the persitant volume used with helm managed chart.
# This is ignored if using an external endpoint.
# This should be commented out if using an external endpoint.
persistence:
size: 8Gi
size: 20Gi
# Create an ingress resource for all external anchore engine services (API & Enterprise UI).
# By default this chart is setup to use the NGINX ingress controller which needs to be installed & configured on your cluster.
# To utilize a GCE/ALB ingress controller comment out the nginx annotations below, change ingress.class, edit path configurions as per the comments, & set API/UI services to use NodePort.
ingress:
enabled: false
# Uncomment the following paths for GCE/ALB ingress controller
# apiPath: /v1/*
# uiPath: /*
apiPath: /v1/
uiPath: /
# Uncomment the following lines to bind on specific hostnames
# apiHosts:
# - anchore-api.example.com
# uiHosts:
# - anchore-ui.example.com
annotations:
# kubernetes.io/ingress.class: gce
kubernetes.io/ingress.class: nginx
# nginx.ingress.kubernetes.io/ssl-redirect: "false"
# kubernetes.io/ingress.allow-http: false
# kubernetes.io/tls-acme: true
tls: []
# Secrets must be manually created in the namespace.
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
# Global configuration shared by all anchore-engine services.
anchoreGlobal:
# Image used for all anchore engine deployments (excluding enterprise components).
image: docker.io/anchore/anchore-engine:v0.3.2
image: docker.io/anchore/anchore-engine:v0.3.3
imagePullPolicy: IfNotPresent
# Create an ingress resource for all external anchore engine services.
# By default this chart is setup to use the NGINX ingress controller which needs to be installed & configured on your cluster.
# To utilize a GCE ingress controller comment out the annotations below, also edit path configurion the UI & Api configs as per the comments.
# Ingress paths/hosts can be setup for the anchoreApi & anchoreEnterpriseUi deployments in the corresponding values sections.
ingress:
enabled: false
annotations:
kubernetes.io/ingress.class: nginx
# nginx.ingress.kubernetes.io/ssl-redirect: "false"
# kubernetes.io/ingress.allow-http: false
# kubernetes.io/tls-acme: true
tls: []
# Secrets must be manually created in the namespace.
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
# Set extra environment variables. These will be set on all containers.
extraEnv: {}
# FOO: bar
###
# Start of General Anchore Engine Configurations (populates config.yaml)
# Start of General Anchore Engine Configurations (populates /config/config.yaml)
###
# Set where default configs are placed at startup. This must be a writable location for the pod.
serviceDir: /anchore_service_config
logLevel: INFO
# If true, if a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
# If true, when a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
allowECRUseIAMRole: false
# Enable prometheus metrics
@@ -98,6 +112,10 @@ anchoreAnalyzer:
replicaCount: 1
containerPort: 8084
# Set extra environment variables. These will be set only on analyzer containers.
extraEnv: {}
# FOO: bar
# The cycle timer is the interval between checks to the work queue for new jobs
cycleTimers:
image_analyzer: 5
@@ -132,23 +150,16 @@ anchoreAnalyzer:
anchoreApi:
replicaCount: 1
# Set extra environment variables. These will be set on all api containers.
extraEnv: {}
# FOO: bar
# kubernetes service configuration for anchore external API
service:
type: ClusterIP
port: 8228
annotations: {}
# Used to create Ingress record for the anchore engine external API (api service)
# (should used with service.type: ClusterIP or NodePort depending on platform)
ingress:
# For GCE ingress controllers use the following path
# path: /v1/*
# By default this is configured to use an NGINX ingress controller.
path: /v1/
# You can bound on specific hostnames
# hosts:
# - anchore-api.local
# resources:
# limits:
# cpu: 100m
@@ -165,6 +176,10 @@ anchoreApi:
anchoreCatalog:
replicaCount: 1
# Set extra environment variables. These will be set on all catalog containers.
extraEnv: {}
# FOO: bar
# Intervals to run specific events on (seconds)
cycleTimers:
# Interval to check for an update to a tag
@@ -185,7 +200,7 @@ anchoreCatalog:
# Event log configuration for webhooks
events:
notification:
enabled: true
enabled: false
# Send notifications for events with severity level that matches items in this list
level:
- error
@@ -262,6 +277,10 @@ anchoreCatalog:
anchorePolicyEngine:
replicaCount: 1
# Set extra environment variables. These will be set on all policy engine containers.
extraEnv: {}
# FOO: bar
# Intervals to run specific events on (seconds)
cycleTimers:
# Interval to run a feed sync to get latest cve data
@@ -292,6 +311,10 @@ anchorePolicyEngine:
anchoreSimpleQueue:
replicaCount: 1
# Set extra environment variables. These will be set on all simplequeue containers.
extraEnv: {}
# FOO: bar
# kubernetes service configuration for anchore simplequeue api
service:
type: ClusterIP
@@ -339,15 +362,19 @@ anchore-feeds-db:
externalEndpoint: Null
# Configure size of the persitant volume used with helm managed chart.
# This is ignored if using an external endpoint.
# This should be commented out if using an external endpoint.
persistence:
size: 8Gi
size: 20Gi
# Configure & enable the Anchore Enterprise on-prem feeds service.
anchoreEnterpriseFeeds:
# If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance.
enabled: true
# Set extra environment variables. These will be set on all feeds containers.
extraEnv: {}
# FOO: bar
# Time delay in seconds between consecutive driver runs for processing data
cycleTimers:
driver_sync: 7200
@@ -391,6 +418,10 @@ anchoreEnterpriseFeeds:
anchoreEnterpriseRbac:
enabled: true
# Set extra environment variables. These will be set on all rbac containers.
extraEnv: {}
# FOO: bar
# Kubernetes service config - annotations & serviceType configs must be set in anchoreApi
# Due to RBAC sharing a service with the general API.
service:
@@ -417,6 +448,11 @@ anchoreEnterpriseRbac:
anchoreEnterpriseUi:
# If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance.
enabled: true
# Set extra environment variables. These will be set on all UI containers.
extraEnv: {}
# FOO: bar
# Specifies whether to trust a reverse proxy when setting secure cookies (via the `X-Forwarded-Proto` header).
enableProxy: false
# Specifies if SSL is enabled in the web app container.
@@ -437,15 +473,7 @@ anchoreEnterpriseUi:
type: ClusterIP
port: 80
annotations: {}
ingress:
# For GCE ingress controllers use the following path
# path: /*
# By default this is configured to use an NGINX ingress controller.
path: /
# You can bound on specific hostnames
# hosts:
# - anchore-ui.local
sessionAffinity: ClientIP
# resources:
# limits: