From 2c651a910a167590dbf545f97965d134bb173272 Mon Sep 17 00:00:00 2001 From: Brady Todhunter Date: Wed, 13 Mar 2019 18:00:53 -0700 Subject: [PATCH] Update to Anchore Engine v0.3.3 (#12014) * Update anchore engine image to use v0.3.3 * Consolidate all ingress resource values * Upgrade to latest Redis chart version * Increase postgres persistence to 20Gi * Allow additional env vars from values Signed-off-by: Brady Todhunter --- stable/anchore-engine/Chart.yaml | 6 +- stable/anchore-engine/README.md | 61 +++++---- stable/anchore-engine/requirements.lock | 4 +- stable/anchore-engine/templates/NOTES.txt | 2 +- .../templates/analyzer_deployment.yaml | 8 ++ .../templates/api_deployment.yaml | 24 ++++ .../templates/catalog_deployment.yaml | 8 ++ .../enterprise_feeds_deployment.yaml | 8 ++ .../templates/enterprise_ui_deployment.yaml | 10 +- stable/anchore-engine/templates/ingress.yaml | 30 ++--- .../templates/policy_engine_deployment.yaml | 8 ++ .../templates/simplequeue_deployment.yaml | 8 ++ stable/anchore-engine/values.yaml | 116 +++++++++++------- 13 files changed, 202 insertions(+), 91 deletions(-) diff --git a/stable/anchore-engine/Chart.yaml b/stable/anchore-engine/Chart.yaml index a346f69981..39a0cd032a 100644 --- a/stable/anchore-engine/Chart.yaml +++ b/stable/anchore-engine/Chart.yaml @@ -1,6 +1,6 @@ name: anchore-engine -version: 0.11.0 -appVersion: 0.3.2 +version: 0.12.0 +appVersion: 0.3.3 description: Anchore container analysis and policy evaluation engine service keywords: - analysis @@ -9,6 +9,8 @@ keywords: - "anchore-engine" - image - security + - vulnerability + - scanner home: https://anchore.com sources: - https://github.com/anchore/anchore-engine diff --git a/stable/anchore-engine/README.md b/stable/anchore-engine/README.md index 1a1417cd91..627f596551 100644 --- a/stable/anchore-engine/README.md +++ b/stable/anchore-engine/README.md @@ -43,11 +43,30 @@ The recommended way to install the Anchore Engine Chart is with a customized val defaultAdminPassword: defaultAdminEmail: ``` + +## Upgrading to Chart version 0.12.0 +Redis dependency chart major version updated to v6.1.3 - check redis chart readme for instructions for upgrade. + +The ingress configuration has been consolidated to a single global section. This should make it easier to manage the ingress resource. Before performing an upgrade ensure you update your custom values file to reflect this change. + +#### Chart v0.12.0 ingress config +``` +ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: gce + apiPath: /v1/* + uiPath: /* + apiHosts: + - anchore-api.example.com + uiHosts: + - anchore-ui.example.com +``` + ## Upgrading to Chart version 0.11.0 The image map has been removed in all configuration sections in favor of individual keys. This should make configuration for tools like skaffold simpler. If using a custom values file, update your `image.repository`, `image.tag`, & `image.pullPolicy` values with `image` & `imagePullPolicy`. -##### v0.11.0 image config - +#### Chart v0.11.0 image config ``` anchoreGlobal: image: docker.io/anchore/anchore-engine:v0.3.2 @@ -69,16 +88,7 @@ Ingress resources have been changed to work natively with NGINX ingress controll Service configs have been moved from the anchoreGlobal section, to individual component sections in the values.yaml file. If you're upgrading from a previous install and are using custom ports or serviceTypes, be sure to update your values.yaml file accordingly. -##### v0.9.0 service config - -``` -anchoreGlobal: - service: - type: ClusterIP - apiPort: 8228 -``` - -##### v0.10.0 service config +#### Chart v0.10.0 service config ``` anchoreApi: service: @@ -107,33 +117,32 @@ All configurations should be appended to your custom `anchore_values.yaml` file #### Using Ingress -This configuration allows SSL termination at the LB. - -*Note: Ingress controllers can use custom hosts or paths for routing requests. Custom paths or hosts should be set in the corresponding component configuration - anchoreEnterpriseUI.ingress or anchoreApi.ingress* +This configuration allows SSL termination using your chosen ingress controller. ##### NGINX Ingress Controller ``` -anchoreGlobal: - ingress: - enabled: true +ingress: + enabled: true ``` ##### GCE Ingress Controller ``` - anchoreGlobal: - ingress: - enabled: true - annotations: null + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: gce + apiPath: /v1/* + uiPath: /* + apiHosts: + - anchore-api.example.com + uiHosts: + - anchore-ui.example.com anchoreApi: - ingress: - path: /v1/* service: type: NodePort anchoreEnterpriseUi: - ingress: - path: /* service type: NodePort ``` diff --git a/stable/anchore-engine/requirements.lock b/stable/anchore-engine/requirements.lock index 82c75c6a50..c79cc58244 100644 --- a/stable/anchore-engine/requirements.lock +++ b/stable/anchore-engine/requirements.lock @@ -7,6 +7,6 @@ dependencies: version: 1.0.0 - name: redis repository: https://kubernetes-charts.storage.googleapis.com - version: 5.1.0 + version: 6.1.3 digest: sha256:c72be0f60c6cb3d764e444e77a51eae11beb0b782bde8c528cb61783dab18e67 -generated: 2018-12-05T18:50:35.229545-08:00 +generated: 2019-02-25T18:00:45.332618-08:00 diff --git a/stable/anchore-engine/templates/NOTES.txt b/stable/anchore-engine/templates/NOTES.txt index 9f893e65c5..6d0fef2f51 100644 --- a/stable/anchore-engine/templates/NOTES.txt +++ b/stable/anchore-engine/templates/NOTES.txt @@ -9,7 +9,7 @@ To configure your anchore-cli run: ANCHORE_CLI_USER=admin ANCHORE_CLI_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "anchore-engine.fullname" . }} -o jsonpath="{.data.ANCHORE_ADMIN_PASSWORD}" | base64 --decode; echo) -{{ if .Values.anchoreApi.ingress.enabled }} +{{ if .Values.ingress.enabled }} ANCHORE_CLI_URL=http://$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "anchore-engine.api.fullname" . }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")/v1/ {{ else }} Using the service endpoint from within the cluster you can use: diff --git a/stable/anchore-engine/templates/analyzer_deployment.yaml b/stable/anchore-engine/templates/analyzer_deployment.yaml index 646e776ef6..c818e35d01 100644 --- a/stable/anchore-engine/templates/analyzer_deployment.yaml +++ b/stable/anchore-engine/templates/analyzer_deployment.yaml @@ -37,6 +37,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreAnalyzer.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: diff --git a/stable/anchore-engine/templates/api_deployment.yaml b/stable/anchore-engine/templates/api_deployment.yaml index c297707be4..311a696b4b 100644 --- a/stable/anchore-engine/templates/api_deployment.yaml +++ b/stable/anchore-engine/templates/api_deployment.yaml @@ -54,6 +54,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreApi.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: @@ -102,6 +110,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreEnterpriseRbac.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: @@ -152,6 +168,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreEnterpriseRbac.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: diff --git a/stable/anchore-engine/templates/catalog_deployment.yaml b/stable/anchore-engine/templates/catalog_deployment.yaml index 9e4107d369..efe5dac4b0 100644 --- a/stable/anchore-engine/templates/catalog_deployment.yaml +++ b/stable/anchore-engine/templates/catalog_deployment.yaml @@ -37,6 +37,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreCatalog.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: diff --git a/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml b/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml index 6eda35f579..28084501c6 100644 --- a/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml +++ b/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml @@ -50,6 +50,14 @@ spec: - secretRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreEnterpriseFeeds.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} {{- if and (index .Values "anchore-feeds-db" "externalEndpoint") (not (index .Values "anchore-feeds-db" "enabled")) }} - name: ANCHORE_DB_HOST value: {{ index .Values "anchore-feeds-db" "externalEndpoint" | quote }} diff --git a/stable/anchore-engine/templates/enterprise_ui_deployment.yaml b/stable/anchore-engine/templates/enterprise_ui_deployment.yaml index 6f1be1b607..2d995314e5 100644 --- a/stable/anchore-engine/templates/enterprise_ui_deployment.yaml +++ b/stable/anchore-engine/templates/enterprise_ui_deployment.yaml @@ -41,6 +41,14 @@ spec: image: {{ .Values.anchoreEnterpriseUi.image }} imagePullPolicy: {{ .Values.anchoreEnterpriseUi.imagePullPolicy }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreEnterpriseUi.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: REDIS_PASSWORD valueFrom: secretKeyRef: @@ -121,7 +129,7 @@ metadata: {{ toYaml .Values.anchoreEnterpriseUi.service.annotations | indent 4 }} {{- end }} spec: - sessionAffinity: ClientIP + sessionAffinity: {{ .Values.anchoreEnterpriseUi.service.sessionAffinity }} type: {{ .Values.anchoreEnterpriseUi.service.type }} ports: - name: enterprise-ui diff --git a/stable/anchore-engine/templates/ingress.yaml b/stable/anchore-engine/templates/ingress.yaml index afd33f6a39..27d1ebf3af 100644 --- a/stable/anchore-engine/templates/ingress.yaml +++ b/stable/anchore-engine/templates/ingress.yaml @@ -1,4 +1,4 @@ -{{- if .Values.anchoreGlobal.ingress.enabled -}} +{{- if .Values.ingress.enabled -}} apiVersion: extensions/v1beta1 kind: Ingress metadata: @@ -8,14 +8,14 @@ metadata: chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: {{ .Release.Name }} heritage: {{ .Release.Service }} - {{- if .Values.anchoreGlobal.ingress.annotations }} + {{- if .Values.ingress.annotations }} annotations: -{{ toYaml .Values.anchoreGlobal.ingress.annotations | indent 4 }} +{{ toYaml .Values.ingress.annotations | indent 4 }} {{- end }} spec: - {{- if .Values.anchoreGlobal.ingress.tls }} + {{- if .Values.ingress.tls }} tls: - {{- range .Values.anchoreGlobal.ingress.tls }} + {{- range .Values.ingress.tls }} - hosts: {{- range .hosts }} - {{ . | quote }} @@ -24,36 +24,36 @@ spec: {{- end }} {{- end }} rules: - {{- if .Values.anchoreApi.ingress.hosts }} - {{- range .Values.anchoreApi.ingress.hosts }} + {{- if .Values.ingress.apiHosts }} + {{- range .Values.ingress.apiHosts }} - host: {{ . | quote }} http: paths: - - path: {{ $.Values.anchoreApi.ingress.path }} + - path: {{ $.Values.ingress.apiPath }} backend: serviceName: {{ template "anchore-engine.api.fullname" $ }} servicePort: {{ $.Values.anchoreApi.service.port }} {{- end }} - {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.anchoreEnterpriseUi.ingress.hosts }} - {{- range .Values.anchoreEnterpriseUi.ingress.hosts }} + {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.ingress.uiHosts }} + {{- range .Values.ingress.uiHosts }} - host: {{ . | quote }} http: paths: - - path: {{ $.Values.anchoreEnterpriseUi.ingress.path }} + - path: {{ $.Values.ingress.uiPath }} backend: serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }} servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }} {{- end }} - {{- end }} - {{- else }} + {{- end }} + {{- else }} - http: paths: - - path: {{ $.Values.anchoreApi.ingress.path }} + - path: {{ $.Values.ingress.apiPath }} backend: serviceName: {{ template "anchore-engine.api.fullname" $ }} servicePort: {{ $.Values.anchoreApi.service.port }} {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} - - path: {{ $.Values.anchoreEnterpriseUi.ingress.path }} + - path: {{ $.Values.ingress.uiPath }} backend: serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }} servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }} diff --git a/stable/anchore-engine/templates/policy_engine_deployment.yaml b/stable/anchore-engine/templates/policy_engine_deployment.yaml index 1bdacab637..cb2c172cc2 100644 --- a/stable/anchore-engine/templates/policy_engine_deployment.yaml +++ b/stable/anchore-engine/templates/policy_engine_deployment.yaml @@ -37,6 +37,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchorePolicyEngine.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: diff --git a/stable/anchore-engine/templates/simplequeue_deployment.yaml b/stable/anchore-engine/templates/simplequeue_deployment.yaml index 59dfa4fab7..2efa107447 100644 --- a/stable/anchore-engine/templates/simplequeue_deployment.yaml +++ b/stable/anchore-engine/templates/simplequeue_deployment.yaml @@ -37,6 +37,14 @@ spec: - configMapRef: name: {{ template "anchore-engine.fullname" . }} env: + {{- range $key, $value := .Values.anchoreGlobal.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} + {{- range $key, $value := .Values.anchoreSimpleQueue.extraEnv }} + - name: {{ $key }} + value: {{ $value }} + {{- end }} - name: ANCHORE_POD_NAME valueFrom: fieldRef: diff --git a/stable/anchore-engine/values.yaml b/stable/anchore-engine/values.yaml index 76cb88c4a1..3e0e995696 100644 --- a/stable/anchore-engine/values.yaml +++ b/stable/anchore-engine/values.yaml @@ -14,41 +14,55 @@ postgresql: externalEndpoint: Null # Configure size of the persitant volume used with helm managed chart. - # This is ignored if using an external endpoint. + # This should be commented out if using an external endpoint. persistence: - size: 8Gi + size: 20Gi + +# Create an ingress resource for all external anchore engine services (API & Enterprise UI). +# By default this chart is setup to use the NGINX ingress controller which needs to be installed & configured on your cluster. +# To utilize a GCE/ALB ingress controller comment out the nginx annotations below, change ingress.class, edit path configurions as per the comments, & set API/UI services to use NodePort. +ingress: + enabled: false + # Uncomment the following paths for GCE/ALB ingress controller + # apiPath: /v1/* + # uiPath: /* + apiPath: /v1/ + uiPath: / + # Uncomment the following lines to bind on specific hostnames + # apiHosts: + # - anchore-api.example.com + # uiHosts: + # - anchore-ui.example.com + annotations: + # kubernetes.io/ingress.class: gce + kubernetes.io/ingress.class: nginx + # nginx.ingress.kubernetes.io/ssl-redirect: "false" + # kubernetes.io/ingress.allow-http: false + # kubernetes.io/tls-acme: true + tls: [] + # Secrets must be manually created in the namespace. + # - secretName: chart-example-tls + # hosts: + # - chart-example.local # Global configuration shared by all anchore-engine services. anchoreGlobal: # Image used for all anchore engine deployments (excluding enterprise components). - image: docker.io/anchore/anchore-engine:v0.3.2 + image: docker.io/anchore/anchore-engine:v0.3.3 imagePullPolicy: IfNotPresent - # Create an ingress resource for all external anchore engine services. - # By default this chart is setup to use the NGINX ingress controller which needs to be installed & configured on your cluster. - # To utilize a GCE ingress controller comment out the annotations below, also edit path configurion the UI & Api configs as per the comments. - # Ingress paths/hosts can be setup for the anchoreApi & anchoreEnterpriseUi deployments in the corresponding values sections. - ingress: - enabled: false - annotations: - kubernetes.io/ingress.class: nginx - # nginx.ingress.kubernetes.io/ssl-redirect: "false" - # kubernetes.io/ingress.allow-http: false - # kubernetes.io/tls-acme: true - tls: [] - # Secrets must be manually created in the namespace. - # - secretName: chart-example-tls - # hosts: - # - chart-example.local + # Set extra environment variables. These will be set on all containers. + extraEnv: {} + # FOO: bar ### - # Start of General Anchore Engine Configurations (populates config.yaml) + # Start of General Anchore Engine Configurations (populates /config/config.yaml) ### # Set where default configs are placed at startup. This must be a writable location for the pod. serviceDir: /anchore_service_config logLevel: INFO - # If true, if a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry + # If true, when a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry allowECRUseIAMRole: false # Enable prometheus metrics @@ -98,6 +112,10 @@ anchoreAnalyzer: replicaCount: 1 containerPort: 8084 + # Set extra environment variables. These will be set only on analyzer containers. + extraEnv: {} + # FOO: bar + # The cycle timer is the interval between checks to the work queue for new jobs cycleTimers: image_analyzer: 5 @@ -132,23 +150,16 @@ anchoreAnalyzer: anchoreApi: replicaCount: 1 + # Set extra environment variables. These will be set on all api containers. + extraEnv: {} + # FOO: bar + # kubernetes service configuration for anchore external API service: type: ClusterIP port: 8228 annotations: {} - # Used to create Ingress record for the anchore engine external API (api service) - # (should used with service.type: ClusterIP or NodePort depending on platform) - ingress: - # For GCE ingress controllers use the following path - # path: /v1/* - # By default this is configured to use an NGINX ingress controller. - path: /v1/ - # You can bound on specific hostnames - # hosts: - # - anchore-api.local - # resources: # limits: # cpu: 100m @@ -165,6 +176,10 @@ anchoreApi: anchoreCatalog: replicaCount: 1 + # Set extra environment variables. These will be set on all catalog containers. + extraEnv: {} + # FOO: bar + # Intervals to run specific events on (seconds) cycleTimers: # Interval to check for an update to a tag @@ -185,7 +200,7 @@ anchoreCatalog: # Event log configuration for webhooks events: notification: - enabled: true + enabled: false # Send notifications for events with severity level that matches items in this list level: - error @@ -262,6 +277,10 @@ anchoreCatalog: anchorePolicyEngine: replicaCount: 1 + # Set extra environment variables. These will be set on all policy engine containers. + extraEnv: {} + # FOO: bar + # Intervals to run specific events on (seconds) cycleTimers: # Interval to run a feed sync to get latest cve data @@ -292,6 +311,10 @@ anchorePolicyEngine: anchoreSimpleQueue: replicaCount: 1 + # Set extra environment variables. These will be set on all simplequeue containers. + extraEnv: {} + # FOO: bar + # kubernetes service configuration for anchore simplequeue api service: type: ClusterIP @@ -339,15 +362,19 @@ anchore-feeds-db: externalEndpoint: Null # Configure size of the persitant volume used with helm managed chart. - # This is ignored if using an external endpoint. + # This should be commented out if using an external endpoint. persistence: - size: 8Gi + size: 20Gi # Configure & enable the Anchore Enterprise on-prem feeds service. anchoreEnterpriseFeeds: # If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance. enabled: true + # Set extra environment variables. These will be set on all feeds containers. + extraEnv: {} + # FOO: bar + # Time delay in seconds between consecutive driver runs for processing data cycleTimers: driver_sync: 7200 @@ -391,6 +418,10 @@ anchoreEnterpriseFeeds: anchoreEnterpriseRbac: enabled: true + # Set extra environment variables. These will be set on all rbac containers. + extraEnv: {} + # FOO: bar + # Kubernetes service config - annotations & serviceType configs must be set in anchoreApi # Due to RBAC sharing a service with the general API. service: @@ -417,6 +448,11 @@ anchoreEnterpriseRbac: anchoreEnterpriseUi: # If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance. enabled: true + + # Set extra environment variables. These will be set on all UI containers. + extraEnv: {} + # FOO: bar + # Specifies whether to trust a reverse proxy when setting secure cookies (via the `X-Forwarded-Proto` header). enableProxy: false # Specifies if SSL is enabled in the web app container. @@ -437,15 +473,7 @@ anchoreEnterpriseUi: type: ClusterIP port: 80 annotations: {} - - ingress: - # For GCE ingress controllers use the following path - # path: /* - # By default this is configured to use an NGINX ingress controller. - path: / - # You can bound on specific hostnames - # hosts: - # - anchore-ui.local + sessionAffinity: ClientIP # resources: # limits: