[stable/anchore-engine] Updates and bug fix for policy bundle sync config (#3435)

* [stable/anchore-engine] Updates and bug fix

Fixes bug in configuration of policy bundle sync.

Updates NOTES.txt and README.md for a bit more detail.

* Bump anchore-engine chart version to 0.1.1

* Update stable/anchore-engine readme to include config option for ingress and loadbalancer

stable/anchore-engine/Chart.yaml

@@ -1,5 +1,5 @@
 name: anchore-engine
-version: 0.1.0
+version: 0.1.1
 appVersion: 0.1.6
 description: Anchore container analysis and policy evaluation engine service
 keywords:

stable/anchore-engine/README.md

@@ -15,6 +15,9 @@ The chart is split into three primary sections: GlobalConfig, CoreConfig, Worker
 the GlobalConfig is for configuration values that all components require, while the Core and Worker sections are
 tier-specific and allow customization for each role.
 
+NOTE: It is highly recommended to set a non-default password when deploying. The admin password is set to a default in the chart. To customize it use:
+ `--set globalConfig.users.admin.password=<pass>` or set it in the values.yaml locally.
+
 
 ### Core Role
 The core services provide the apis and state management for the system. Core services must be available within the cluster
@@ -35,12 +38,18 @@ Installing the Chart
 
 Deploying PostgreSQL as a dependency managed in the chart:
 
-`helm install .`
+`helm install stable/anchore-engine`
 
 
 Using and existing/external PostgreSQL service:
 
-`helm install --name <name> --set postgresql.enabled=False .`
+`helm install --name <name> --set postgresql.enabled=False stable/anchore-engine`
+
+
+This installs the chart in cluster-local mode. To expose the service outside the chart there are two options:
+1. Use a LoadBalancer service type by setting the `service.type=LoadBalancer` in the values.yaml or on CLI
+2. Use an ingress by setting `ingress.enabled=True` in the values.yaml or on CLI
+
 
 
 Configuration
@@ -48,6 +57,15 @@ Configuration
 
 While the configuration options of Anchore Engine are extensive, the options provided by the chart are:
 
+### Exposing the service outside the cluster:
+
+* Use ingress, which enables SSL termination at the LB:
+  * ingress.enabled=True (may require service.type=NodePort for some K8s installations e.g. GKE)
+
+* Use a LoadBalancer service type:
+  * service.type=LoadBalancer 
+
+
 ### Database
 
 * External Postgres (not managed by helm)
@@ -75,9 +93,14 @@ Adding Workers
 
 To set a specific number of workers once the service is running:
 
-`helm upgrade --set workerConfig.replicaCount=2`
+If using defaults from the chart:
+
+`helm upgrade --set workerConfig.replicaCount=2 <releasename> stable/anchore-engine`
+
+If customized values, use the local directory for the chart values:
+
+`helm upgrade --est workerConfig.replicaCount=2 <releasename> ./anchore-engine`
 
 To launch with more than one worker you can either modify values.yaml or run with:
 
-`helm install --set workerConfig.replicaCount=2 <chart location>`
-
+`helm install --set workerConfig.replicaCount=2 stable/anchore-engine`

stable/anchore-engine/templates/NOTES.txt

@@ -18,7 +18,7 @@ Using the service endpoint from within the cluster you can use:
 
 To verify the service is up and running, you can run container for the Anchore Engine CLI:
 
-    kubectl run -i --tty anchore-cli --restart=Never --image anchore/engine-cli --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://{{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.api}}/v1/
+    kubectl run -i --tty anchore-cli --restart=Always --image anchore/engine-cli --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://{{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.api}}/v1/
 
 from within the container you can use 'anchore-cli' commands.
 

stable/anchore-engine/templates/core_configmap.yaml

@@ -60,9 +60,9 @@ data:
           email: {{ .Values.globalConfig.users.admin.email }}
           external_service_auths:
           {{ if not .Values.globalConfig.users.admin.anchoreIOCredentials.useAnonymous }}
-          anchoreio:
-            anchorecli:
-              auth: "${ANCHORE_IO_USER}:${ANCHORE_IO_PASSWORD}"
+            anchoreio:
+              anchorecli:
+                auth: "${ANCHORE_IO_USER}:${ANCHORE_IO_PASSWORD}"
           {{ end }}
           auto_policy_sync: {{ .Values.coreConfig.policyBundleSyncEnabled }}
 

stable/anchore-engine/templates/core_deployment.yaml

@@ -47,6 +47,16 @@ spec:
           value: {{ .Values.postgresql.postgresDatabase }}
         - name: ANCHORE_DB_HOST
           value: {{ template "postgres.fullname" . }}
+        - name: ANCHORE_IO_USER
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "fullname" . }}
+              key: anchoreIOUser
+        - name: ANCHORE_IO_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "fullname" . }}
+              key: anchoreIOPassword
         - name: ANCHORE_DB_USER
           valueFrom:
             secretKeyRef: