Upgrade to v0.3.0 & add Enterprise (#9287)

* ui functional Signed-off-by: Brady Todhunter <bradyt@anchore.com> * enterprise feeds service functional Signed-off-by: Brady Todhunter <bradyt@anchore.com> * rbac functional Signed-off-by: Brady Todhunter <bradyt@anchore.com> * distributed services functional Signed-off-by: Brady Todhunter <bradyt@anchore.com> * Add more comments to values.yml. Clean up feeds configuration. Make internal ssl configuration global. Signed-off-by: Brady Todhunter <bradyt@anchore.com> * use /health for all readiness & liveness probes Signed-off-by: Brady Todhunter <bradyt@anchore.com> * config rbac authorizer on external APIs. Move k8s webhook to core pod. Fix ssl configs to use anchoreGlobal values. Signed-off-by: Brady Todhunter <bradyt@anchore.com> * add values.yaml snippet & install instructions to README. Default anchoreEnterpriseGlobal.enabled to false Signed-off-by: Brady Todhunter <bradyt@anchore.com> * be explicit about license secret creation Signed-off-by: Brady Todhunter <bradyt@anchore.com> * organize values.yaml. Add additional cycle timers. Set image info to non-dev. Signed-off-by: Brady Todhunter <bradyt@anchore.com> * make service port values global. Remove k8s webhook pod. Default more feeds values. Signed-off-by: Brady Todhunter <bradyt@anchore.com> * remove alias for base postgresql dependency Signed-off-by: Brady Todhunter <bradyt@anchore.com> * add upgrade info to README. update chart version to 0.9.0 Signed-off-by: Brady Todhunter <bradyt@anchore.com> * fix requirements.lock. Remove inline comments. Change case of true/false values. Signed-off-by: Brady Todhunter <bradyt@anchore.com>
2026-08-23 22:37:45 +00:00 · 2018-11-14 22:22:39 -08:00
parent b3226cf40a
commit 8eb06375ba
24 changed files with 1969 additions and 861 deletions
@@ -1,6 +1,6 @@
 name: anchore-engine
-version: 0.2.6
-appVersion: 0.2.4
+version: 0.9.0
+appVersion: 0.3.0
 description: Anchore container analysis and policy evaluation engine service
 keywords:
 - analysis
@@ -1,220 +1,226 @@
-Anchore Engine Helm Chart
-=========================
+# Anchore Engine Helm Chart

-This chart deploys the Anchore Engine docker container image analysis system. Anchore Engine
-requires a PostgreSQL database (>=9.6) which may be handled by the chart or supplied externally,
-and executes in a 2-tier architecture with an api/control layer and a batch execution worker pool layer.
+This chart deploys the Anchore Engine docker container image analysis system. Anchore Engine requires a PostgreSQL database (>=9.6) which may be handled by the chart or supplied externally, and executes in a service based architecture utilizing the following Anchore Engine services: External API, Simplequeue, Catalog, Policy Engine, and Analyzer.
+
+This chart can also be used to install the following Anchore Enterprise services: GUI, RBAC, On-prem Feeds. Enterprise services require a valid Anchore Enterprise License as well as credentials with access to the private dockerhub repository hosting the images. These are not enabled by default.
+
+Each of these services can be scaled and configured independently.

 See [Anchore Engine](https://github.com/anchore/anchore-engine) for more project details.


-Chart Details
-------------
+## Chart Details

-The chart is split into three primary sections: GlobalConfig, CoreConfig, WorkerConfig. As the name implies,
-the GlobalConfig is for configuration values that all components require, while the Core and Worker sections are
-tier-specific and allow customization for each role.
+The chart is split into global and service specific configurations for the OSS Anchore Engine, as well as global and services specific configurations for the Enterprise components.

-NOTE: It is highly recommended to set a non-default password when deploying. The admin password is set to a default in the chart. To customize it use:
- `--set globalConfig.users.admin.password=<pass>` or set it in the values.yaml locally.
+  * The `anchoreGlobal` section is for configuration values required by all Anchore Engine components.
+  * The `anchoreEnterpriseGlobal` section is for configuration values required by all Anchore Engine Enterprise components.
+  * Service specific configuration values allow customization for each individual service.

-New to v0.1.8 of the chart: configurable archive drivers.
-Archive drivers allow Anchore Engine to store the large analysis results in storage other than the postgresql db (the default).
-The currently supported drivers are: S3 and OpenStack's Swift, as well as a localfs option for testing (not for production).
+For a description of each component, view the official documentation at: [Anchore Enterprise Service Overview](https://anchore.freshdesk.com/support/solutions/articles/36000098518-enterprise-service-overview-and-architecture)

+## Installing the Anchore Engine OSS Chart
+TL;DR - `helm install stable/anchore-engine`

-### Core Role
-The core services provide the apis and state management for the system. Core services must be available within the cluster
-for use by the workers.
-* Core component provides webhook calls to external services for notifications of events:
-  * New images added
-  * CVE changes in images
-  * Policy evaluation state change for an image
+The recommended way to install the Anchore Engine Chart is with a customized values file and a custom release name. Create a new file named `anchore_values.yaml` and add all desired custom values (examples below); then run the following command:

+  `helm install --name <release_name> -f anchore_values.yaml stable/anchore-engine`

-### Worker Role
-The workers download and analyze images and upload results to the core services. The workers poll the queue service and
-do not have their own external api.
+Note: It is highly recommended to set non-default passwords when deploying. All passwords are set to defaults specified in the chart.

+##### Install using chart managed PostgreSQL service with custom passwords.
+  ```
+  ## anchore_values.yaml

-Installing the Chart
--------------------
+  postgresql:
+    postgresPassword: <PASSWORD>
+    persistence:
+      size: 50Gi

-Deploying PostgreSQL as a dependency managed in the chart:
+  anchoreGlobal:
+    defaultAdminPassword: <PASSWORD>
+    defaultAdminEmail: <EMAIL>
+  ```

-`helm install stable/anchore-engine`
+## Upgrading to Chart version 0.9.0

+Version 0.9.0 of the anchore-engine helm chart includes major changes to the architecture, values.yaml file, as well as introduced Anchore Enterprise components. Due to these changes, it is highly recommended that upgrades are handled with caution. Any custom values.yaml files will also need to be adjusted to match the new structure. Version upgrades have only been validated when upgrading from 0.2.6 -> 0.9.0.

-Using an existing/external PostgreSQL service:
+`helm upgrade <release_name> stable/anchore-engine`

-`helm install --name <name> --set postgresql.enabled=False stable/anchore-engine`
+When upgrading the Chart from version 0.2.6 to version 0.9.0, it will take approximately 5 minutes for anchore-engine to upgrade the database.
+To ensure that the upgrade has completed, run the `anchore-cli system status` command and verify the engine & db versions match the output below.

+```
+Engine DB Version: 0.0.8
+Engine Code Version: 0.3.0
+```

-This installs the chart in cluster-local mode. To expose the service outside the chart there are two options:
-1. Use a LoadBalancer service type by setting the `service.type=LoadBalancer` in the values.yaml or on CLI
-2. Use an ingress by setting `ingress.enabled=True` in the values.yaml or on CLI
-
-
-
-Configuration
-------------
+## Configuration

+All configurations should be appended to your custom `anchore_values.yaml` file and utilized when installing the chart.
 While the configuration options of Anchore Engine are extensive, the options provided by the chart are:

-### Exposing the service outside the cluster:
+#### Exposing the service outside the cluster:

-* Use ingress, which enables SSL termination at the LB:
-  * ingress.enabled=True (may require service.type=NodePort for some K8s installations e.g. GKE)
+Use ingress, which enables SSL termination at the LB:
+  ```
+  anchoreGlobal:
+    ingress:
+      enabled: true
+  ```

-* Use a LoadBalancer service type:
-  * service.type=LoadBalancer 
+Use a LoadBalancer service type:
+  ```
+  anchoreGlobal:
+    service:
+      type: LoadBalancer
+  ```

+#### Install using an existing/external PostgreSQL service:
+  ```
+  postgresql:
+    postgresPassword: <PASSWORD>
+    postgresUser: <USER>
+    postgresDatabase: <DATABASE>
+    enabled: false
+    externalEndpoint: <HOSTNAME:5432>

-### Database
+  anchoreGlobal:
+    dbConfig:
+      ssl: true
+  ```

-* External Postgres (not managed by helm)
-  * postgresql.enabled=False
-  * postgresql.externalEndpoint=myserver.mypostgres.com:5432
-  * postgresql.postgresUser=username
-  * postgresql.postgresPassword=password
-  * postgresql.postgresDatabase=db name  
-  * globalConfig.dbConfig.ssl=True
-
-### Archive Driver Configuration (new in v0.1.8 of chart)
+### Archive Driver

 The archive subsystem of Anchore Engine is what stores large json documents and can consume quite a lot of storage if
 you analyze a lot of images. A general rule for storage provisioning is 10MB per image analyzed, so with thousands of
 analyzed images, you may need many gigabytes of storage. The Archive drivers now support other backends than just postgresql,
 so you can leverage external and scalable storage systems and keep the postgresql storage usage to a much lower level.

-The supported archive drivers are:
-
-* S3 - Any AWS s3-api compatible system (e.g. minio, scality, etc)
-* OpenStack Swift 
-* Local FS - A local filesystem on the core pod. Does not handle sharding or replication, so generally only for testing.
-* DB - the default postgresql backend
-
-Configuring Compression:
+##### Configuring Compression:

 The archive system has compression available to help reduce size of objects and storage consumed in exchange for slightly
 slower performance and more cpu usage. There are two config values:

-To toggle on/off (default is True)
-* coreConfig.archive.compression.enabled=True
+To toggle on/off (default is True), and set a minimum size for compression to be used (to avoid compressing things too small to be of much benefit, the default is 100):

-To set a minimum size for compression to be used (to avoid compressing things too small to be of much benefit, the default is 100):
-* coreConfig.archive.compression.min_size_kbytes=100
+  ```
+  anchoreCatalog:
+    archive:
+      compression:
+        enabled=True
+        min_size_kbytes=100
+  ```

-Using S3, in values.yaml:
+##### The supported archive drivers are:

-```
-coreConfig:
-  archive:
-    driver:
-      name: 's3'
-      config:
-        access_key: 'MY_ACCESS_KEY'
-        secret_key: 'MY_SECRET_KEY'
-        #iamauto: True
-        url: 'https://S3-end-point.example.com'
-        region: null
-        bucket: 'anchorearchive'
-        create_bucket: True
-    compression:
-    ... # Compression ocnfig here
-```
+* S3 - Any AWS s3-api compatible system (e.g. minio, scality, etc)
+* OpenStack Swift
+* Local FS - A local filesystem on the core pod. Does not handle sharding or replication, so generally only for testing.
+* DB - the default postgresql backend

-Using Swift:
+#### S3:
+  ```
+  anchoreCatalog:
+    archive:
+      storage_driver:
+        name: 's3'
+        config:
+          access_key: 'MY_ACCESS_KEY'
+          secret_key: 'MY_SECRET_KEY'
+          #iamauto: True
+          url: 'https://S3-end-point.example.com'
+          region: null
+          bucket: 'anchorearchive'
+          create_bucket: True
+      compression:
+      ... # Compression config here
+  ```
+
+#### Using Swift:

 The swift configuration is basically a pass-thru to the underlying pythonswiftclient so it can take quite a few different
 options depending on your swift deployment and config. The best way to configure the swift driver is by using a custom values.yaml

-The Swift driver supports three authentication methods: 
+The Swift driver supports three authentication methods:

 * Keystone V3
 * Keystone V2
 * Legacy (username / password)

-To set the config for Keystone V3 in the values.yaml file:
-```
-coreConfig:
-  archive:
-    driver:
-      name: swift
-      config:
-        auth_version: '3'
-        os_username: 'myusername'
-        os_password: 'mypassword'
-        os_project_name: myproject
-        os_project_domain_name: example.com
-        os_auth_url: 'foo.example.com:8000/auth/etc'
-        container: 'anchorearchive'
-        # Optionally
-        create_container: True 
-    compression:
-    ... # Compression config here
-```
+##### Keystone V3:
+  ```
+  anchoreCatalog:
+    archive:
+      storage_driver:
+        name: swift
+        config:
+          auth_version: '3'
+          os_username: 'myusername'
+          os_password: 'mypassword'
+          os_project_name: myproject
+          os_project_domain_name: example.com
+          os_auth_url: 'foo.example.com:8000/auth/etc'
+          container: 'anchorearchive'
+          # Optionally
+          create_container: True
+      compression:
+      ... # Compression config here
+  ```

-To set the config for Keystone V2, in the values.yaml:
-```
-coreConfig:
-  archive:
-    driver:    
-      name: swift
-      config:
-        auth_version: '2'
-        os_username: 'myusername'
-        os_password: 'mypassword'
-        os_tenant_name: 'mytenant'
-        os_auth_url: 'foo.example.com:8000/auth/etc'
-        container: 'anchorearchive'
-        # Optionally
-        create_container: True
-    compression:
-    ... # Compression config here
+##### Keystone V2:
+  ```
+  anchoreCatalog:
+    archive:
+      storage_driver:    
+        name: swift
+        config:
+          auth_version: '2'
+          os_username: 'myusername'
+          os_password: 'mypassword'
+          os_tenant_name: 'mytenant'
+          os_auth_url: 'foo.example.com:8000/auth/etc'
+          container: 'anchorearchive'
+          # Optionally
+          create_container: True
+      compression:
+      ... # Compression config here
+  ```

-```
+##### Legacy username/password:
+  ```
+  anchoreCatalog:
+    archive:
+      storage_driver:
+        name: swift
+        config:
+          user: 'user:password'
+          auth: 'http://swift.example.com:8080/auth/v1.0'
+          key:  'anchore'
+          container: 'anchorearchive'
+          # Optionally
+          create_container: True
+      compression:
+      ... # Compression config here
+  ```

-To set the config for Legacy username/password, in the values.yaml:
-```
-coreConfig:
-  archive:
-    compression:
-      enabled: False
-      min_size_kbytes: 100
-    driver:
-      name: swift
-      config:
-        user: 'user:password'
-        auth: 'http://swift.example.com:8080/auth/v1.0'
-        key:  'anchore'
-        container: 'anchorearchive'
-        # Optionally
-        create_container: True
-    compression:
-    ... # Compression config here
-```
+#### Postgresql:

+This is the default archive driver and requires no additional configuration.

-Using Postgresql:
+### Prometheus Metrics

-This is the default and requires very little configuration.
-
-* coreConfig.archive.driver.name=db
-* coreconfig.archive.driver.config={}
-
-
-### Prometheus Metrics (new in v0.1.8 of chart)
-
-Anchore Engine, as of v0.2.1, also supports exporting prometheus metrics form each container.
-To enable metrics:
-
-* globalConfig.enableMetrics=True
+Anchore Engine supports exporting prometheus metrics form each container. To enable metrics:
+  ```
+  anchoreGlobal:
+    enableMetrics: True
+  ```

 When enabled, each service provides the metrics over the existing service port so your prometheus deployment will need to
 know about each pod and the ports it provides to scrape the metrics.

-### Event Notifications (new in v0.1.8 of chart)
+### Event Notifications

 Anchore Engine in v0.2.3 introduces a new events subsystem that exposes system-wide events via both a REST api as well
 as via webhooks. The webhooks support filtering to ensure only certain event classes result in webhook calls to help limit
@@ -222,50 +228,75 @@ the volume of calls if you desire. Events, and all webhooks, are emitted from th
 done in the coreConfig.

 To configure the events:
+  ```
+  anchoreCatalog:
+    events:
+      notification:
+        enabled:true
+      level=error
+  ```

-* coreConfig.events.notification.enabled=True
-* coreconfig.events.level=[info, error] (Default is error only)
+### Scaling Individual Components

-
-### Policy Sync from anchore.io
-
-anchore.io is a hosted version of anchore engine that includes a UI and policy editor. You can configure a local anchore-engine
-to download and keep the policy bundles in sync (policies defining how to evaluate images).
-Simply provide the credentials for your anchore.io account in the values.yaml or using `--set` on CLI to enable:
-
-* coreConfig.policyBundleSyncEnabled=True
-* globalConfig.users.admin.anchoreIOCredentials.useAnonymous=False
-* globalConfig.users.admin.anchoreIOCredentials.user=username
-* globalConfig.users.admin.anchoreIOCredentials.password=password
-
-
-Adding Core Components
----------------------
-
-As of Anchore Engine v0.2.0, all services can now be scaled-out by increasing the replica counts. The chart now supports
+As of Anchore Engine v0.3.0, all services can now be scaled-out by increasing the replica counts. The chart now supports
 this configuration.

-To set a specific number of core service containers:
+To set a specific number of service containers:
+  ```
+  anchoreAnalyzer:
+    replicaCount: 5

-`helm install stable/anchore-engine --set coreConfig.replicaCount=2`
+  anchorePolicyEngine:
+    replicaCount: 3
+  ```

 To update the number in a running configuration:

-`helm upgrade --set coreConfig.replicaCount=2 <releasename> stable/anchore-engine <-f values.yaml>`
+`helm upgrade --set anchoreAnalyzer.replicaCount=2 <releasename> stable/anchore-engine -f anchore_values.yaml`

-Adding Workers
--------------
+## Adding Enterprise Components

-To set a specific number of workers once the service is running:
+ The following features are available to Anchore Enterprise customers. Please contact the Anchore team for more information about getting a license for the enterprise features. [Anchore Enterprise Demo](https://anchore.com/demo/)

-If using defaults from the chart:
+### Enabling Enterprise Services
+Enterprise services require an Anchore Enterprise license, as well as credentials with
+permission to the private docker repositories that contain the enterprise images.

-`helm upgrade --set workerConfig.replicaCount=2 <releasename> stable/anchore-engine`
+To use this Helm chart with the enterprise services enabled, perform these steps.

-If customized values, use the local directory for the chart values:
+1. Create a kubernetes secret containing your license file.

-`helm upgrade --set workerConfig.replicaCount=2 <releasename> ./anchore-engine`
+    `kubectl create secret generic anchore-enterprise-license --from-file=license.yaml=<PATH/TO/LICENSE.YAML>`

-To launch with more than one worker you can either modify values.yaml or run with:
+1. Create a kubernetes secret containing dockerhub credentials with access to the private anchore enterprise repositories.

-`helm install --set workerConfig.replicaCount=2 stable/anchore-engine`
+    `kubectl create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username=<DOCKERHUB_USER> --docker-password=<DOCKERHUB_PASSWORD> --docker-email=<EMAIL_ADDRESS>`
+
+1. Install the helm chart using a custom anchore_values.yaml file (see examples below)
+
+    `helm install --name <release_name> -f /path/to/anchore_values.yaml stable/anchore-engine`
+
+##### Example anchore_values.yaml file for installing Anchore Enterprise
+Note: This installs with chart managed PostgreSQL & Redis databases.
+  ```
+  ## anchore_values.yaml
+
+  postgresql:
+    postgresPassword: <PASSWORD>
+    persistence:
+      size: 50Gi
+
+  anchoreGlobal:
+    defaultAdminPassword: <PASSWORD>
+    defaultAdminEmail: <EMAIL>
+    enableMetrics: True
+
+  anchoreEnterpriseGlobal:
+    enabled: True
+
+  anchore-feeds-db:
+    postgresPassword: <PASSWORD>
+
+  anchore-ui-redis:
+    password: <PASSWORD>
+  ```
@@ -1,6 +1,12 @@
 dependencies:
 - name: postgresql
  repository: https://kubernetes-charts.storage.googleapis.com
-  version: 0.18.0
-digest: sha256:4bc4d595ff06f16017dbc5caeb9452bec76886dda4cadb26d0901195ba9144ce
-generated: 2018-09-21T21:58:40.643557498+01:00
+  version: 1.0.0
+- name: postgresql
+  repository: https://kubernetes-charts.storage.googleapis.com
+  version: 1.0.0
+- name: redis
+  repository: https://kubernetes-charts.storage.googleapis.com
+  version: 4.2.7
+digest: sha256:7a15cbf9e0bb350d68491b7e85fec2885c1407009290cc52ee612a181942f921
+generated: 2018-11-14T21:22:15.107839-08:00
@@ -1,5 +1,17 @@
 dependencies:
  - name: postgresql
-    version: "*"
+    version: "1.0.0"
    repository: "alias:stable"
    condition: postgresql.enabled
+
+  - name: postgresql
+    version: "1.0.0"
+    repository: "alias:stable"
+    condition: anchore-feeds-db.enabled,anchoreEnterpriseGlobal.enabled
+    alias: anchore-feeds-db
+
+  - name: redis
+    version: "4.2.7"
+    repository: "alias:stable"
+    condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled
+    alias: anchore-ui-redis
@@ -1,24 +1,24 @@
 To use Anchore Engine you need the URL, username, and password to access the API.

-Anchore Engine can be accessed via port {{ .Values.service.ports.api }} on the following DNS name from within the cluster:
-{{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
+Anchore Engine can be accessed via port {{ .Values.anchoreGlobal.service.ports.extApi }} on the following DNS name from within the cluster:
+{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local

 Here are the steps to configure the anchore-cli (`pip install anchorecli`). Use these same values for direct API access as well.

 To configure your anchore-cli run:

    ANCHORE_CLI_USER=admin
-    ANCHORE_CLI_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.adminPassword}" | base64 --decode; echo)
-{{ if .Values.ingress.enabled }}
-   ANCHORE_CLI_URL=http://$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")
+    ANCHORE_CLI_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "anchore-engine.fullname" . }} -o jsonpath="{.data.ANCHORE_ADMIN_PASSWORD}" | base64 --decode; echo)
+{{ if .Values.anchoreApi.ingress.enabled }}
+   ANCHORE_CLI_URL=http://$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "anchore-engine.api.fullname" . }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")
 {{ else }}
 Using the service endpoint from within the cluster you can use:
-    ANCHORE_CLI_URL=http://{{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.api}}/v1/
+    ANCHORE_CLI_URL=http://{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.anchoreGlobal.service.ports.extApi}}/v1/
 {{ end }}

 To verify the service is up and running, you can run container for the Anchore Engine CLI:

-    kubectl run -i --tty anchore-cli --restart=Always --image anchore/engine-cli --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://{{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.api}}/v1/
+    kubectl run -i --tty anchore-cli --restart=Always --image anchore/engine-cli --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.anchoreGlobal.service.ports.extApi}}/v1/

 from within the container you can use 'anchore-cli' commands.

@@ -26,7 +26,7 @@ from within the container you can use 'anchore-cli' commands.
 Once the sync is complete, any queued images will be analyzed and the system status will change to 'all_up'.

 Initial setup time can be >60sec for postgresql setup and readiness checks to pass for the services as indicated by pod state. You can check with:
-    kubectl get pods -l app={{ template "fullname" .}},component=core
+    kubectl get pods -l app={{ template "anchore-engine.fullname" .}},component=api


 A quick primer on using the Anchore Engine CLI follows. For more info see: https://github.com/anchore/anchore-engine/wiki/Getting-Started
@@ -59,5 +59,3 @@ List OS packages found in the image with:

 List files found in the image with:
    anchore-cli image content <imageref> files
-
-
@@ -10,7 +10,7 @@ Expand the name of the chart.
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 */}}
-{{- define "fullname" -}}
+{{- define "anchore-engine.fullname" -}}
 {{- $name := default .Chart.Name .Values.nameOverride -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
@@ -19,18 +19,72 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 */}}
-{{- define "worker.fullname" -}}
+{{- define "anchore-engine.analyzer.fullname" -}}
 {{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- printf "%s-%s-%s" .Release.Name $name "worker"| trunc 63 | trimSuffix "-" -}}
+{{- printf "%s-%s-%s" .Release.Name $name "analyzer"| trunc 63 | trimSuffix "-" -}}
 {{- end -}}

 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 */}}
-{{- define "core.fullname" -}}
+{{- define "anchore-engine.catalog.fullname" -}}
 {{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- printf "%s-%s-%s" .Release.Name $name "core"| trunc 63 | trimSuffix "-" -}}
+{{- printf "%s-%s-%s" .Release.Name $name "catalog"| trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "anchore-engine.api.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s-%s" .Release.Name $name "api"| trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "anchore-engine.policy-engine.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s-%s" .Release.Name $name "policy"| trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "anchore-engine.simplequeue.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s-%s" .Release.Name $name "simplequeue"| trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "anchore-engine.enterprise.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s-%s" .Release.Name $name "enterprise"| trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "anchore-engine.enterprise-ui.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s-%s" .Release.Name $name "enterprise-ui"| trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "anchore-engine.enterprise-feeds.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s-%s" .Release.Name $name "enterprise-feeds"| trunc 63 | trimSuffix "-" -}}
 {{- end -}}

 {{/*
@@ -40,3 +94,19 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- define "postgres.fullname" -}}
 {{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Create a default fully qualified dependency name for the feeds db.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "postgres.anchore-feeds-db.fullname" -}}
+{{- printf "%s-%s" .Release.Name "anchore-feeds-db" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified dependency name for the db.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "redis.fullname" -}}
+{{- printf "%s-%s" .Release.Name "anchore-ui-redis" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
@@ -0,0 +1,97 @@
+{{- $component := "analyzer" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "anchore-engine.analyzer.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: {{ $component }}
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" . }}"
+      component: {{ $component }}
+  replicas: {{ .Values.anchoreAnalyzer.replicaCount }}
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+{{- if .Values.anchoreAnalyzer.annotations }}
+      annotations:
+{{ toYaml .Values.anchoreAnalyzer.annotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: {{ .Values.anchoreGlobal.image.repository }}:{{ .Values.anchoreGlobal.image.tag }}
+        imagePullPolicy: {{ .Values.anchoreGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-manager"]
+        args: ["service", "start", "analyzer"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - name: analyzer-api
+          containerPort: {{ .Values.anchoreGlobal.service.ports.analyzer }}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        - name: analysis-scratch
+          mountPath: {{ .Values.anchoreAnalyzer.scratchVolume.mountPath }}
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: analyzer-api
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: analyzer-api
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreAnalyzer.resources | indent 10 }}
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ template "anchore-engine.fullname" .}}
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          secret:
+            secretName: {{ .Values.anchoreGlobal.internalServicesSsl.certSecret }}
+        {{- end }}
+        - name: analysis-scratch
+{{ toYaml .Values.anchoreAnalyzer.scratchVolume.details | indent 10 }}
+    {{- if .Values.anchoreAnalyzer.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchoreAnalyzer.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreAnalyzer.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreAnalyzer.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
@@ -0,0 +1,236 @@
+{{- $component := "api" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "anchore-engine.api.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    component: {{ $component }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" . }}"
+      component: {{ $component }}
+  replicas: {{ .Values.anchoreApi.replicaCount }}
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+{{- if .Values.anchoreApi.annotations }}
+      annotations:
+{{ toYaml .Values.anchoreApi.annotations | indent 8 }}
+{{- end }}
+    spec:
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ template "anchore-engine.fullname" .}}
+        {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
+        - name: anchore-license
+          secret:
+            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
+        - name: rbac-config-volume
+          configMap:
+            name: {{ template "anchore-engine.enterprise.fullname" . }}
+        {{- end}}
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          secret:
+            secretName: {{ .Values.anchoreGlobal.internalServicesSsl.certSecret }}
+        {{- end }}
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: {{ .Values.anchoreGlobal.image.repository }}:{{ .Values.anchoreGlobal.image.tag }}
+        imagePullPolicy: {{ .Values.anchoreGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-manager"]
+        args: ["service", "start", "apiext"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - containerPort: {{ .Values.anchoreGlobal.service.ports.extApi }}
+          name: external-api
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: external-api
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: external-api
+          timeoutSeconds: 10
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreApi.resources | indent 10 }}
+
+      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
+      - name: {{ .Chart.Name }}-rbac-manager
+        image: "{{ .Values.anchoreEnterpriseGlobal.image.repository }}:{{ .Values.anchoreEnterpriseGlobal.image.tag }}"
+        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-enterprise-manager"]
+        args: ["service", "start", "rbac_manager"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - containerPort: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
+          name: rbac-manager
+        volumeMounts:
+        - name: anchore-license
+          mountPath: /license.yaml
+          subPath: license.yaml
+        - name: rbac-config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: rbac-manager
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: rbac-manager
+          timeoutSeconds: 10
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreEnterpriseRbac.managerResources | indent 10 }}
+
+      - name: {{ .Chart.Name }}-rbac-authorizer
+        image: "{{ .Values.anchoreEnterpriseGlobal.image.repository }}:{{ .Values.anchoreEnterpriseGlobal.image.tag }}"
+        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-enterprise-manager"]
+        args: ["service", "start", "rbac_authorizer"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - containerPort: {{ .Values.anchoreGlobal.service.ports.rbacAuth }}
+          name: rbac-auth
+        volumeMounts:
+        - name: anchore-license
+          mountPath: /license.yaml
+          subPath: license.yaml
+        - name: rbac-config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        readinessProbe:
+          exec:
+            command:
+              - curl
+              - 'localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}/health'
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        livenessProbe:
+          exec:
+            command:
+              - curl
+              - 'localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}/health'
+          timeoutSeconds: 10
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreEnterpriseRbac.authResources | indent 10 }}
+
+      imagePullSecrets:
+      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
+      {{- end }}
+
+      {{- if .Values.anchoreApi.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchoreApi.nodeSelector | indent 8 }}
+      {{- end }}
+      {{- with .Values.anchoreApi.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      {{- with .Values.anchoreApi.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "anchore-engine.api.fullname" . }}
+  labels:
+    app: {{ template "anchore-engine.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    component: {{ $component }}
+spec:
+  type: {{ .Values.anchoreGlobal.service.type }}
+  ports:
+    - name: anchore-external-api
+      port: {{ .Values.anchoreGlobal.service.ports.extApi }}
+      targetPort: {{ .Values.anchoreGlobal.service.ports.extApi }}
+      protocol: TCP
+  {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
+    - name: anchore-rbac-manager
+      port: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
+      targetPort: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
+      protocol: TCP
+  {{- end }}
+  selector:
+    app: {{ template "anchore-engine.fullname" . }}
+    component: {{ $component }}
@@ -0,0 +1,115 @@
+{{- $component := "catalog" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "anchore-engine.catalog.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: {{ $component }}
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" . }}"
+      component: {{ $component }}
+  replicas: {{ .Values.anchoreCatalog.replicaCount }}
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+{{- if .Values.anchoreCatalog.annotations }}
+      annotations:
+{{ toYaml .Values.anchoreCatalog.annotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: {{ .Values.anchoreGlobal.image.repository }}:{{ .Values.anchoreGlobal.image.tag }}
+        imagePullPolicy: {{ .Values.anchoreGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-manager"]
+        args: ["service", "start", "catalog"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - name: catalog
+          containerPort: {{ .Values.anchoreGlobal.service.ports.catalog }}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: catalog
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: catalog
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreCatalog.resources | indent 10 }}
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ template "anchore-engine.fullname" .}}
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          secret:
+            secretName: {{ .Values.anchoreGlobal.internalServicesSsl.certSecret }}
+        {{- end }}
+    {{- if .Values.anchoreCatalog.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchoreCatalog.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreCatalog.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreCatalog.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "anchore-engine.catalog.fullname" . }}
+  labels:
+    app: {{ template "anchore-engine.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    component: {{ $component }}
+spec:
+  type: {{ .Values.anchoreGlobal.service.type }}
+  ports:
+    - name: anchore-catalog-api
+      port: {{ .Values.anchoreGlobal.service.ports.catalog }}
+      targetPort: {{ .Values.anchoreGlobal.service.ports.catalog }}
+      protocol: TCP
+  selector:
+    app: {{ template "anchore-engine.fullname" . }}
+    component: {{ $component }}
@@ -1,135 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: "{{ template "core.fullname" . }}"
-  labels:
-    app: "{{ template "fullname" . }}"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-    component: core
-data:
-  config.yaml: |
-    # Anchore Service Configuration File from ConfigMap
-    service_dir: {{ .Values.globalConfig.configDir }}
-    tmp_dir: "/tmp"
-
-    allow_awsecr_iam_auto: {{ .Values.globalConfig.allowECRUseIAMRole }}
-    cleanup_images: {{ .Values.globalConfig.cleanupImages }}
-
-    log_level: {{ .Values.coreConfig.logLevel }}
-    host_id: ${ANCHORE_POD_NAME}
-    internal_ssl_verify: {{ .Values.globalConfig.internalServicesSslVerifyCerts }}
-
-    metrics:
-      enabled: {{ .Values.globalConfig.enableMetrics }}
-
-    # Uncomment if you have a local endpoint that can accept
-    # notifications from the anchore-engine, as configured below
-    #
-    {{ if .Values.coreConfig.webhooks.enabled }}
-    webhooks:
-{{ toYaml .Values.coreConfig.webhooks.config | indent 6 }}
-    {{ end }}
-
-    # Configure what feeds to sync. The 'admin' anchoreIO credentials are used if present, but not required.
-    # The 'anonymous' user is used for the sync otherwise.
-    # The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
-    feeds:
-      selective_sync:
-        # If enabled only sync specific feeds instead of all that are found.
-        enabled: True
-        feeds:
-          # Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
-          vulnerabilities: True
-          # NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
-          nvd: True
-          # Warning: enabling the package sync causes the service to require much
-          #   more memory to do process the significant data volume. We recommend at least 4GB available for the container
-          packages: False
-    #  anonymous_user_username: anon@ancho.re
-    #  anonymous_user_password: pbiU2RYZ2XrmYQ
-    #  url: 'https://ancho.re/v1/service/feeds'
-    #  client_url: 'https://ancho.re/v1/account/users'
-    #  token_url: 'https://ancho.re/oauth/token'
-    #  connection_timeout_seconds: 3
-    #  read_timeout_seconds: 60
-
-    credentials:
-      users:
-        admin:
-          password: ${ANCHORE_ADMIN_PASSWORD}
-          email: {{ .Values.globalConfig.users.admin.email }}
-          external_service_auths:
-          {{ if not .Values.globalConfig.users.admin.anchoreIOCredentials.useAnonymous }}
-            anchoreio:
-              anchorecli:
-                auth: "${ANCHORE_IO_USER}:${ANCHORE_IO_PASSWORD}"
-          {{ end }}
-          auto_policy_sync: {{ .Values.coreConfig.policyBundleSyncEnabled }}
-
-      database:
-        {{ if .Values.postgresql.enabled }}
-        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@{{ template "postgres.fullname" . }}:5432/{{ .Values.postgresql.postgresDatabase }}'
-        {{ else }}
-        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@{{ .Values.postgresql.externalEndpoint}}/{{ .Values.postgresql.postgresDatabase }}'
-        {{ end }}
-        db_connect_args:
-          timeout: 120
-          ssl: {{ .Values.postgresql.sslEnabled }}
-        db_pool_size: {{ .Values.globalConfig.dbConfig.connectionPoolSize }}
-        db_pool_max_overflow: {{ .Values.globalConfig.dbConfig.connectionPoolSize }}
-    services:
-      apiext:
-        enabled: True
-        require_auth: True
-        endpoint_hostname: {{ template "fullname" . }}
-        listen: '0.0.0.0'
-        port: {{ .Values.service.ports.api }}
-        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
-        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
-        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
-      kubernetes_webhook:
-        enabled: True
-        require_auth: False
-        endpoint_hostname: {{ template "fullname" . }}
-        listen: '0.0.0.0'
-        port: {{ .Values.service.ports.k8sImagePolicyWebhook }}
-        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
-        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
-        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
-      catalog:
-        enabled: True
-        require_auth: True
-        endpoint_hostname: {{ template "fullname" . }}
-        listen: '0.0.0.0'
-        port: {{ .Values.service.ports.catalog }}
-        use_db: True
-        cycle_timer_seconds: '1'
-        cycle_timers:
-{{ toYaml .Values.globalConfig.cycleTimers | indent 10 }}
-        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
-        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
-        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
-        event_log:
-{{ toYaml .Values.coreConfig.events | indent 10 }}
-        archive:
-{{ toYaml .Values.coreConfig.archive | indent 10 }}
-      simplequeue:
-        enabled: True
-        require_auth: True
-        endpoint_hostname: {{ template "fullname" . }}
-        listen: '0.0.0.0'
-        port: {{ .Values.service.ports.queue }}
-        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
-        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
-        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
-      policy_engine:
-        enabled: True
-        require_auth: True
-        endpoint_hostname: {{ template "fullname" . }}
-        listen: '0.0.0.0'
-        port: {{ .Values.service.ports.policy }}
-        ssl_cert: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretCertName }}
-        ssl_key: {{ .Values.coreConfig.ssl.certDir -}}/{{- .Values.coreConfig.ssl.certSecretKeyName }}
-        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
@@ -1,126 +0,0 @@
-apiVersion: apps/v1beta1
-kind: Deployment
-metadata:
-  name: "{{ template "core.fullname" . }}"
-  labels:
-    app: "{{ template "fullname" . }}"
-    component: core
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  replicas: {{ .Values.coreConfig.replicaCount }}
-  template:
-    metadata:
-      labels:
-        app: "{{ template "fullname" . }}"
-        component: core
-{{- if .Values.coreConfig.annotations }}
-      annotations:
-{{ toYaml .Values.coreConfig.annotations | indent 8 }}
-{{- end }}
-    spec:
-      volumes:
-        - name: config-volume
-          configMap:
-            name: {{ template "core.fullname" .}}
-        {{- if .Values.globalConfig.internalServicesSslEnabled }}
-        - name: certs
-          secret:
-            secretName: {{ .Values.coreConfig.ssl.certSecret }}
-        {{- end }}
-      containers:
-      - name: {{ .Chart.Name }}-core
-        image: {{ .Values.image.tag }}
-        imagePullPolicy: {{ .Values.image.pullPolicy }}
-        ports:
-        - containerPort: {{ .Values.service.ports.api }}
-          name: external-api
-        - containerPort: {{ .Values.service.ports.queue }}
-          name: queue-service
-        - containerPort: {{ .Values.service.ports.k8sImagePolicyWebhook }}
-          name: webhook-service
-        - containerPort: {{ .Values.service.ports.catalog }}
-          name: catalog
-        - containerPort: {{ .Values.service.ports.policy }}
-          name: policy-engine
-        env:
-        - name: ANCHORE_DB
-          value: {{ .Values.postgresql.postgresDatabase }}
-        - name: ANCHORE_DB_HOST
-          value: {{ template "postgres.fullname" . }}
-        - name: ANCHORE_IO_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: anchoreIOUser
-        - name: ANCHORE_IO_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: anchoreIOPassword
-        - name: ANCHORE_DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: dbUser
-        - name: ANCHORE_DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: dbPassword
-        - name: ANCHORE_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: adminPassword
-        - name: ANCHORE_POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: ANCHORE_POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ANCHORE_POD_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        volumeMounts:
-        - name: config-volume
-          mountPath: /config
-        {{- if .Values.globalConfig.internalServicesSslEnabled }}
-        - name: certs
-          mountPath: {{ default "/certs" .Values.coreConfig.ssl.certDir }}
-          readOnly: true
-        {{- end }}
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: external-api
-          initialDelaySeconds: 60
-          periodSeconds: 10
-          timeoutSeconds: 10
-          failureThreshold: 10
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: external-api
-          timeoutSeconds: 10
-          initialDelaySeconds: 60
-          periodSeconds: 30
-          failureThreshold: 10
-        resources:
-{{ toYaml .Values.coreConfig.resources | indent 10 }}
-    {{- if .Values.coreConfig.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.coreConfig.nodeSelector | indent 8 }}
-    {{- end }}
-    {{- with .Values.coreConfig.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.coreConfig.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-    {{- end }}
@@ -0,0 +1,160 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: "{{ template "anchore-engine.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+data:
+  ANCHORE_DB_NAME: {{ index .Values "postgresql" "postgresDatabase" | quote }}
+  ANCHORE_DB_USER: {{ index .Values "postgresql" "postgresUser" | quote }}
+  {{- if and (index .Values "postgresql" "externalEndpoint") (not (index .Values "postgresql" "enabled")) }}
+  ANCHORE_DB_HOST: {{ index .Values "postgresql" "externalEndpoint" | quote }}
+  {{- else }}
+  ANCHORE_DB_HOST: "{{ template "postgres.fullname" . }}:5432"
+  {{- end }}
+
+  config.yaml: |
+    # Anchore Service Configuration File from ConfigMap
+
+    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
+    tmp_dir: {{ default "/scratch" .Values.anchoreAnalyzer.scratchVolume.mountPath }}
+    log_level: {{ .Values.anchoreGlobal.logLevel }}
+    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
+
+    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
+    host_id: ${ANCHORE_POD_NAME}
+    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
+    auto_restart_services: false
+
+    metrics:
+      enabled: {{ .Values.anchoreGlobal.enableMetrics }}
+
+    # Uncomment if you have a local endpoint that can accept
+    # notifications from the anchore-engine, as configured below
+    #
+    {{ if .Values.anchoreGlobal.webhooksEnabled }}
+    webhooks:
+{{ toYaml .Values.anchoreGlobal.webhooks | indent 6 }}
+    {{ end }}
+
+    # Configure what feeds to sync. The 'admin' anchoreIO credentials are used if present, but not required.
+    # The 'anonymous' user is used for the sync otherwise.
+    # The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
+    feeds:
+      sync_enabled: true
+      selective_sync:
+        # If enabled only sync specific feeds instead of all that are found.
+        enabled: true
+        feeds:
+          # Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
+          vulnerabilities: {{ default "true" .Values.anchoreGlobal.syncVulnerabilites }}
+          # NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
+          nvd: {{ default "true" .Values.anchoreGlobal.syncNvd }}
+          # Warning: enabling the package sync causes the service to require much
+          #   more memory to do process the significant data volume. We recommend at least 4GB available for the container
+          {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
+          packages: true
+          {{- else }}
+          packages: {{ default "false" .Values.anchoreGlobal.syncPackages }}
+          {{- end }}
+          # Enabling snyk syncs snyk vulnerability data from an on-premise anchore enterprise feeds service. Please contact
+          # anchore support for finding out more about this service
+          {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
+          snyk: {{ default "true" .Values.anchoreEnterpriseFeeds.synkDriverEnabled }}
+          {{- else }}
+          snyk: false
+          {{- end }}
+      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
+      url: 'http://{{ template "anchore-engine.enterprise-feeds.fullname" . }}:{{ .Values.anchoreGlobal.service.ports.feedsApi }}/v1/feeds'
+      client_url:
+      token_url:
+      {{- else }}
+      client_url: 'https://ancho.re/v1/account/users'
+      token_url: 'https://ancho.re/oauth/token'
+      anonymous_user_username: anon@ancho.re
+      anonymous_user_password: pbiU2RYZ2XrmYQ
+      {{- end }}
+      connection_timeout_seconds: {{ default 3 .Values.anchoreGlobal.feedsConnectionTimeout }}
+      read_timeout_seconds: {{ default 60 .Values.anchoreGlobal.feedsReadTimeout }}
+
+    default_admin_password: ${ANCHORE_ADMIN_PASSWORD}
+    default_admin_email: {{ .Values.anchoreGlobal.defaultAdminEmail }}
+
+    credentials:
+      database:
+        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}'
+        db_connect_args:
+          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
+          ssl: {{ .Values.anchoreGlobal.dbConfig.ssl }}
+        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
+        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
+
+    services:
+      apiext:
+        enabled: true
+        require_auth: true
+        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.extApi }}
+        {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
+        authorization_handler: external
+        authorization_handler_config:
+          endpoint: "http://localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}"
+        {{- end }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+      analyzer:
+        enabled: true
+        require_auth: true
+        endpoint_hostname: {{ template "anchore-engine.analyzer.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.analyzer }}
+        cycle_timer_seconds: 1
+        cycle_timers:
+{{ toYaml .Values.anchoreAnalyzer.cycleTimers | indent 10 }}
+        max_threads: {{ .Values.anchoreAnalyzer.concurrentTasksPerWorker }}
+        analyzer_driver: 'nodocker'
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{ .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+      catalog:
+        enabled: true
+        require_auth: true
+        endpoint_hostname: {{ template "anchore-engine.catalog.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.catalog }}
+        cycle_timer_seconds: '1'
+        cycle_timers:
+{{ toYaml .Values.anchoreCatalog.cycleTimers | indent 10 }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+        event_log:
+{{ toYaml .Values.anchoreCatalog.events | indent 10 }}
+        archive:
+{{ toYaml .Values.anchoreCatalog.archive | indent 10 }}
+      simplequeue:
+        enabled: true
+        require_auth: true
+        endpoint_hostname: {{ template "anchore-engine.simplequeue.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+      policy_engine:
+        enabled: true
+        require_auth: true
+        endpoint_hostname: {{ template "anchore-engine.policy-engine.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
+        cycle_timer_seconds: 1
+        cycle_timers:
+{{ toYaml .Values.anchorePolicyEngine.cycleTimers | indent 10 }}
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
@@ -0,0 +1,135 @@
+{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled -}}
+{{- $component := "enterprise-feeds" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "anchore-engine.enterprise-feeds.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    component: {{ $component }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" . }}"
+      component: {{ $component }}
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+{{- if .Values.anchoreEnterpriseFeeds.annotations }}
+      annotations:
+{{ toYaml .Values.anchoreEnterpriseFeeds.annotations | indent 8 }}
+{{- end }}
+    spec:
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ template "anchore-engine.enterprise-feeds.fullname" .}}
+        - name: scratch-volume
+{{ toYaml .Values.anchoreEnterpriseFeeds.scratchVolume.details | indent 10 }}
+        - name: anchore-license
+          secret:
+            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
+      imagePullSecrets:
+      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: "{{ .Values.anchoreEnterpriseGlobal.image.repository }}:{{ .Values.anchoreEnterpriseGlobal.image.tag }}"
+        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-enterprise-manager"]
+        args: ["service", "start", "feeds"]
+        ports:
+        - containerPort: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
+          name: feeds-api
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        {{- if and (index .Values "anchore-feeds-db" "externalEndpoint") (not (index .Values "anchore-feeds-db" "enabled")) }}
+        - name: ANCHORE_DB_HOST
+          value: {{ index .Values "anchore-feeds-db" "externalEndpoint" | quote }}
+        {{- else}}
+        - name: ANCHORE_DB_HOST
+          value: "{{ template "postgres.anchore-feeds-db.fullname" . }}:5432"
+        {{- end }}
+        - name: ANCHORE_DB_NAME
+          value: {{ index .Values "anchore-feeds-db" "postgresDatabase" | quote }}
+        - name: ANCHORE_DB_USER
+          value: {{ index .Values "anchore-feeds-db" "postgresUser"  | quote }}
+        - name: ANCHORE_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "anchore-engine.fullname" . }}
+              key: .feedsDbPassword
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        - name: scratch-volume
+          mountPath: {{ .Values.anchoreEnterpriseFeeds.scratchVolume.mountPath }}
+        - name: anchore-license
+          mountPath: /license.yaml
+          subPath: license.yaml
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: feeds-api
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: feeds-api
+          timeoutSeconds: 10
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreEnterpriseFeeds.resources | indent 10 }}
+    {{- if .Values.anchoreEnterpriseFeeds.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchoreEnterpriseFeeds.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreEnterpriseFeeds.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreEnterpriseFeeds.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
+  labels:
+    app: {{ template "anchore-engine.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    component: {{ $component }}
+spec:
+  type: {{ .Values.anchoreGlobal.service.type }}
+  ports:
+    - name: feeds-api
+      port: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
+      targetPort: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
+      protocol: TCP
+  selector:
+    app: {{ template "anchore-engine.fullname" . }}
+    component: {{ $component }}
+
+{{- end -}}
@@ -0,0 +1,132 @@
+{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled -}}
+{{- $component := "enterprise-ui" -}}
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "anchore-engine.enterprise-ui.fullname" . | quote }}
+  labels:
+    app: {{ include "anchore-engine.fullname" . | quote }}
+    component: {{ $component }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" .}}"
+      component: {{ $component }}
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+        release: "{{ .Release.Name }}"
+        heritage: "{{ .Release.Service }}"
+{{- if .Values.anchoreEnterpriseUi.annotations }}
+      annotations:
+{{ toYaml .Values.anchoreEnterpriseUi.annotations | indent 8 }}
+{{- end }}
+    spec:
+      volumes:
+      - name: anchore-license
+        secret:
+          secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
+      imagePullSecrets:
+      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: {{ .Values.anchoreEnterpriseUi.image.repository }}:{{ .Values.anchoreEnterpriseUi.image.tag }}
+        imagePullPolicy: {{ .Values.anchoreEnterpriseUi.image.pullPolicy }}
+        env:
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "redis.fullname" . }}
+              key: redis-password
+        {{- if and (index .Values "anchore-ui-redis" "externalEndpoint") (not (index .Values "anchore-ui-redis" "enabled")) }}
+        - name: ANCHORE_REDIS_URI
+          value: {{ index .Values "anchore-ui-redis" "externalEndpoint" | quote }}
+        {{- else }}
+        - name: ANCHORE_REDIS_URI
+          value: {{ printf "redis://:$(REDIS_PASSWORD)@%s-master:6379" ( include "redis.fullname" . ) }}
+        {{- end }}
+        - name: ANCHORE_ENGINE_URI
+          value: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreGlobal.service.ports.extApi }}/v1'
+        - name: ANCHORE_LICENSE_PATH
+          value: '/'
+        {{- if .Values.anchoreEnterpriseRbac.enabled }}
+        - name: ANCHORE_RBAC_URI
+          value: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreGlobal.service.ports.rbacApi }}/v1'
+        {{- end }}
+        - name: ANCHORE_ENABLE_SSL
+          value: '{{ .Values.anchoreEnterpriseUi.enableSsl }}'
+        - name: ANCHORE_ENABLE_PROXY
+          value: '{{ .Values.anchoreEnterpriseUi.enableProxy }}'
+        - name: ANCHORE_ALLOW_SHARED_LOGIN
+          value: '{{ .Values.anchoreEnterpriseUi.enableSharedLogin }}'
+        ports:
+        - containerPort: 3000
+          protocol: TCP
+          name: enterprise-ui
+        volumeMounts:
+        - name: anchore-license
+          mountPath: "/license.yaml"
+          subPath: license.yaml
+        readinessProbe:
+          httpGet:
+            path: /service/health
+            port: enterprise-ui
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        livenessProbe:
+          httpGet:
+            path: /service/health
+            port: enterprise-ui
+          timeoutSeconds: 10
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreEnterpriseUi.resources | indent 10 }}
+    {{- if .Values.anchoreEnterpriseUi.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchoreEnterpriseUi.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreEnterpriseUi.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreEnterpriseUi.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "anchore-engine.enterprise-ui.fullname" . | quote }}
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    component: {{ $component }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  sessionAffinity: ClientIP
+  type: {{ .Values.anchoreGlobal.service.type }}
+  ports:
+    - name: enterprise-ui
+      port: {{ .Values.anchoreGlobal.service.ports.uiHttp }}
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    component: {{ $component }}
+
+{{- end -}}
@@ -0,0 +1,90 @@
+{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "anchore-engine.enterprise-feeds.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: "enterprise-feeds"
+data:
+  config.yaml: |
+    # Anchore Enterprise Service Configuration File
+
+    # General system-wide configuration options, these should not need to
+    # be altered for basic operation
+    #
+    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
+    tmp_dir: {{ default "/scratch" .Values.anchoreAnalyzer.scratchVolume.mountPath }}
+    log_level: {{ .Values.anchoreGlobal.logLevel }}
+    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
+
+    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
+    host_id: "${ANCHORE_POD_NAME}"
+    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
+    auto_restart_services: false
+    license_file: "/license.yaml"
+
+    metrics:
+      enabled: {{ .Values.anchoreGlobal.enableMetrics }}
+
+    credentials:
+      database:
+        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}'
+        db_connect_args:
+          timeout: {{ .Values.anchoreEnterpriseFeeds.dbConfig.timeout }}
+          ssl: {{ .Values.anchoreEnterpriseFeeds.dbConfig.ssl }}
+        db_pool_size: {{ .Values.anchoreEnterpriseFeeds.dbConfig.connectionPoolSize }}
+        db_pool_max_overflow: {{ .Values.anchoreEnterpriseFeeds.dbConfig.connectionPoolSize }}
+
+    services:
+      feeds:
+        enabled: true
+        require_auth: true
+        endpoint_hostname: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
+        # Time delay in seconds between consecutive driver runs for processing data
+        cycle_timers:
+{{ toYaml .Values.anchoreEnterpriseFeeds.cycleTimers | indent 10 }}
+        # Staging space for holding normalized output from drivers.
+        local_workspace: "{{ .Values.anchoreEnterpriseFeeds.scratchVolume.mountPath }}"
+        # Drivers process data from external sources and store normalized data in local_workspace. Processing large data sets
+        # is a time consuming process for some drivers. To speed it up the container is shipped with pre-loaded data which is used
+        # by default if local_workspace is empty.
+        workspace_preload:
+          # Do not use pre-loaded data if local_workspace is empty. Drivers will generate normalized data from scratch
+          # disabled: true
+          # To load the workspace from a different location, uncomment and configure workspace_preload_file property to point to the tar.gz file
+          workspace_preload_file: "/workspace_preload/data.tar.gz"
+        # If api_only is set to true, the service will not update feed data in the system.
+        # API end points will be functional and serve feed data if any is available.
+        api_only: {{ default "false" .Values.anchoreEnterpriseFeeds.apiOnly }}
+        drivers:
+          # Configuration section for drivers collecting and processing feed data.
+          # All drivers are enabled by default unless explicitly disabled. npm and gem drivers are explicitly disabled out of the box
+          npm:
+            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.npmDriverEnabled }}
+          gem:
+            # rubygem data comes packaged as a PostgreSQL dump file. gem driver loads the pg dump and normalizes the data.
+            # To enable gem driver comment the enabled property and uncomment the db_connect property.
+            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.gemDriverEnabled }}
+            db_connect: {{ default "'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/gems'" .Values.anchoreEnterpriseFeeds.gemDbEndpoint }}
+          centos:
+            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.centosDriverEnabled }}
+          debian:
+            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.debianDriverEnabled }}
+          ubuntu:
+            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.ubuntuDriverEnabled }}
+          ol:
+            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.olDriverEnabled }}
+          alpine:
+            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.alpineDriverEnabled }}
+          snyk:
+            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.snykDriverEnabled }}
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+{{- end -}}
@@ -1,43 +1,62 @@
-{{- if .Values.ingress.enabled -}}
+{{- if .Values.anchoreGlobal.ingress.enabled -}}
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
-  name: "{{ template "fullname" . }}"
+  name: "{{ template "anchore-engine.fullname" . }}"
  labels:
-    app: "{{ template "fullname" . }}"
+    app: "{{ template "anchore-engine.fullname" . }}"
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
-    component: core
-{{- if .Values.ingress.annotations }}
+  {{- if .Values.anchoreGlobal.ingress.annotations }}
  annotations:
-{{ toYaml .Values.ingress.annotations | indent 4 }}
-{{- end }}
+{{ toYaml .Values.anchoreGlobal.ingress.annotations | indent 4 }}
+  {{- end }}
 spec:
-{{- if .Values.ingress.tls }}
+  {{- if .Values.anchoreGlobal.ingress.tls }}
  tls:
-  {{- range .Values.ingress.tls }}
+    {{- range .Values.anchoreGlobal.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
+    {{- end }}
  {{- end }}
-{{- end }}
-{{- if .Values.ingress.hosts }}
  rules:
-  {{- range .Values.ingress.hosts }}
-    - host: {{ . }}
+  {{- if .Values.anchoreApi.ingress.hosts }}
+    {{- range .Values.anchoreApi.ingress.hosts }}
+    - host: {{ . | quote }}
      http:
        paths:
-          - path: {{ $.Values.ingress.path }}
-            backend:
-              serviceName: "{{ template "fullname" $ }}"
-              servicePort: {{ $.Values.service.ports.api }}
+        - path: {{ $.Values.anchoreApi.ingress.path }}
+          backend:
+            serviceName: "{{ template "anchore-engine.api.fullname" $ }}"
+            servicePort: {{ $.Values.anchoreGlobal.service.ports.extApi }}
+    {{- end }}
+  {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.anchoreEnterpriseUi.ingress.hosts }}
+    {{- range .Values.anchoreEnterpriseUi.ingress.hosts }}
+    - host: {{ . | quote }}
+      http:
+        paths:
+        - path: {{ $.Values.anchoreEnterpriseUi.ingress.path }}
+          backend:
+            serviceName: "{{ template "anchore-engine.enterprise-ui.fullname" $ }}"
+            servicePort: {{ $.Values.anchoreGlobal.service.ports.uiHttp }}
+    {{- end }}
+  {{- end }}
+    {{- else }}
+    - http:
+        paths:
+        - path: {{ $.Values.anchoreApi.ingress.path }}
+          backend:
+            serviceName: "{{ template "anchore-engine.api.fullname" $ }}"
+            servicePort: {{ $.Values.anchoreGlobal.service.ports.extApi }}
+        {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }}
+        - path: {{ $.Values.anchoreEnterpriseUi.ingress.path }}
+          backend:
+            serviceName: "{{ template "anchore-engine.enterprise-ui.fullname" $ }}"
+            servicePort: {{ $.Values.anchoreGlobal.service.ports.uiHttp }}
+        {{- end }}
  {{- end }}
-{{- else }}
-  backend:
-    serviceName: {{ template "fullname" . }}
-    servicePort: {{ .Values.service.ports.api }}
-{{- end }}
 {{- end -}}
@@ -0,0 +1,116 @@
+{{- $component := "policy" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "anchore-engine.policy-engine.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: {{ $component }}
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" . }}"
+      component: {{ $component }}
+  replicas: {{ .Values.anchorePolicyEngine.replicaCount }}
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+{{- if .Values.anchorePolicyEngine.annotations }}
+      annotations:
+{{ toYaml .Values.anchorePolicyEngine.annotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: {{ .Values.anchoreGlobal.image.repository }}:{{ .Values.anchoreGlobal.image.tag }}
+        imagePullPolicy: {{ .Values.anchoreGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-manager"]
+        args: ["service", "start", "policy_engine"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - name: policy
+          containerPort: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        livenessProbe:
+          exec:
+            command:
+            - pgrep
+            - twistd
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: policy
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchorePolicyEngine.resources | indent 10 }}
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ template "anchore-engine.fullname" .}}
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          secret:
+            secretName: {{ .Values.anchoreGlobal.internalServicesSsl.certSecret }}
+        {{- end }}
+    {{- if .Values.anchorePolicyEngine.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchorePolicyEngine.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchorePolicyEngine.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchorePolicyEngine.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "anchore-engine.policy-engine.fullname" . }}
+  labels:
+    app: {{ template "anchore-engine.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    component: {{ $component }}
+spec:
+  type: {{ .Values.anchoreGlobal.service.type }}
+  ports:
+    - name: anchore-policy-api
+      port: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
+      targetPort: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
+      protocol: TCP
+  selector:
+    app: {{ template "anchore-engine.fullname" . }}
+    component: {{ $component }}
@@ -0,0 +1,66 @@
+{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled -}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "anchore-engine.enterprise.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: "enterprise-rbac"
+data:
+  config.yaml: |
+    # Anchore Enterprise Service Configuration File
+
+    # General system-wide configuration options, these should not need to
+    # be altered for basic operation
+    #
+    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
+    tmp_dir: {{ default "/scratch" .Values.anchoreAnalyzer.scratchVolume.mountPath }}
+    log_level: {{ .Values.anchoreGlobal.logLevel }}
+    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
+
+    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
+    host_id: "${ANCHORE_POD_NAME}"
+    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
+    auto_restart_services: False
+    license_file: "/license.yaml"
+
+    metrics:
+      enabled: {{ .Values.anchoreGlobal.enableMetrics }}
+
+    credentials:
+      database:
+        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}'
+        db_connect_args:
+          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
+          ssl: {{ .Values.anchoreGlobal.dbConfig.ssl }}
+        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
+        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
+
+    services:
+      # This should never be exposed outside of linked containers/localhost. It is used only for internal service access
+      rbac_authorizer:
+        enabled: True
+        require_auth: True
+        endpoint_hostname: localhost
+        listen: '127.0.0.1'
+        port: {{ .Values.anchoreGlobal.service.ports.rbacAuth }}
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+      rbac_manager:
+        enabled: True
+        require_auth: True
+        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
+        listen: '0.0.0.0'
+        port: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
+        authorization_handler: external
+        authorization_handler_config:
+          endpoint: 'http://localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}'
+        ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
+        ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
+        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
+{{- end -}}
@@ -1,16 +1,16 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ template "fullname" . }}
+  name: {{ template "anchore-engine.fullname" . }}
  labels:
-    app: {{ template "fullname" . }}
+    app: {{ template "anchore-engine.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
 type: Opaque
-data:
-  adminPassword:  {{ .Values.globalConfig.users.admin.password | b64enc | quote }}
-  dbUser: {{ .Values.postgresql.postgresUser | b64enc | quote }}
-  dbPassword: {{ .Values.postgresql.postgresPassword | b64enc | quote }}
-  anchoreIOUser: {{ .Values.globalConfig.users.admin.anchoreIOCredentials.user | b64enc | quote }}
-  anchoreIOPassword: {{ .Values.globalConfig.users.admin.anchoreIOCredentials.password | b64enc | quote }}
+stringData:
+  ANCHORE_ADMIN_PASSWORD: {{ .Values.anchoreGlobal.defaultAdminPassword | quote }}
+  ANCHORE_DB_PASSWORD: {{ index .Values "postgresql" "postgresPassword" | quote }}
+  {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
+  .feedsDbPassword: {{ index .Values "anchore-feeds-db" "postgresPassword" | quote }}
+  {{- end }}
@@ -1,36 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "fullname" . }}
-  labels:
-    app: {{ template "fullname" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-    component: core
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - name: anchore-external-api
-      port: {{ .Values.service.ports.api }}
-      targetPort: {{ .Values.service.ports.api }}
-      protocol: TCP
-    - name: anchore-kubewebhook
-      port: {{ .Values.service.ports.k8sImagePolicyWebhook }}
-      targetPort: {{ .Values.service.ports.k8sImagePolicyWebhook }}
-      protocol: TCP
-    - name: anchore-queue
-      port: {{ .Values.service.ports.queue }}
-      targetPort: {{ .Values.service.ports.queue }}
-      protocol: TCP
-    - name: anchore-catalog
-      port: {{ .Values.service.ports.catalog }}
-      targetPort: {{ .Values.service.ports.catalog }}
-      protocol: TCP
-    - name: anchore-policy
-      port: {{ .Values.service.ports.policy }}
-      targetPort: {{ .Values.service.ports.policy }}
-      protocol: TCP
-  selector:
-    app: {{ template "fullname" . }}
-    component: core
@@ -0,0 +1,115 @@
+{{- $component := "simplequeue" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ template "anchore-engine.simplequeue.fullname" . }}"
+  labels:
+    app: "{{ template "anchore-engine.fullname" . }}"
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: {{ $component }}
+spec:
+  selector:
+    matchLabels:
+      app: "{{ template "anchore-engine.fullname" . }}"
+      component: {{ $component }}
+  replicas: {{ .Values.anchoreSimpleQueue.replicaCount }}
+  template:
+    metadata:
+      labels:
+        app: "{{ template "anchore-engine.fullname" . }}"
+        component: {{ $component }}
+{{- if .Values.anchoreSimpleQueue.annotations }}
+      annotations:
+{{ toYaml .Values.anchoreSimpleQueue.annotations | indent 8 }}
+{{- end }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}-{{ $component }}
+        image: {{ .Values.anchoreGlobal.image.repository }}:{{ .Values.anchoreGlobal.image.tag }}
+        imagePullPolicy: {{ .Values.anchoreGlobal.image.pullPolicy }}
+        command: ["/usr/local/bin/anchore-manager"]
+        args: ["service", "start", "simplequeue"]
+        envFrom:
+        - secretRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        - configMapRef:
+            name: {{ template "anchore-engine.fullname" . }}
+        env:
+        - name: ANCHORE_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        ports:
+        - name: simplequeue
+          containerPort: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
+          readOnly: true
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: simplequeue
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: simplequeue
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 10
+          failureThreshold: 10
+        resources:
+{{ toYaml .Values.anchoreSimpleQueue.resources | indent 10 }}
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ template "anchore-engine.fullname" .}}
+        {{- if .Values.anchoreGlobal.internalServicesSslEnabled }}
+        - name: certs
+          secret:
+            secretName: {{ .Values.anchoreGlobal.internalServicesSsl.certSecret }}
+        {{- end }}
+    {{- if .Values.anchoreSimpleQueue.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.anchoreSimpleQueue.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreSimpleQueue.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.anchoreSimpleQueue.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "anchore-engine.simplequeue.fullname" . }}
+  labels:
+    app: {{ template "anchore-engine.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    component: {{ $component }}
+spec:
+  type: {{ .Values.anchoreGlobal.service.type }}
+  ports:
+    - name: anchore-simplequeue-api
+      port: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
+      targetPort: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
+      protocol: TCP
+  selector:
+    app: {{ template "anchore-engine.fullname" . }}
+    component: {{ $component }}
@@ -1,59 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: "{{ template "worker.fullname" . }}"
-  labels:
-    app: "{{ template "fullname" . }}"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-    component: worker
-data:
-  config.yaml: |
-    # Anchore Service Configuration File
-
-    service_dir: {{ .Values.globalConfig.configDir }}
-    tmp_dir: {{ default "/tmp" .Values.workerConfig.analyzerScratchDir }}
-
-    allow_awsecr_iam_auto: {{ .Values.globalConfig.allowECRUseIAMRole }}
-    cleanup_images: {{ .Values.globalConfig.cleanupImages }}
-
-    log_level: {{ .Values.workerConfig.logLevel }}
-    host_id: ${ANCHORE_POD_NAME}
-    internal_ssl_verify: {{ .Values.globalConfig.internalServicesSslVerifyCerts }}
-    metrics:
-      enabled: {{ .Values.globalConfig.enableMetrics }}
-    credentials:
-      users:
-         admin:
-           password: ${ANCHORE_ADMIN_PASSWORD}
-           email: 'admin@myemail.com'
-           external_service_auths:
-           #  anchoreio:
-           #    anchorecli:
-           #      auth: 'myanchoreiouser:myanchoreiopass'
-           #auto_policy_sync: true
-
-      database:
-        {{ if .Values.postgresql.enabled }}
-        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@{{ template "postgres.fullname" . }}:5432/{{ .Values.postgresql.postgresDatabase }}'
-        {{ else }}
-        db_connect: 'postgresql+pg8000://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@{{ .Values.postgresql.externalEndpoint}}/{{ .Values.postgresql.postgresDatabase }}'
-        {{ end }}
-        db_connect_args:
-          timeout: 120
-          ssl: {{ .Values.globalConfig.dbConfig.ssl }}
-        db_pool_size: {{ .Values.globalConfig.dbConfig.connectionPoolSize }}
-        db_pool_max_overflow: {{ .Values.globalConfig.dbConfig.connectionPoolSize }}
-    services:
-      analyzer:
-        enabled: true
-        endpoint_hostname: ${ANCHORE_POD_IP}
-        listen: '0.0.0.0'
-        port: {{ .Values.workerConfig.port }}
-        cycle_timer_seconds: {{ .Values.workerConfig.cycleTimerSeconds }}
-        max_threads: {{ .Values.workerConfig.concurrentTasksPerWorker }}
-        analyzer_driver: nodocker
-        ssl_cert: {{ .Values.workerConfig.ssl.certDir -}}/{{- .Values.workerConfig.ssl.certSecretCertName }}
-        ssl_key: {{ .Values.workerConfig.ssl.certDir -}}/{{ .Values.workerConfig.ssl.certSecretKeyName }}
-        ssl_enable: {{ .Values.globalConfig.internalServicesSslEnabled }}
@@ -1,113 +0,0 @@
-apiVersion: apps/v1beta1
-kind: Deployment
-metadata:
-  name: "{{ template "worker.fullname" . }}"
-  labels:
-    app: "{{ template "worker.fullname" . }}"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-    component: worker
-spec:
-  replicas: {{ .Values.workerConfig.replicaCount }}
-  template:
-    metadata:
-      labels:
-        app: "{{ template "worker.fullname" . }}"
-        component: worker
-{{- if .Values.workerConfig.annotations }}
-      annotations:
-{{ toYaml .Values.workerConfig.annotations | indent 8 }}
-{{- end }}
-    spec:
-      containers:
-      - name: {{ .Chart.Name }}-worker
-        image: {{ .Values.image.tag }}
-        env:
-        - name: ANCHORE_ENGINE_SERVICES
-          value: anchore-worker
-        - name: ANCHORE_DB
-          value: {{ .Values.postgresql.postgresDatabase }}
-        - name: ANCHORE_DB_HOST
-          value: {{ template "postgres.fullname" . }}
-        - name: ANCHORE_DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: dbUser
-        - name: ANCHORE_DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: dbPassword
-        - name: ANCHORE_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "fullname" . }}
-              key: adminPassword
-        - name: ANCHORE_POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: ANCHORE_POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ANCHORE_POD_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        ports:
-        - name: analyzer-api
-          containerPort: {{ .Values.workerConfig.port }}
-        volumeMounts:
-        - name: config-volume
-          mountPath: /config
-        {{- if .Values.globalConfig.internalServicesSslEnabled }}
-        - name: certs
-          mountPath: {{ default "/certs" .Values.workerConfig.ssl.CertDir }}
-          readOnly: true
-        {{- end }}
-        - name: analysis-scratch
-          mountPath: {{ .Values.workerConfig.analysisScratchVolume.mountPath }}
-        livenessProbe:
-          exec:
-            command:
-            - pgrep
-            - twistd
-          initialDelaySeconds: 10
-          periodSeconds: 60
-          failureThreshold: 5
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: analyzer-api
-          initialDelaySeconds: 5
-          periodSeconds: 10
-          timeoutSeconds: 10
-          failureThreshold: 10
-        resources:
-{{ toYaml .Values.workerConfig.resources | indent 10 }}
-      volumes:
-        - name: config-volume
-          configMap:
-            name: {{ template "worker.fullname" .}}
-        {{- if .Values.globalConfig.internalServicesSslEnabled }}
-        - name: certs
-          secret:
-            secretName: {{ .Values.workerConfig.ssl.certSecret }}
-        {{- end }}
-        - name: analysis-scratch
-          {{ toYaml .Values.workerConfig.analysisScratchVolume.details -}}
-    {{- if .Values.workerConfig.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.workerConfig.nodeSelector | indent 8 }}
-    {{- end }}
-    {{- with .Values.workerConfig.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-    {{- with .Values.workerConfig.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-    {{- end }}
@@ -1,55 +1,77 @@
 # Default values for anchore_engine chart.

-# The configuration for the API service, which must be reachable inside the cluster by other workers and users
-service:
-  type: ClusterIP
-  ports:
-    api: 8228
-    queue: 8083
-    catalog: 8082
-    policy: 8087
-    k8sImagePolicyWebhook: 8338
-
-image:
-  # Can use 'latest' but not recommended
-  tag: "docker.io/anchore/anchore-engine:v0.2.4"
-  # pullPolicy: IfNotPresent
-
-# Used to create Ingress record (should used with service.type: ClusterIP or NodePort depending on platform)
-ingress:
-  enabled: false
-  annotations: {}
-    # kubernetes.io/ingress.allow-http: False
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: true
-  path: /
-  # You can bound on specific hostnames
-  # hosts:
-  #   - chart-example.local
-  tls: []
-  # Secrets must be manually created in the namespace.
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
-
-# Dependency on Postgresql, configure here
+# Anchore engine has a dependency on Postgresql, configure here
 postgresql:
-  enabled: true
+  # To use an external DB, uncomment & set 'enabled: false'
+  # externalEndpoint, postgresUser, postgresPassword & postgresDatabase are required values for external postgres
+  # enabled: false
  postgresUser: anchoreengine
  postgresPassword: anchore-postgres,123
  postgresDatabase: anchore

-
-  # Use this config if you set enabled=False and want to specify an external (already existing) postres deployment for use.
-  # Set this to the host and port. eg. mypostgres.myserver.io:5432
+  # Specify an external (already existing) postgres deployment for use.
+  # Set to the host and port. eg. mypostgres.myserver.io:5432
  externalEndpoint: Null

+  # Configure size of the persitant volume used with helm managed chart.
+  # This is ignored if using an external endpoint.
+  persistence:
+    size: 8Gi
+
+# Global configuration shared by all anchore-engine services.
+anchoreGlobal:
+  # Image used for all anchore engine deployments (excluding enterprise components).
+  image:
+    # Can use 'latest' tag but not recommended
+    repository: docker.io/anchore/anchore-engine
+    tag: v0.3.0
+    pullPolicy: IfNotPresent
+
+  # K8s service configuration for all anchore engine APIs, must be reachable inside the cluster by all other services and users
+  service:
+    type: ClusterIP
+    ports:
+      analyzer: 8084
+      extApi: 8228
+      simplequeue: 8083
+      catalog: 8082
+      policyEngine: 8087
+      kubernetesWebhook: 8338
+      # For enterprise customers only
+      feedsApi: 8448
+      uiHttp: 80
+      rbacApi: 8229
+      rbacAuth: 8089
+
+  # Create an ingress resource for all external anchore engine services.
+  # Ingress paths/hosts can be setup for the anchoreApi & anchoreEnterpriseUi deployments in the corresponding values sections.
+  ingress:
+    enabled: false
+    annotations: {}
+      # kubernetes.io/ingress.allow-http: false
+      # kubernetes.io/ingress.class: nginx
+      # kubernetes.io/tls-acme: true
+    tls: []
+    # Secrets must be manually created in the namespace.
+    #  - secretName: chart-example-tls
+    #    hosts:
+    #      - chart-example.local

-# Global configuration shared by both core and worker
-globalConfig:
  # Set where default configs are placed at startup. This must be a writable location for the pod.
-  configDir: /anchore_service_config
+  serviceDir: /anchore_service_config
+  logLevel: INFO

+  # If true, if a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
+  allowECRUseIAMRole: false
+
+  # Enable prometheus metrics
+  enableMetrics: false
+
+  # Sets the password & email address for the default anchore-engine admin user.
+  defaultAdminPassword: foobar
+  defaultAdminEmail: example@email.com
+
+  # Configure the database connection within anchore-engine & enterprise-ui. This may get split into 2 different configurations based on service utilized.
  dbConfig:
    timeout: 120
    # Use ssl, but the default postgresql config in helm's stable repo does not support ssl on server side, so this should be set for external dbs only for the time being
@@ -57,102 +79,127 @@ globalConfig:
    connectionPoolSize: 30
    connectionPoolMaxOverflow: 100

-  # Cleanup local images used during analysis, defaults to True. If set to false, images will remain on workers after analysis.
-  cleanupImages: true
-
-  # If True, if a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
-  allowECRUseIAMRole: false
-
-  # User configuration. Add more users here if needed.
-  users:
-    admin:
-      password: foobar
-      email: admin@myemail.com
-      policyBundleSyncEnabled: false
-
-      # Credentials for https://anchore.io Cloud service if you have them. Can be used to automatically sync policy bundles.
-      anchoreIOCredentials:
-        # If use_anonymous = False, the specific credentials are used for the feed sync and bundle sync features otherwise disregarded.
-        useAnonymous: true
-        user: someuser
-        password: somepassword
-
+  # Enable to force all anchore-engine services to communicate internally using SSL
  internalServicesSslEnabled: false
-  internalServicesSslVerifyCerts: false
+  internalServicesSsl:
+    # specify whether cert is verfied against the local certifacte bundle (allow self-signed certs if set to false)
+    verifyCerts: false
+    certDir: "/certs"
+    certSecret: Null
+    certSecretKeyName: "tls.key"
+    certSecretCertName: "tls.crt"
+
+  # To enable webhooks, set webhooksEnabled: true
+  webhooksEnabled: false
+  # Configure webhook outputs here. The service provides these webhooks for notifying external systems of updates
+  webhooks:
+    # User and password to be set (using HTTP basic auth) on all webhook calls if necessary
+    webhook_user: Null
+    webhook_password: Null
+    ssl_verify: true
+
+    # Endpoint for general notification delivery. These events are image/tag updates etc. This is globally configured
+    # and updates for all users are sent to the same host but with a different path for each user.
+    # <notification_type>/<userId> are required as documented at end of URI - only hostname:port should be configured.
+    general: {}
+      # url: "http://somehost:9090/<notification_type>/<userId>"
+
+# Configuration for the analyzer pods that perform image analysis
+# There may be many of these analyzers but best practice is to not have more than one per node since analysis
+# is very IO intensive. Use of affinity/anti-affinity rules for scheduling the analyzers is future work.
+anchoreAnalyzer:
+  replicaCount: 1
+
+  # The cycle timer is the interval between checks to the work queue for new jobs
+  cycleTimers:
+    image_analyzer: 5
+
+  # Controls the concurrency of the analyzer itself. Can be configured to process more than one task at a time, but it IO bound, so may not
+  # necessarily be faster depending on hardware. Should test and balance this value vs. number of analyzers for your deployment cluster performance.
+  concurrentTasksPerWorker: 1
+
+  # The analysisVolume controls the mounting of an external volume for scratch space for image analysis. Generally speaking
+  # you need to provision 3x the size of the largest image (uncompressed) that you want to analyze for this space.
+  scratchVolume:
+    mountPath: /scratch
+    details:
+      # Specify volume configuration here
+      emptyDir: {}
+
+  # resources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 8Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 3Gi
+
+  annotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+
+# Pod configuration for the anchore engine api service.
+anchoreApi:
+  replicaCount: 1
+
+  # Used to create Ingress record for the anchore engine external API (api service)
+  # (should used with service.type: ClusterIP or NodePort depending on platform)
+  ingress:
+    path: /v1/*
+    # You can bound on specific hostnames
+    # hosts:
+    #   - anchore-api.local
+
+  # resources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 6Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 4Gi
+
+  annotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+anchoreCatalog:
+  replicaCount: 1

  # Intervals to run specific events on (seconds)
  cycleTimers:
    # Interval to check for an update to a tag
    image_watcher: 3600
-    # Interval to re-run a policy eval on a tag
+    # Interval to run a policy evaluation on images with the policy_eval subscription activated.
    policy_eval: 3600
-    # Interval to run a feed sync to get latest cve data
-    feed_sync: 14400
-    # Interval workers check the queue
+    # Interval to run a vulnerability scan on images with the vuln_update subscription activated.
+    vulnerability_scan: 14400
+    # Interval at which the catalog looks for new work to put on the image analysis queue.
    analyzer_queue: 1
    # Interval notifications will be processed for state changes
    notifications: 30
-    # Intervals service state updates are polled
+    # Intervals service state updates are polled for the system status
    service_watcher: 15
-    # Interval for policy bundle sync from anchore.io if enabled
-    policy_bundle_sync: 300
+    # Interval between checks to repo for new tags
+    repo_watcher: 60

-  # Enable prometheus metrics
-  enableMetrics: false
-
-# Configuration for the core engine service that serves the API
-# The core service handles the user facing APIs and coordination of workers as well as storage interfaces for data
-coreConfig:
-  replicaCount: 1
-  logLevel: INFO
-
-  # Policy bundle sync enables the engine to download a policy bundle from anchore.io if you have an account there with a custom bundle. Requires providing your login credentials in the globalConfig.users.anchoreIOCredentials section
-  policyBundleSyncEnabled: false
-
-  ssl:
-    # To use certs for TLS directly from the services, create a secret with keys that match the values fo certSecretKey and certSecretCert
-    certSecret: null
-    certSecretKeyName: "tls.key"
-    certSecretCertName: "tls.crt"
-    certDir: "/certs"
-
-
-  # Configure webhook outputs here. The service provides these webhooks for notifying external systems of updates
-  webhooks:
-    enabled: True
-    config:
-      # User and password to be set (using HTTP basic auth) on all webhook calls if necessary
-      user: null
-      password: null
-      ssl_verify: true
-
-      # Endpoint for general notification delivery. These events are image/tag updates etc. This is globally configured
-      # and updates for all users are sent to the same host but with a different path for each user.
-      general: {}
-        # url: "http://somehost:9090/<notification_type>/<userId>"
-      # Endpoint and credentials for policy evaluation delivery
-      policy_eval: {}
-        # url: "http://somehost:9090/policy_eval/<userId>"
-        # user: null
-        # password: null
-      # Endpoint for fatal system errors to be delivery
-      error_event: {}
-        # url: 'http://somehost:9090/error_event/'
-  # Event log configuration
+  # Event log configuration for webhooks
  events:
    notification:
      enabled: true
      # Send notifications for events with severity level that matches items in this list
      level:
        - error
-#        - info
+        # - info
+
  archive:
    compression:
      enabled: true
      min_size_kbytes: 100
    storage_driver:
-      # Valid storage driver names: 'db', 'localfs', 's3', 'swift'
-      # It is strongly recommended to only use localfs for local testing using persisent volumes or a shared FS and generally not in a k8s deployment.
+      # Valid storage driver names: 'db', 's3', 'swift'
      name: db
      config: {}

@@ -164,7 +211,7 @@ coreConfig:
      #   # A prefix for keys in the bucket if desired (optional)
      #   prefix: "internaltest"
      #   # Create the bucket if it doesn't already exist
-      #   create_bucket: False
+      #   create_bucket: false
          # Url only needed for non-AWS S3 implementations (e.g. minio). Otherwise, configure the region instead
      #   #url: "https://s3.amazonaws.com"
      #   # AWS region to connect to if 'url' not specified, if both are set, then 'url' has precedent
@@ -172,7 +219,7 @@ coreConfig:
      #   # For Auth can provide access/secret keys or use 'iamauto' which will use an instance profile or any credentials found in normal aws search paths/metadata service
      #   access_key: XXXX
      #   secret_key: YYYY
-      #   iamauto: False
+      #   iamauto: false

      # Example Minio configuration (basically same as s3 example):
      # name: s3
@@ -181,7 +228,7 @@ coreConfig:
      #   bucket: mybucket
      #   access_key: xxxxxx
      #   secret_key: yyyyyy
-      #   create_bucket: True
+      #   create_bucket: true

      # Example Swift Configuration:
      # name: swift
@@ -193,56 +240,47 @@ coreConfig:
      #     # The swift container where data will be stored
      #     container: "local_test_anchore"
      #     # Create the container if it is not already present
-      #     create_container: False
+      #     create_container: false

  # resources:
  #  limits:
  #    cpu: 100m
-  #    memory: 6Gi
+  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
-  #    memory: 4Gi
+  #    memory: 3Gi

-  ## Node labels for pod assignment
-  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
-  ##
  annotations: {}
-
  nodeSelector: {}
-
  tolerations: []
-
  affinity: {}

-# Configuration for the worker pods that perform image analysis
-# There may be many of these workers but best practice is to not have more than one per node since analysis
-# is very IO intensive. Use of affinity/anti-affinity rules for scheduling the workers is future work.
-workerConfig:
+# Pod configuration for the anchore engine policy service.
+anchorePolicyEngine:
  replicaCount: 1
-  logLevel: INFO

-  # The cycle timer is the interval between checks to the work queue for new jobs
-  cycleTimerSeconds: 1
+  cycleTimers:
+    # Interval to run a feed sync to get latest cve data
+    feed_sync: 14400
+    # Interval between checks to see if there needs to be a task queued
+    feed_sync_checker: 3600

-  # Controls the concurrency of the worker itself. Can be configured to process more than one task at a time, but it IO bound, so may not
-  # necessarily be faster depending on hardware. Should test and balance this value vs. number of workers for your deployment cluster performance.
-  concurrentTasksPerWorker: 1
+  # resources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 8Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 3Gi

-  # The analysisVolume controls the mounting of an external volume for scratch space for image analysis. Generally speaking
-  # you need to provision 3x the size of the largest image (uncompressed) that you want to analyze for this space.
-  analysisScratchVolume:
-    mountPath: /tmp
-    details:
-      emptyDir: {}
+  annotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}

-  port: 8084
-
-  # Configuration for ssl used for internal node communications between components
-  ssl:
-    certDir: "/certs"
-    certSecret: null
-    certSecretKeyName: "tls.key"
-    certSecretCertName: "tls.crt"
+# Pod configuration for the anchore engine simplequeue service.
+anchoreSimpleQueue:
+  replicaCount: 1

  # resources:
  #  limits:
@@ -252,13 +290,154 @@ workerConfig:
  #    cpu: 100m
  #    memory: 2Gi

-  ## Node labels for pod assignment
-  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
-  ##
  annotations: {}
-
  nodeSelector: {}
-
  tolerations: []
-
  affinity: {}
+
+# This section is used for configuring anchore enterprise.
+anchoreEnterpriseGlobal:
+  enabled: false
+  # Name of kubernetes secret containing your license.yaml file.
+  # Create this secret with the following command - kubectl create secret generic anchore-license --from-file=license.yaml=<PATH TO LICENSE.YAML>
+  licenseSecretName: anchore-enterprise-license
+  # Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images.
+  # Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username=<USERNAME> --docker-password=<PASSWORD> --docker-email=<EMAIL_ADDRESS>
+  imagePullSecretName: anchore-enterprise-pullcreds
+
+  image:
+    repository: docker.io/anchore/enterprise
+    tag: v0.3.0
+    pullPolicy: IfNotPresent
+
+# Configure the second postgres database instance for the enterprise feeds service.
+# Only utilized if anchoreEnterpriseFeeds.enabled: true
+anchore-feeds-db:
+  # To use an external DB, uncomment & set 'enabled: false'
+  # externalEndpoint, postgresUser, postgresPassword & postgresDatabase are required values for external postgres
+  # enabled: false
+  postgresUser: anchoreengine
+  postgresPassword: anchore-postgres,123
+  postgresDatabase: anchore-feeds
+
+  # Specify an external (already existing) postgres deployment for use.
+  # Set to the host and port. eg. mypostgres.myserver.io:5432
+  externalEndpoint: Null
+
+  # Configure size of the persitant volume used with helm managed chart.
+  # This is ignored if using an external endpoint.
+  persistence:
+    size: 8Gi
+
+# Configure & enable the Anchore Enterprise on-prem feeds service.
+anchoreEnterpriseFeeds:
+  # If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance.
+  enabled: true
+
+  # Time delay in seconds between consecutive driver runs for processing data
+  cycleTimers:
+    driver_sync: 7200
+
+  # Configure the database connection within anchore-engine & enterprise-ui. This may get split into 2 different configurations based on service utilized.
+  dbConfig:
+    timeout: 120
+    # Use ssl, but the default postgresql config in helm's stable repo does not support ssl on server side, so this should be set for external dbs only for the time being
+    ssl: false
+    connectionPoolSize: 30
+    connectionPoolMaxOverflow: 100
+
+  # Staging space for holding normalized output from drivers.
+  scratchVolume:
+    mountPath: /scratch
+    details:
+      # Specify volume configuration here
+      emptyDir: {}
+
+  # resources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 8Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 3Gi
+
+  annotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+# Configure the Anchore Enterprise role based access control component.
+# This component consists of 2 containers that run as side-cars in the anchore engine api pod.
+anchoreEnterpriseRbac:
+  enabled: true
+  # authResources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 8Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 3Gi
+
+  # managerResources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 8Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 3Gi
+
+# Configure the Anchore Enterprise UI.
+anchoreEnterpriseUi:
+  # If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance.
+  enabled: true
+  # Specifies whether to trust a reverse proxy when setting secure cookies (via the `X-Forwarded-Proto` header).
+  enableProxy: false
+  # Specifies if SSL is enabled in the web app container.
+  enableSsl: false
+  # Specifies if a single set of user credentials can be used to start multiple Anchore Enterprise UI sessions; for
+  # example, by multiple users across different systems, or by a single user on a single system across multiple browsers.
+  #
+  # When set to `false`, only one session per credential is permitted at a time, and logging in will invalidate any other
+  # sessions that are using the same set of credentials. Note that setting this property to `false` does not prevent a
+  # single session from being viewed within multiple *tabs* inside the same browser.
+  enableSharedLogin: true
+
+  image:
+    repository: docker.io/anchore/enterprise-ui
+    tag: v0.3.0
+    pullPolicy: IfNotPresent
+
+  ingress:
+    path: /*
+    # You can bound on specific hostnames
+    # hosts:
+    #   - anchore-ui.local
+
+  # resources:
+  #  limits:
+  #    cpu: 100m
+  #    memory: 8Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 3Gi
+
+  annotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+# Anchore Engine Enterprise UI is dependent on redis for storing sessions
+# Only utilized if 'anchoreEnterpriseUi.enabled: true'
+anchore-ui-redis:
+  password: anchore-redis,123
+  cluster:
+    enabled: false
+  persistence:
+    enabled: false
+
+  # To use an external redis endpoint, uncomment to set 'enabled: false'
+  # enabled: false
+
+  # If 'enabled: false', specify an external redis endpoint -
+  # eg redis://:<password>@hostname:6379
+  externalEndpoint: Null