github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/anchore-engine] update to anchore-engine v0.6.1 (#20459)

Browse Source 
* update readme with helm3 installation instructions

Signed-off-by: Brady Todhunter <bradyt@anchore.com>

* bug fix

Signed-off-by: Brady Todhunter <bradyt@anchore.com>

* update anchore-engine to v0.6.1 & bump chart version

Signed-off-by: Brady Todhunter <bradyt@anchore.com>

* update ingress to include feeds api

Signed-off-by: Brady Todhunter <bradyt@anchore.com>

* mount an emptydir volume to anchore temp directory on policy engine for feeds sync

Signed-off-by: Brady Todhunter <bradyt@anchore.com>
This commit is contained in:
Brady Todhunter
2020-01-30 20:36:19 -08:00
committed by GitHub
parent 9a20026370
commit c561ea4e39
7 changed files with 63 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/anchore-engine/Chart.yaml
+2 -2
View File
@@ -1,7 +1,7 @@
apiVersion: v1
name: anchore-engine
version: 1.4.1
appVersion: 0.6.0
version: 1.4.2
appVersion: 0.6.1
description: Anchore container analysis and policy evaluation engine service
keywords:
- analysis
stable/anchore-engine/README.md
+24 -7
View File
@@ -1,8 +1,8 @@
# Anchore Engine Helm Chart
This chart deploys the Anchore Engine docker container image analysis system. Anchore Engine requires a PostgreSQL database (>=9.6) which may be handled by the chart or supplied externally, and executes in a service based architecture utilizing the following Anchore Engine services: External API, Simplequeue, Catalog, Policy Engine, and Analyzer.
This chart deploys the Anchore Engine docker container image analysis system. Anchore Engine requires a PostgreSQL database (>=9.6) which may be handled by the chart or supplied externally, and executes in a service based architecture utilizing the following Anchore Engine services: External API, SimpleQueue, Catalog, Policy Engine, and Analyzer.
This chart can also be used to install the following Anchore Enterprise services: GUI, RBAC, Reporting, & On-premises Feeds. Enterprise services require a valid Anchore Enterprise License as well as credentials with access to the private Dockerhub repository hosting the images. These are not enabled by default.
This chart can also be used to install the following Anchore Enterprise services: GUI, RBAC, Reporting, Notifications & On-premises Feeds. Enterprise services require a valid Anchore Enterprise License as well as credentials with access to the private DockerHub repository hosting the images. These are not enabled by default.
Each of these services can be scaled and configured independently.
@@ -23,12 +23,18 @@ TL;DR - `helm install stable/anchore-engine`
Anchore Engine will take approximately 3 minutes to bootstrap. After the initial bootstrap period, Anchore Engine will begin a vulnerability feed sync. During this time, image analysis will show zero vulnerabilities until the sync is completed. This sync can take multiple hours depending on which feeds are enabled. The following anchore-cli command is available to poll the system and report back when the engine is bootstrapped and the vulnerability feeds are all synced up. `anchore-cli system wait`
The recommended way to install the Anchore Engine Helm Chart is with a customized values file and a custom release name. It is highly recommended to set non-default passwords when deploying, all passwords are set to defaults specified in the chart. It is also recommended to utilize an external database, rather than using the included postgresql chart.
The recommended way to install the Anchore Engine Helm Chart is with a customized values file and a custom release name. It is highly recommended to set non-default passwords when deploying, all passwords are set to defaults specified in the chart. It is also recommended to utilize an external database, rather then using the included postgresql chart.
Create a new file named `anchore_values.yaml` and add all desired custom values (examples below); then run the following command:
#### Helm v2 installation
`helm install --name <release_name> -f anchore_values.yaml stable/anchore-engine`
#### Helm v3 installation
`helm repo add stable https://kubernetes-charts.storage.googleapis.com`
`helm install <release_name> -f anchore_values.yaml stable/anchore-engine`
##### Example anchore_values.yaml - using chart managed PostgreSQL service with custom passwords.
*Note: Installs with chart managed PostgreSQL database. This is not a guaranteed production ready config.*
```
@@ -66,17 +72,28 @@ To use this Helm chart with the enterprise services enabled, perform these steps
`kubectl create secret generic anchore-enterprise-license --from-file=license.yaml=<PATH/TO/LICENSE.YAML>`
1. Create a kubernetes secret containing dockerhub credentials with access to the private anchore enterprise repositories.
1. Create a kubernetes secret containing DockerHub credentials with access to the private anchore enterprise repositories.
`kubectl create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username=<DOCKERHUB_USER> --docker-password=<DOCKERHUB_PASSWORD> --docker-email=<EMAIL_ADDRESS>`
1. (demo) Install the Helm chart using default values
#### Helm v2 installation
`helm install --name <release_name> --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine`
`helm fetch stable/anchore-engine --untar && helm install --name enterprise stable/anchore-engine -f anchore-engine/enterprise_values.yaml`
#### Helm v3 installation
`helm repo add stable https://kubernetes-charts.storage.googleapis.com`
1. (production) Install the Helm chart using a custom anchore_values.yaml file - *see examples below*
`helm install <release_name> --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine`
`helm install --name <release_name> -f /path/to/anchore_values.yaml stable/anchore-engine`
2. (production) Install the Helm chart using a custom anchore_values.yaml file - *see examples below*
#### Helm v2 installation
`helm install --name <release_name> -f anchore_values.yaml stable/anchore-engine`
#### Helm v3 installation
`helm repo add stable https://kubernetes-charts.storage.googleapis.com`
`helm install <release_name> -f anchore_values.yaml stable/anchore-engine`
#### Example anchore_values.yaml - installing Anchore Enterprise
stable/anchore-engine/templates/analyzer_deployment.yaml
+2 -2
View File
@@ -131,6 +131,8 @@ spec:
- name: config-volume
configMap:
name: {{ template "anchore-engine.fullname" .}}
- name: {{ $component }}-scratch
{{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }}
{{- if .Values.anchoreGlobal.openShiftDeployment }}
- name: service-config-volume
emptyDir: {}
@@ -147,8 +149,6 @@ spec:
secret:
secretName: {{ . }}
{{- end }}
- name: {{ $component }}-scratch
{{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }}
{{- if .Values.cloudsql.useExistingServiceAcc }}
- name: {{ .Values.cloudsql.serviceAccSecretName }}
secret:
stable/anchore-engine/templates/enterprise_feeds_deployment.yaml
+1 -1
View File
@@ -164,7 +164,7 @@ spec:
{{- end }}
{{- with .Values.anchoreEnterpriseFeeds.nodeSelector }}
nodeSelector:
{{ toYaml .Values.anchoreEnterpriseFeeds.nodeSelector | nindent 8 }}
{{ toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.anchoreEnterpriseFeeds.affinity }}
affinity:
stable/anchore-engine/templates/ingress.yaml
+20 -5
View File
@@ -30,7 +30,7 @@ spec:
{{- end }}
{{- end }}
rules:
{{- if .Values.ingress.apiHosts }}
{{- if or .Values.ingress.apiHosts .Values.ingress.uiHosts .Values.ingress.feedsHosts }}
{{- range .Values.ingress.apiHosts }}
- host: {{ . | quote }}
http:
@@ -40,7 +40,6 @@ spec:
serviceName: {{ template "anchore-engine.api.fullname" $ }}
servicePort: {{ $.Values.anchoreApi.service.port }}
{{- end }}
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.ingress.uiHosts }}
{{- range .Values.ingress.uiHosts }}
- host: {{ . | quote }}
http:
@@ -50,19 +49,35 @@ spec:
serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }}
servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
{{- end }}
{{- range .Values.ingress.feedsHosts }}
- host: {{ . | quote }}
http:
paths:
- path: {{ $.Values.ingress.feedsPath }}
backend:
serviceName: {{ template "anchore-engine.enterprise-feeds.fullname" $ }}
servicePort: {{ $.Values.anchoreEnterpriseFeeds.service.port }}
{{- end }}
{{- else }}
- http:
paths:
- path: {{ $.Values.ingress.apiPath }}
{{- with .Values.ingress.apiPath }}
- path: {{ . }}
backend:
serviceName: {{ template "anchore-engine.api.fullname" $ }}
servicePort: {{ $.Values.anchoreApi.service.port }}
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }}
- path: {{ $.Values.ingress.uiPath }}
{{- end }}
{{- with .Values.ingress.uiPath }}
- path: {{ . }}
backend:
serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }}
servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
{{- end }}
{{- with .Values.ingress.feedsPath }}
- path: {{ . }}
backend:
serviceName: {{ template "anchore-engine.enterprise-feeds.fullname" $ }}
servicePort: {{ $.Values.anchoreEnterpriseFeeds.service.port }}
{{- end }}
{{- end }}
{{- end -}}
stable/anchore-engine/templates/policy_engine_deployment.yaml
+4
View File
@@ -84,6 +84,8 @@ spec:
- name: config-volume
mountPath: /config/config.yaml
subPath: config.yaml
- name: {{ $component }}-scratch
mountPath: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
{{- if .Values.anchoreGlobal.openShiftDeployment }}
- name: service-config-volume
mountPath: /anchore_service_config
@@ -126,6 +128,8 @@ spec:
- name: config-volume
configMap:
name: {{ template "anchore-engine.fullname" . }}
- name: {{ $component }}-scratch
{{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }}
{{- if .Values.anchoreGlobal.openShiftDeployment }}
- name: service-config-volume
emptyDir: {}
stable/anchore-engine/values.yaml
+10 -3
View File
@@ -59,15 +59,22 @@ ingress:
enabled: false
labels: {}
# Use the following paths for GCE/ALB ingress controller
# feedsPath: /v1/feeds/*
# apiPath: /v1/*
# uiPath: /*
# Exposing the feeds API w/ ingress is for special cases only, uncomment feedsPath if external access to the feeds API is needed
# feedsPath: /v1/feeds/
apiPath: /v1/
uiPath: /
# uncomment `feedsPath` to add an ingress endpoint for the feeds api
# Uncomment the following lines to bind on specific hostnames
# apiHosts:
# - anchore-api.example.com
# uiHosts:
# - anchore-ui.example.com
# feedsHosts:
# - anchore-feeds.example.com
annotations:
# kubernetes.io/ingress.class: gce
kubernetes.io/ingress.class: nginx
@@ -83,7 +90,7 @@ ingress:
# Global configuration shared by all anchore-engine services.
anchoreGlobal:
# Image used for all anchore engine deployments (excluding enterprise components).
image: docker.io/anchore/anchore-engine:v0.6.0
image: docker.io/anchore/anchore-engine:v0.6.1
imagePullPolicy: IfNotPresent
# Set this value to True to setup the chart for OpenShift deployment compatibility.
@@ -474,7 +481,7 @@ anchoreEnterpriseGlobal:
# Create this secret with the following command - kubectl create secret generic anchore-license --from-file=license.yaml=<PATH TO LICENSE.YAML>
licenseSecretName: anchore-enterprise-license
image: docker.io/anchore/enterprise:v0.6.0
image: docker.io/anchore/enterprise:v0.6.1
imagePullPolicy: IfNotPresent
# Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images.
# Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username=<USERNAME> --docker-password=<PASSWORD> --docker-email=<EMAIL_ADDRESS>
@@ -672,7 +679,7 @@ anchoreEnterpriseNotifications:
anchoreEnterpriseUi:
# If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance.
enabled: true
image: docker.io/anchore/enterprise-ui:v0.6.0
image: docker.io/anchore/enterprise-ui:v0.6.1
imagePullPolicy: IfNotPresent
# Set extra environment variables. These will be set on all UI containers.