From c561ea4e394dd1e15f77773e7dc4831254bb3889 Mon Sep 17 00:00:00 2001 From: Brady Todhunter Date: Thu, 30 Jan 2020 20:36:19 -0800 Subject: [PATCH] [stable/anchore-engine] update to anchore-engine v0.6.1 (#20459) * update readme with helm3 installation instructions Signed-off-by: Brady Todhunter * bug fix Signed-off-by: Brady Todhunter * update anchore-engine to v0.6.1 & bump chart version Signed-off-by: Brady Todhunter * update ingress to include feeds api Signed-off-by: Brady Todhunter * mount an emptydir volume to anchore temp directory on policy engine for feeds sync Signed-off-by: Brady Todhunter --- stable/anchore-engine/Chart.yaml | 4 +-- stable/anchore-engine/README.md | 31 ++++++++++++++----- .../templates/analyzer_deployment.yaml | 4 +-- .../enterprise_feeds_deployment.yaml | 2 +- stable/anchore-engine/templates/ingress.yaml | 25 ++++++++++++--- .../templates/policy_engine_deployment.yaml | 4 +++ stable/anchore-engine/values.yaml | 13 ++++++-- 7 files changed, 63 insertions(+), 20 deletions(-) diff --git a/stable/anchore-engine/Chart.yaml b/stable/anchore-engine/Chart.yaml index 4be7f4ecb9..8a9925fd24 100644 --- a/stable/anchore-engine/Chart.yaml +++ b/stable/anchore-engine/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: anchore-engine -version: 1.4.1 -appVersion: 0.6.0 +version: 1.4.2 +appVersion: 0.6.1 description: Anchore container analysis and policy evaluation engine service keywords: - analysis diff --git a/stable/anchore-engine/README.md b/stable/anchore-engine/README.md index 45a3c5a0ec..30fdf447ea 100644 --- a/stable/anchore-engine/README.md +++ b/stable/anchore-engine/README.md @@ -1,8 +1,8 @@ # Anchore Engine Helm Chart -This chart deploys the Anchore Engine docker container image analysis system. Anchore Engine requires a PostgreSQL database (>=9.6) which may be handled by the chart or supplied externally, and executes in a service based architecture utilizing the following Anchore Engine services: External API, Simplequeue, Catalog, Policy Engine, and Analyzer. +This chart deploys the Anchore Engine docker container image analysis system. Anchore Engine requires a PostgreSQL database (>=9.6) which may be handled by the chart or supplied externally, and executes in a service based architecture utilizing the following Anchore Engine services: External API, SimpleQueue, Catalog, Policy Engine, and Analyzer. -This chart can also be used to install the following Anchore Enterprise services: GUI, RBAC, Reporting, & On-premises Feeds. Enterprise services require a valid Anchore Enterprise License as well as credentials with access to the private Dockerhub repository hosting the images. These are not enabled by default. +This chart can also be used to install the following Anchore Enterprise services: GUI, RBAC, Reporting, Notifications & On-premises Feeds. Enterprise services require a valid Anchore Enterprise License as well as credentials with access to the private DockerHub repository hosting the images. These are not enabled by default. Each of these services can be scaled and configured independently. @@ -23,12 +23,18 @@ TL;DR - `helm install stable/anchore-engine` Anchore Engine will take approximately 3 minutes to bootstrap. After the initial bootstrap period, Anchore Engine will begin a vulnerability feed sync. During this time, image analysis will show zero vulnerabilities until the sync is completed. This sync can take multiple hours depending on which feeds are enabled. The following anchore-cli command is available to poll the system and report back when the engine is bootstrapped and the vulnerability feeds are all synced up. `anchore-cli system wait` -The recommended way to install the Anchore Engine Helm Chart is with a customized values file and a custom release name. It is highly recommended to set non-default passwords when deploying, all passwords are set to defaults specified in the chart. It is also recommended to utilize an external database, rather than using the included postgresql chart. +The recommended way to install the Anchore Engine Helm Chart is with a customized values file and a custom release name. It is highly recommended to set non-default passwords when deploying, all passwords are set to defaults specified in the chart. It is also recommended to utilize an external database, rather then using the included postgresql chart. Create a new file named `anchore_values.yaml` and add all desired custom values (examples below); then run the following command: + #### Helm v2 installation `helm install --name -f anchore_values.yaml stable/anchore-engine` + #### Helm v3 installation + `helm repo add stable https://kubernetes-charts.storage.googleapis.com` + + `helm install -f anchore_values.yaml stable/anchore-engine` + ##### Example anchore_values.yaml - using chart managed PostgreSQL service with custom passwords. *Note: Installs with chart managed PostgreSQL database. This is not a guaranteed production ready config.* ``` @@ -66,17 +72,28 @@ To use this Helm chart with the enterprise services enabled, perform these steps `kubectl create secret generic anchore-enterprise-license --from-file=license.yaml=` -1. Create a kubernetes secret containing dockerhub credentials with access to the private anchore enterprise repositories. +1. Create a kubernetes secret containing DockerHub credentials with access to the private anchore enterprise repositories. `kubectl create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username= --docker-password= --docker-email=` 1. (demo) Install the Helm chart using default values + #### Helm v2 installation + `helm install --name --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine` - `helm fetch stable/anchore-engine --untar && helm install --name enterprise stable/anchore-engine -f anchore-engine/enterprise_values.yaml` + #### Helm v3 installation + `helm repo add stable https://kubernetes-charts.storage.googleapis.com` -1. (production) Install the Helm chart using a custom anchore_values.yaml file - *see examples below* + `helm install --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine` - `helm install --name -f /path/to/anchore_values.yaml stable/anchore-engine` +2. (production) Install the Helm chart using a custom anchore_values.yaml file - *see examples below* + + #### Helm v2 installation + `helm install --name -f anchore_values.yaml stable/anchore-engine` + + #### Helm v3 installation + `helm repo add stable https://kubernetes-charts.storage.googleapis.com` + + `helm install -f anchore_values.yaml stable/anchore-engine` #### Example anchore_values.yaml - installing Anchore Enterprise diff --git a/stable/anchore-engine/templates/analyzer_deployment.yaml b/stable/anchore-engine/templates/analyzer_deployment.yaml index ff8b43c7f7..e42b55c4f0 100644 --- a/stable/anchore-engine/templates/analyzer_deployment.yaml +++ b/stable/anchore-engine/templates/analyzer_deployment.yaml @@ -131,6 +131,8 @@ spec: - name: config-volume configMap: name: {{ template "anchore-engine.fullname" .}} + - name: {{ $component }}-scratch + {{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }} {{- if .Values.anchoreGlobal.openShiftDeployment }} - name: service-config-volume emptyDir: {} @@ -147,8 +149,6 @@ spec: secret: secretName: {{ . }} {{- end }} - - name: {{ $component }}-scratch - {{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }} {{- if .Values.cloudsql.useExistingServiceAcc }} - name: {{ .Values.cloudsql.serviceAccSecretName }} secret: diff --git a/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml b/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml index 57152c2dd9..d5e0b882ad 100644 --- a/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml +++ b/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml @@ -164,7 +164,7 @@ spec: {{- end }} {{- with .Values.anchoreEnterpriseFeeds.nodeSelector }} nodeSelector: - {{ toYaml .Values.anchoreEnterpriseFeeds.nodeSelector | nindent 8 }} + {{ toYaml . | nindent 8 }} {{- end }} {{- with .Values.anchoreEnterpriseFeeds.affinity }} affinity: diff --git a/stable/anchore-engine/templates/ingress.yaml b/stable/anchore-engine/templates/ingress.yaml index 1eb18416cc..b0ad48f355 100644 --- a/stable/anchore-engine/templates/ingress.yaml +++ b/stable/anchore-engine/templates/ingress.yaml @@ -30,7 +30,7 @@ spec: {{- end }} {{- end }} rules: - {{- if .Values.ingress.apiHosts }} + {{- if or .Values.ingress.apiHosts .Values.ingress.uiHosts .Values.ingress.feedsHosts }} {{- range .Values.ingress.apiHosts }} - host: {{ . | quote }} http: @@ -40,7 +40,6 @@ spec: serviceName: {{ template "anchore-engine.api.fullname" $ }} servicePort: {{ $.Values.anchoreApi.service.port }} {{- end }} - {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.ingress.uiHosts }} {{- range .Values.ingress.uiHosts }} - host: {{ . | quote }} http: @@ -50,19 +49,35 @@ spec: serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }} servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }} {{- end }} + {{- range .Values.ingress.feedsHosts }} + - host: {{ . | quote }} + http: + paths: + - path: {{ $.Values.ingress.feedsPath }} + backend: + serviceName: {{ template "anchore-engine.enterprise-feeds.fullname" $ }} + servicePort: {{ $.Values.anchoreEnterpriseFeeds.service.port }} {{- end }} {{- else }} - http: paths: - - path: {{ $.Values.ingress.apiPath }} + {{- with .Values.ingress.apiPath }} + - path: {{ . }} backend: serviceName: {{ template "anchore-engine.api.fullname" $ }} servicePort: {{ $.Values.anchoreApi.service.port }} - {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} - - path: {{ $.Values.ingress.uiPath }} + {{- end }} + {{- with .Values.ingress.uiPath }} + - path: {{ . }} backend: serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }} servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }} {{- end }} + {{- with .Values.ingress.feedsPath }} + - path: {{ . }} + backend: + serviceName: {{ template "anchore-engine.enterprise-feeds.fullname" $ }} + servicePort: {{ $.Values.anchoreEnterpriseFeeds.service.port }} + {{- end }} {{- end }} {{- end -}} diff --git a/stable/anchore-engine/templates/policy_engine_deployment.yaml b/stable/anchore-engine/templates/policy_engine_deployment.yaml index bacb75ca39..877caeabdf 100644 --- a/stable/anchore-engine/templates/policy_engine_deployment.yaml +++ b/stable/anchore-engine/templates/policy_engine_deployment.yaml @@ -84,6 +84,8 @@ spec: - name: config-volume mountPath: /config/config.yaml subPath: config.yaml + - name: {{ $component }}-scratch + mountPath: {{ .Values.anchoreGlobal.scratchVolume.mountPath }} {{- if .Values.anchoreGlobal.openShiftDeployment }} - name: service-config-volume mountPath: /anchore_service_config @@ -126,6 +128,8 @@ spec: - name: config-volume configMap: name: {{ template "anchore-engine.fullname" . }} + - name: {{ $component }}-scratch + {{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }} {{- if .Values.anchoreGlobal.openShiftDeployment }} - name: service-config-volume emptyDir: {} diff --git a/stable/anchore-engine/values.yaml b/stable/anchore-engine/values.yaml index 35d64494ff..7c03da697a 100644 --- a/stable/anchore-engine/values.yaml +++ b/stable/anchore-engine/values.yaml @@ -59,15 +59,22 @@ ingress: enabled: false labels: {} # Use the following paths for GCE/ALB ingress controller + # feedsPath: /v1/feeds/* # apiPath: /v1/* # uiPath: /* + # Exposing the feeds API w/ ingress is for special cases only, uncomment feedsPath if external access to the feeds API is needed + # feedsPath: /v1/feeds/ apiPath: /v1/ uiPath: / + # uncomment `feedsPath` to add an ingress endpoint for the feeds api + # Uncomment the following lines to bind on specific hostnames # apiHosts: # - anchore-api.example.com # uiHosts: # - anchore-ui.example.com + # feedsHosts: + # - anchore-feeds.example.com annotations: # kubernetes.io/ingress.class: gce kubernetes.io/ingress.class: nginx @@ -83,7 +90,7 @@ ingress: # Global configuration shared by all anchore-engine services. anchoreGlobal: # Image used for all anchore engine deployments (excluding enterprise components). - image: docker.io/anchore/anchore-engine:v0.6.0 + image: docker.io/anchore/anchore-engine:v0.6.1 imagePullPolicy: IfNotPresent # Set this value to True to setup the chart for OpenShift deployment compatibility. @@ -474,7 +481,7 @@ anchoreEnterpriseGlobal: # Create this secret with the following command - kubectl create secret generic anchore-license --from-file=license.yaml= licenseSecretName: anchore-enterprise-license - image: docker.io/anchore/enterprise:v0.6.0 + image: docker.io/anchore/enterprise:v0.6.1 imagePullPolicy: IfNotPresent # Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images. # Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username= --docker-password= --docker-email= @@ -672,7 +679,7 @@ anchoreEnterpriseNotifications: anchoreEnterpriseUi: # If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance. enabled: true - image: docker.io/anchore/enterprise-ui:v0.6.0 + image: docker.io/anchore/enterprise-ui:v0.6.1 imagePullPolicy: IfNotPresent # Set extra environment variables. These will be set on all UI containers.