mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
service config changes (#9765)
* initial service config changes update readiness & liveness probes update chart app version. update redis chart version. update readme/notes. Signed-off-by: Brady Todhunter <bradyt@anchore.com> * Update ingress resource to work directly with NGINX ingress controller Signed-off-by: Brady Todhunter <bradyt@anchore.com> * Update readme Signed-off-by: Brady Todhunter <bradyt@anchore.com> * revert default ports in values.yaml back to original chart values. Signed-off-by: Brady Todhunter <bradyt@anchore.com>
This commit is contained in:
Brady Todhunter
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
02cfba3002
commit
d0e80c76e2
@@ -1,6 +1,6 @@
|
||||
name: anchore-engine
|
||||
version: 0.9.0
|
||||
appVersion: 0.3.0
|
||||
version: 0.10.0
|
||||
appVersion: 0.3.1
|
||||
description: Anchore container analysis and policy evaluation engine service
|
||||
keywords:
|
||||
- analysis
|
||||
@@ -9,7 +9,7 @@ keywords:
|
||||
- "anchore-engine"
|
||||
- image
|
||||
- security
|
||||
home: https://anchore.io
|
||||
home: https://anchore.com
|
||||
sources:
|
||||
- https://github.com/anchore/anchore-engine
|
||||
maintainers:
|
||||
|
||||
@@ -8,7 +8,6 @@ Each of these services can be scaled and configured independently.
|
||||
|
||||
See [Anchore Engine](https://github.com/anchore/anchore-engine) for more project details.
|
||||
|
||||
|
||||
## Chart Details
|
||||
|
||||
The chart is split into global and service specific configurations for the OSS Anchore Engine, as well as global and services specific configurations for the Enterprise components.
|
||||
@@ -22,11 +21,14 @@ For a description of each component, view the official documentation at: [Anchor
|
||||
## Installing the Anchore Engine OSS Chart
|
||||
TL;DR - `helm install stable/anchore-engine`
|
||||
|
||||
Anchore Engine will take approximately 3 minutes to bootstrap. After the initial bootstrap period, Anchore Engine will begin a vulnerability feed sync. During this time, image analysis will show zero vulnerabilities until the sync is completed. This sync can take multiple hours depending on which feeds are enabled. The following anchore-cli command is available to poll the system and report back when the engine is bootstrapped and the vulnerability feeds are all synced up. `anchore-cli system wait`
|
||||
|
||||
|
||||
The recommended way to install the Anchore Engine Chart is with a customized values file and a custom release name. Create a new file named `anchore_values.yaml` and add all desired custom values (examples below); then run the following command:
|
||||
|
||||
`helm install --name <release_name> -f anchore_values.yaml stable/anchore-engine`
|
||||
|
||||
Note: It is highly recommended to set non-default passwords when deploying. All passwords are set to defaults specified in the chart.
|
||||
*Note: It is highly recommended to set non-default passwords when deploying. All passwords are set to defaults specified in the chart.*
|
||||
|
||||
##### Install using chart managed PostgreSQL service with custom passwords.
|
||||
```
|
||||
@@ -42,6 +44,30 @@ Note: It is highly recommended to set non-default passwords when deploying. All
|
||||
defaultAdminEmail: <EMAIL>
|
||||
```
|
||||
|
||||
## Upgrading to Chart version 0.10.0
|
||||
|
||||
Ingress resources have been changed to work natively with NGINX ingress controllers. If you're using a different ingress controller, update your values.yaml file accordingly. See the __Using Ingress__ configuration section for examples of NGINX & GCE ingress controller configurations.
|
||||
|
||||
Service configs have been moved from the anchoreGlobal section, to individual component sections in the values.yaml file.
|
||||
If you're upgrading from a previous install and are using custom ports or serviceTypes, be sure to update your values.yaml file accordingly.
|
||||
|
||||
##### v0.9.0 service config
|
||||
|
||||
```
|
||||
anchoreGlobal:
|
||||
service:
|
||||
type: ClusterIP
|
||||
apiPort: 8228
|
||||
```
|
||||
|
||||
##### v0.10.0 service config
|
||||
```
|
||||
anchoreApi:
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8228
|
||||
```
|
||||
|
||||
## Upgrading to Chart version 0.9.0
|
||||
|
||||
Version 0.9.0 of the anchore-engine helm chart includes major changes to the architecture, values.yaml file, as well as introduced Anchore Enterprise components. Due to these changes, it is highly recommended that upgrades are handled with caution. Any custom values.yaml files will also need to be adjusted to match the new structure. Version upgrades have only been validated when upgrading from 0.2.6 -> 0.9.0.
|
||||
@@ -61,23 +87,51 @@ Engine Code Version: 0.3.0
|
||||
All configurations should be appended to your custom `anchore_values.yaml` file and utilized when installing the chart.
|
||||
While the configuration options of Anchore Engine are extensive, the options provided by the chart are:
|
||||
|
||||
#### Exposing the service outside the cluster:
|
||||
### Exposing the service outside the cluster:
|
||||
|
||||
Use ingress, which enables SSL termination at the LB:
|
||||
#### Using Ingress
|
||||
|
||||
This configuration allows SSL termination at the LB.
|
||||
|
||||
*Note: Ingress controllers can use custom hosts or paths for routing requests. Custom paths or hosts should be set in the corresponding component configuration - anchoreEnterpriseUI.ingress or anchoreApi.ingress*
|
||||
|
||||
##### NGINX Ingress Controller
|
||||
```
|
||||
anchoreGlobal:
|
||||
ingress:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
##### GCE Ingress Controller
|
||||
```
|
||||
anchoreGlobal:
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations: null
|
||||
|
||||
anchoreApi:
|
||||
ingress:
|
||||
path: /v1/*
|
||||
service:
|
||||
type: NodePort
|
||||
|
||||
anchoreEnterpriseUi:
|
||||
ingress:
|
||||
path: /*
|
||||
service
|
||||
type: NodePort
|
||||
```
|
||||
|
||||
Use a LoadBalancer service type:
|
||||
##### Using Service Type
|
||||
```
|
||||
anchoreGlobal:
|
||||
anchoreApi:
|
||||
service:
|
||||
type: LoadBalancer
|
||||
```
|
||||
|
||||
#### Install using an existing/external PostgreSQL service:
|
||||
### Install using an existing/external PostgreSQL instance
|
||||
*Note: it is recommended to use an external Postgresql instance for production installs*
|
||||
|
||||
```
|
||||
postgresql:
|
||||
postgresPassword: <PASSWORD>
|
||||
@@ -92,6 +146,7 @@ Use a LoadBalancer service type:
|
||||
```
|
||||
|
||||
### Archive Driver
|
||||
*Note: it is recommended to use an external archive driver for production installs.*
|
||||
|
||||
The archive subsystem of Anchore Engine is what stores large json documents and can consume quite a lot of storage if
|
||||
you analyze a lot of images. A general rule for storage provisioning is 10MB per image analyzed, so with thousands of
|
||||
@@ -238,7 +293,7 @@ To configure the events:
|
||||
|
||||
### Scaling Individual Components
|
||||
|
||||
As of Anchore Engine v0.3.0, all services can now be scaled-out by increasing the replica counts. The chart now supports
|
||||
As of Chart version 0.9.0, all services can now be scaled-out by increasing the replica counts. The chart now supports
|
||||
this configuration.
|
||||
|
||||
To set a specific number of service containers:
|
||||
@@ -258,6 +313,11 @@ To update the number in a running configuration:
|
||||
|
||||
The following features are available to Anchore Enterprise customers. Please contact the Anchore team for more information about getting a license for the enterprise features. [Anchore Enterprise Demo](https://anchore.com/demo/)
|
||||
|
||||
* Role based access control
|
||||
* Graphical User Interface
|
||||
* On-prem feeds service
|
||||
* Snyk vulnerability data
|
||||
|
||||
### Enabling Enterprise Services
|
||||
Enterprise services require an Anchore Enterprise license, as well as credentials with
|
||||
permission to the private docker repositories that contain the enterprise images.
|
||||
@@ -277,7 +337,8 @@ To use this Helm chart with the enterprise services enabled, perform these steps
|
||||
`helm install --name <release_name> -f /path/to/anchore_values.yaml stable/anchore-engine`
|
||||
|
||||
##### Example anchore_values.yaml file for installing Anchore Enterprise
|
||||
Note: This installs with chart managed PostgreSQL & Redis databases.
|
||||
*Note: This installs with chart managed PostgreSQL & Redis databases. This is not a production ready config.*
|
||||
|
||||
```
|
||||
## anchore_values.yaml
|
||||
|
||||
|
||||
@@ -7,6 +7,6 @@ dependencies:
|
||||
version: 1.0.0
|
||||
- name: redis
|
||||
repository: https://kubernetes-charts.storage.googleapis.com
|
||||
version: 4.2.7
|
||||
digest: sha256:7a15cbf9e0bb350d68491b7e85fec2885c1407009290cc52ee612a181942f921
|
||||
generated: 2018-11-14T21:22:15.107839-08:00
|
||||
version: 5.1.0
|
||||
digest: sha256:c72be0f60c6cb3d764e444e77a51eae11beb0b782bde8c528cb61783dab18e67
|
||||
generated: 2018-12-05T18:50:35.229545-08:00
|
||||
|
||||
@@ -11,7 +11,7 @@ dependencies:
|
||||
alias: anchore-feeds-db
|
||||
|
||||
- name: redis
|
||||
version: "4.2.7"
|
||||
version: "*"
|
||||
repository: "alias:stable"
|
||||
condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled
|
||||
alias: anchore-ui-redis
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
To use Anchore Engine you need the URL, username, and password to access the API.
|
||||
|
||||
Anchore Engine can be accessed via port {{ .Values.anchoreGlobal.service.ports.extApi }} on the following DNS name from within the cluster:
|
||||
Anchore Engine can be accessed via port {{ .Values.anchoreApi.service.port }} on the following DNS name from within the cluster:
|
||||
{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
|
||||
|
||||
Here are the steps to configure the anchore-cli (`pip install anchorecli`). Use these same values for direct API access as well.
|
||||
@@ -10,15 +10,15 @@ To configure your anchore-cli run:
|
||||
ANCHORE_CLI_USER=admin
|
||||
ANCHORE_CLI_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "anchore-engine.fullname" . }} -o jsonpath="{.data.ANCHORE_ADMIN_PASSWORD}" | base64 --decode; echo)
|
||||
{{ if .Values.anchoreApi.ingress.enabled }}
|
||||
ANCHORE_CLI_URL=http://$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "anchore-engine.api.fullname" . }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")
|
||||
ANCHORE_CLI_URL=http://$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "anchore-engine.api.fullname" . }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")/v1/
|
||||
{{ else }}
|
||||
Using the service endpoint from within the cluster you can use:
|
||||
ANCHORE_CLI_URL=http://{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.anchoreGlobal.service.ports.extApi}}/v1/
|
||||
ANCHORE_CLI_URL=http://{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.anchoreApi.service.port}}/v1/
|
||||
{{ end }}
|
||||
|
||||
To verify the service is up and running, you can run container for the Anchore Engine CLI:
|
||||
|
||||
kubectl run -i --tty anchore-cli --restart=Always --image anchore/engine-cli --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.anchoreGlobal.service.ports.extApi}}/v1/
|
||||
kubectl run -i --tty anchore-cli --restart=Always --image anchore/engine-cli --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://{{ template "anchore-engine.api.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.anchoreApi.service.port}}/v1/
|
||||
|
||||
from within the container you can use 'anchore-cli' commands.
|
||||
|
||||
|
||||
@@ -43,7 +43,7 @@ spec:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- name: analyzer-api
|
||||
containerPort: {{ .Values.anchoreGlobal.service.ports.analyzer }}
|
||||
containerPort: {{ .Values.anchoreAnalyzer.containerPort }}
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
@@ -59,17 +59,19 @@ spec:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: analyzer-api
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 60
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: analyzer-api
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreAnalyzer.resources | indent 10 }}
|
||||
volumes:
|
||||
|
||||
@@ -59,7 +59,7 @@ spec:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreGlobal.service.ports.extApi }}
|
||||
- containerPort: {{ .Values.anchoreApi.service.port }}
|
||||
name: external-api
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
@@ -70,22 +70,23 @@ spec:
|
||||
mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: external-api
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: external-api
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: external-api
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreApi.resources | indent 10 }}
|
||||
|
||||
@@ -106,7 +107,7 @@ spec:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
|
||||
- containerPort: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
||||
name: rbac-manager
|
||||
volumeMounts:
|
||||
- name: anchore-license
|
||||
@@ -120,22 +121,23 @@ spec:
|
||||
mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: rbac-manager
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: rbac-manager
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: rbac-manager
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreEnterpriseRbac.managerResources | indent 10 }}
|
||||
|
||||
@@ -155,7 +157,7 @@ spec:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreGlobal.service.ports.rbacAuth }}
|
||||
- containerPort: {{ .Values.anchoreEnterpriseRbac.service.authPort }}
|
||||
name: rbac-auth
|
||||
volumeMounts:
|
||||
- name: anchore-license
|
||||
@@ -169,24 +171,27 @@ spec:
|
||||
mountPath: {{ default "/certs" .Values.anchoreGlobal.internalServicesSsl.certDir }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- curl
|
||||
- 'localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}/health'
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- curl
|
||||
- 'localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}/health'
|
||||
- -f
|
||||
- 'localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}/health'
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- curl
|
||||
- -f
|
||||
- 'localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}/health'
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreEnterpriseRbac.authResources | indent 10 }}
|
||||
|
||||
@@ -218,17 +223,21 @@ metadata:
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
component: {{ $component }}
|
||||
{{- if .Values.anchoreApi.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.anchoreApi.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.anchoreGlobal.service.type }}
|
||||
type: {{ .Values.anchoreApi.service.type }}
|
||||
ports:
|
||||
- name: anchore-external-api
|
||||
port: {{ .Values.anchoreGlobal.service.ports.extApi }}
|
||||
targetPort: {{ .Values.anchoreGlobal.service.ports.extApi }}
|
||||
port: {{ .Values.anchoreApi.service.port }}
|
||||
targetPort: {{ .Values.anchoreApi.service.port }}
|
||||
protocol: TCP
|
||||
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
|
||||
- name: anchore-rbac-manager
|
||||
port: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
|
||||
targetPort: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
|
||||
port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
||||
targetPort: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
selector:
|
||||
|
||||
@@ -43,7 +43,7 @@ spec:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- name: catalog
|
||||
containerPort: {{ .Values.anchoreGlobal.service.ports.catalog }}
|
||||
containerPort: {{ .Values.anchoreCatalog.service.port }}
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
@@ -57,17 +57,19 @@ spec:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: catalog
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 60
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: catalog
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreCatalog.resources | indent 10 }}
|
||||
volumes:
|
||||
@@ -103,12 +105,16 @@ metadata:
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
component: {{ $component }}
|
||||
{{- if .Values.anchoreCatalog.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.anchoreCatalog.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.anchoreGlobal.service.type }}
|
||||
type: {{ .Values.anchoreCatalog.service.type }}
|
||||
ports:
|
||||
- name: anchore-catalog-api
|
||||
port: {{ .Values.anchoreGlobal.service.ports.catalog }}
|
||||
targetPort: {{ .Values.anchoreGlobal.service.ports.catalog }}
|
||||
port: {{ .Values.anchoreCatalog.service.port }}
|
||||
targetPort: {{ .Values.anchoreCatalog.service.port }}
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
|
||||
@@ -68,7 +68,7 @@ data:
|
||||
snyk: false
|
||||
{{- end }}
|
||||
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
|
||||
url: 'http://{{ template "anchore-engine.enterprise-feeds.fullname" . }}:{{ .Values.anchoreGlobal.service.ports.feedsApi }}/v1/feeds'
|
||||
url: 'http://{{ template "anchore-engine.enterprise-feeds.fullname" . }}:{{ .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds'
|
||||
client_url:
|
||||
token_url:
|
||||
{{- else }}
|
||||
@@ -98,11 +98,11 @@ data:
|
||||
require_auth: true
|
||||
endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.extApi }}
|
||||
port: {{ .Values.anchoreApi.service.port }}
|
||||
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
|
||||
authorization_handler: external
|
||||
authorization_handler_config:
|
||||
endpoint: "http://localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}"
|
||||
endpoint: "http://localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}"
|
||||
{{- end }}
|
||||
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
|
||||
ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
|
||||
@@ -112,7 +112,7 @@ data:
|
||||
require_auth: true
|
||||
endpoint_hostname: {{ template "anchore-engine.analyzer.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.analyzer }}
|
||||
port: {{ .Values.anchoreAnalyzer.containerPort }}
|
||||
cycle_timer_seconds: 1
|
||||
cycle_timers:
|
||||
{{ toYaml .Values.anchoreAnalyzer.cycleTimers | indent 10 }}
|
||||
@@ -126,7 +126,7 @@ data:
|
||||
require_auth: true
|
||||
endpoint_hostname: {{ template "anchore-engine.catalog.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.catalog }}
|
||||
port: {{ .Values.anchoreCatalog.service.port }}
|
||||
cycle_timer_seconds: '1'
|
||||
cycle_timers:
|
||||
{{ toYaml .Values.anchoreCatalog.cycleTimers | indent 10 }}
|
||||
@@ -142,7 +142,7 @@ data:
|
||||
require_auth: true
|
||||
endpoint_hostname: {{ template "anchore-engine.simplequeue.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
|
||||
port: {{ .Values.anchoreSimpleQueue.service.port }}
|
||||
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
|
||||
ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
|
||||
ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
|
||||
@@ -151,7 +151,7 @@ data:
|
||||
require_auth: true
|
||||
endpoint_hostname: {{ template "anchore-engine.policy-engine.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
|
||||
port: {{ .Values.anchorePolicyEngine.service.port }}
|
||||
cycle_timer_seconds: 1
|
||||
cycle_timers:
|
||||
{{ toYaml .Values.anchorePolicyEngine.cycleTimers | indent 10 }}
|
||||
|
||||
@@ -44,7 +44,7 @@ spec:
|
||||
command: ["/usr/local/bin/anchore-enterprise-manager"]
|
||||
args: ["service", "start", "feeds"]
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
|
||||
- containerPort: {{ .Values.anchoreEnterpriseFeeds.service.port }}
|
||||
name: feeds-api
|
||||
envFrom:
|
||||
- secretRef:
|
||||
@@ -79,22 +79,23 @@ spec:
|
||||
- name: anchore-license
|
||||
mountPath: /license.yaml
|
||||
subPath: license.yaml
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: feeds-api
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: feeds-api
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: feeds-api
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreEnterpriseFeeds.resources | indent 10 }}
|
||||
{{- if .Values.anchoreEnterpriseFeeds.nodeSelector }}
|
||||
@@ -121,12 +122,16 @@ metadata:
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
component: {{ $component }}
|
||||
{{- if .Values.anchoreEnterpriseFeeds.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.anchoreEnterpriseFeeds.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.anchoreGlobal.service.type }}
|
||||
type: {{ .Values.anchoreEnterpriseFeeds.service.type }}
|
||||
ports:
|
||||
- name: feeds-api
|
||||
port: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
|
||||
targetPort: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
|
||||
port: {{ .Values.anchoreEnterpriseFeeds.service.port }}
|
||||
targetPort: {{ .Values.anchoreEnterpriseFeeds.service.port }}
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
|
||||
@@ -54,12 +54,12 @@ spec:
|
||||
value: {{ printf "redis://:$(REDIS_PASSWORD)@%s-master:6379" ( include "redis.fullname" . ) }}
|
||||
{{- end }}
|
||||
- name: ANCHORE_ENGINE_URI
|
||||
value: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreGlobal.service.ports.extApi }}/v1'
|
||||
value: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreApi.service.port }}/v1'
|
||||
- name: ANCHORE_LICENSE_PATH
|
||||
value: '/'
|
||||
{{- if .Values.anchoreEnterpriseRbac.enabled }}
|
||||
- name: ANCHORE_RBAC_URI
|
||||
value: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreGlobal.service.ports.rbacApi }}/v1'
|
||||
value: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseRbac.service.apiPort }}/v1'
|
||||
{{- end }}
|
||||
- name: ANCHORE_ENABLE_SSL
|
||||
value: '{{ .Values.anchoreEnterpriseUi.enableSsl }}'
|
||||
@@ -75,22 +75,21 @@ spec:
|
||||
- name: anchore-license
|
||||
mountPath: "/license.yaml"
|
||||
subPath: license.yaml
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: enterprise-ui
|
||||
initialDelaySeconds: 120
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /service/health
|
||||
port: enterprise-ui
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /service/health
|
||||
port: enterprise-ui
|
||||
timeoutSeconds: 10
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreEnterpriseUi.resources | indent 10 }}
|
||||
{{- if .Values.anchoreEnterpriseUi.nodeSelector }}
|
||||
@@ -117,12 +116,16 @@ metadata:
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
release: "{{ .Release.Name }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
{{- if .Values.anchoreEnterpriseUi.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.anchoreEnterpriseUi.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
sessionAffinity: ClientIP
|
||||
type: {{ .Values.anchoreGlobal.service.type }}
|
||||
type: {{ .Values.anchoreEnterpriseUi.service.type }}
|
||||
ports:
|
||||
- name: enterprise-ui
|
||||
port: {{ .Values.anchoreGlobal.service.ports.uiHttp }}
|
||||
port: {{ .Values.anchoreEnterpriseUi.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: 3000
|
||||
selector:
|
||||
|
||||
@@ -45,7 +45,7 @@ data:
|
||||
require_auth: true
|
||||
endpoint_hostname: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.feedsApi }}
|
||||
port: {{ .Values.anchoreEnterpriseFeeds.service.port }}
|
||||
# Time delay in seconds between consecutive driver runs for processing data
|
||||
cycle_timers:
|
||||
{{ toYaml .Values.anchoreEnterpriseFeeds.cycleTimers | indent 10 }}
|
||||
|
||||
@@ -32,7 +32,7 @@ spec:
|
||||
- path: {{ $.Values.anchoreApi.ingress.path }}
|
||||
backend:
|
||||
serviceName: "{{ template "anchore-engine.api.fullname" $ }}"
|
||||
servicePort: {{ $.Values.anchoreGlobal.service.ports.extApi }}
|
||||
servicePort: {{ $.Values.anchoreApi.service.port }}
|
||||
{{- end }}
|
||||
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled) .Values.anchoreEnterpriseUi.ingress.hosts }}
|
||||
{{- range .Values.anchoreEnterpriseUi.ingress.hosts }}
|
||||
@@ -42,7 +42,7 @@ spec:
|
||||
- path: {{ $.Values.anchoreEnterpriseUi.ingress.path }}
|
||||
backend:
|
||||
serviceName: "{{ template "anchore-engine.enterprise-ui.fullname" $ }}"
|
||||
servicePort: {{ $.Values.anchoreGlobal.service.ports.uiHttp }}
|
||||
servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
@@ -51,12 +51,12 @@ spec:
|
||||
- path: {{ $.Values.anchoreApi.ingress.path }}
|
||||
backend:
|
||||
serviceName: "{{ template "anchore-engine.api.fullname" $ }}"
|
||||
servicePort: {{ $.Values.anchoreGlobal.service.ports.extApi }}
|
||||
servicePort: {{ $.Values.anchoreApi.service.port }}
|
||||
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }}
|
||||
- path: {{ $.Values.anchoreEnterpriseUi.ingress.path }}
|
||||
backend:
|
||||
serviceName: "{{ template "anchore-engine.enterprise-ui.fullname" $ }}"
|
||||
servicePort: {{ $.Values.anchoreGlobal.service.ports.uiHttp }}
|
||||
servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
@@ -43,7 +43,7 @@ spec:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- name: policy
|
||||
containerPort: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
|
||||
containerPort: {{ .Values.anchorePolicyEngine.service.port }}
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
@@ -54,21 +54,22 @@ spec:
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- twistd
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 60
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /health
|
||||
port: policy
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: policy
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchorePolicyEngine.resources | indent 10 }}
|
||||
volumes:
|
||||
@@ -104,12 +105,16 @@ metadata:
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
component: {{ $component }}
|
||||
{{- if .Values.anchorePolicyEngine.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.anchorePolicyEngine.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.anchoreGlobal.service.type }}
|
||||
type: {{ .Values.anchorePolicyEngine.service.type }}
|
||||
ports:
|
||||
- name: anchore-policy-api
|
||||
port: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
|
||||
targetPort: {{ .Values.anchoreGlobal.service.ports.policyEngine }}
|
||||
port: {{ .Values.anchorePolicyEngine.service.port }}
|
||||
targetPort: {{ .Values.anchorePolicyEngine.service.port }}
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
|
||||
@@ -47,7 +47,7 @@ data:
|
||||
require_auth: True
|
||||
endpoint_hostname: localhost
|
||||
listen: '127.0.0.1'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.rbacAuth }}
|
||||
port: {{ .Values.anchoreEnterpriseRbac.service.authPort }}
|
||||
ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
|
||||
ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
|
||||
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
|
||||
@@ -56,10 +56,10 @@ data:
|
||||
require_auth: True
|
||||
endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
|
||||
listen: '0.0.0.0'
|
||||
port: {{ .Values.anchoreGlobal.service.ports.rbacApi }}
|
||||
port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
||||
authorization_handler: external
|
||||
authorization_handler_config:
|
||||
endpoint: 'http://localhost:{{ .Values.anchoreGlobal.service.ports.rbacAuth }}'
|
||||
endpoint: 'http://localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}'
|
||||
ssl_cert: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}
|
||||
ssl_key: {{ .Values.anchoreGlobal.internalServicesSsl.certDir -}}/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}
|
||||
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSslEnabled }}
|
||||
|
||||
@@ -43,7 +43,7 @@ spec:
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
- name: simplequeue
|
||||
containerPort: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
|
||||
containerPort: {{ .Values.anchoreSimpleQueue.service.port }}
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
@@ -57,17 +57,19 @@ spec:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: simplequeue
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 60
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: simplequeue
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreSimpleQueue.resources | indent 10 }}
|
||||
volumes:
|
||||
@@ -103,12 +105,16 @@ metadata:
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
component: {{ $component }}
|
||||
{{- if .Values.anchoreSimpleQueue.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.anchoreSimpleQueue.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.anchoreGlobal.service.type }}
|
||||
type: {{ .Values.anchoreSimpleQueue.service.type }}
|
||||
ports:
|
||||
- name: anchore-simplequeue-api
|
||||
port: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
|
||||
targetPort: {{ .Values.anchoreGlobal.service.ports.simplequeue }}
|
||||
port: {{ .Values.anchoreSimpleQueue.service.port }}
|
||||
targetPort: {{ .Values.anchoreSimpleQueue.service.port }}
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
|
||||
@@ -24,32 +24,19 @@ anchoreGlobal:
|
||||
image:
|
||||
# Can use 'latest' tag but not recommended
|
||||
repository: docker.io/anchore/anchore-engine
|
||||
tag: v0.3.0
|
||||
tag: v0.3.1
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# K8s service configuration for all anchore engine APIs, must be reachable inside the cluster by all other services and users
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
analyzer: 8084
|
||||
extApi: 8228
|
||||
simplequeue: 8083
|
||||
catalog: 8082
|
||||
policyEngine: 8087
|
||||
kubernetesWebhook: 8338
|
||||
# For enterprise customers only
|
||||
feedsApi: 8448
|
||||
uiHttp: 80
|
||||
rbacApi: 8229
|
||||
rbacAuth: 8089
|
||||
|
||||
# Create an ingress resource for all external anchore engine services.
|
||||
# By default this chart is setup to use the NGINX ingress controller which needs to be installed & configured on your cluster.
|
||||
# To utilize a GCE ingress controller comment out the annotations below, also edit path configurion the UI & Api configs as per the comments.
|
||||
# Ingress paths/hosts can be setup for the anchoreApi & anchoreEnterpriseUi deployments in the corresponding values sections.
|
||||
ingress:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
# nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
# kubernetes.io/ingress.allow-http: false
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: true
|
||||
tls: []
|
||||
# Secrets must be manually created in the namespace.
|
||||
@@ -57,6 +44,9 @@ anchoreGlobal:
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
###
|
||||
# Start of General Anchore Engine Configurations (populates config.yaml)
|
||||
###
|
||||
# Set where default configs are placed at startup. This must be a writable location for the pod.
|
||||
serviceDir: /anchore_service_config
|
||||
logLevel: INFO
|
||||
@@ -109,6 +99,7 @@ anchoreGlobal:
|
||||
# is very IO intensive. Use of affinity/anti-affinity rules for scheduling the analyzers is future work.
|
||||
anchoreAnalyzer:
|
||||
replicaCount: 1
|
||||
containerPort: 8084
|
||||
|
||||
# The cycle timer is the interval between checks to the work queue for new jobs
|
||||
cycleTimers:
|
||||
@@ -144,10 +135,19 @@ anchoreAnalyzer:
|
||||
anchoreApi:
|
||||
replicaCount: 1
|
||||
|
||||
# kubernetes service configuration for anchore external API
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8228
|
||||
annotations: {}
|
||||
|
||||
# Used to create Ingress record for the anchore engine external API (api service)
|
||||
# (should used with service.type: ClusterIP or NodePort depending on platform)
|
||||
ingress:
|
||||
path: /v1/*
|
||||
# For GCE ingress controllers use the following path
|
||||
# path: /v1/*
|
||||
# By default this is configured to use an NGINX ingress controller.
|
||||
path: /v1/
|
||||
# You can bound on specific hostnames
|
||||
# hosts:
|
||||
# - anchore-api.local
|
||||
@@ -242,6 +242,12 @@ anchoreCatalog:
|
||||
# # Create the container if it is not already present
|
||||
# create_container: false
|
||||
|
||||
# kubernetes service configuration for anchore catalog api
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8082
|
||||
annotations: {}
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
@@ -259,12 +265,19 @@ anchoreCatalog:
|
||||
anchorePolicyEngine:
|
||||
replicaCount: 1
|
||||
|
||||
# Intervals to run specific events on (seconds)
|
||||
cycleTimers:
|
||||
# Interval to run a feed sync to get latest cve data
|
||||
feed_sync: 14400
|
||||
# Interval between checks to see if there needs to be a task queued
|
||||
feed_sync_checker: 3600
|
||||
|
||||
# kubernetes service configuration for anchore policy engine api
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8087
|
||||
annotations: {}
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
@@ -282,6 +295,12 @@ anchorePolicyEngine:
|
||||
anchoreSimpleQueue:
|
||||
replicaCount: 1
|
||||
|
||||
# kubernetes service configuration for anchore simplequeue api
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8083
|
||||
annotations: {}
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
@@ -307,7 +326,7 @@ anchoreEnterpriseGlobal:
|
||||
|
||||
image:
|
||||
repository: docker.io/anchore/enterprise
|
||||
tag: v0.3.0
|
||||
tag: v0.3.1
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Configure the second postgres database instance for the enterprise feeds service.
|
||||
@@ -346,6 +365,12 @@ anchoreEnterpriseFeeds:
|
||||
connectionPoolSize: 30
|
||||
connectionPoolMaxOverflow: 100
|
||||
|
||||
# kubernetes service configuration for anchore feeds service api
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8448
|
||||
annotations: {}
|
||||
|
||||
# Staging space for holding normalized output from drivers.
|
||||
scratchVolume:
|
||||
mountPath: /scratch
|
||||
@@ -370,6 +395,13 @@ anchoreEnterpriseFeeds:
|
||||
# This component consists of 2 containers that run as side-cars in the anchore engine api pod.
|
||||
anchoreEnterpriseRbac:
|
||||
enabled: true
|
||||
|
||||
# Kubernetes service config - annotations & serviceType configs must be set in anchoreApi
|
||||
# Due to RBAC sharing a service with the general API.
|
||||
service:
|
||||
apiPort: 8229
|
||||
authPort: 8089
|
||||
|
||||
# authResources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
@@ -404,11 +436,20 @@ anchoreEnterpriseUi:
|
||||
|
||||
image:
|
||||
repository: docker.io/anchore/enterprise-ui
|
||||
tag: v0.3.0
|
||||
tag: v0.3.1
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# kubernetes service configuration for anchore UI
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
annotations: {}
|
||||
|
||||
ingress:
|
||||
path: /*
|
||||
# For GCE ingress controllers use the following path
|
||||
# path: /*
|
||||
# By default this is configured to use an NGINX ingress controller.
|
||||
path: /
|
||||
# You can bound on specific hostnames
|
||||
# hosts:
|
||||
# - anchore-ui.local
|
||||
|
||||
Reference in New Issue
Block a user