mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Update to enterprise v2.3.0 & engine v0.7.1 (#22173)
add pre-upgrade hook for updating DB Use enterprise image, pullPolicy & imagePullSecret when appropriate Use recreate deployment strategy for upgrade hook add global timeout to engine & enterprise add license to engine components when enterprise is enabled add license to engine configmap for enterprise installs use anchore-enterprise-manager for all services when enterprise is enabled update README Signed-off-by: Brady Todhunter <bradyt@anchore.com>
This commit is contained in:
Brady Todhunter
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
name: anchore-engine
|
||||
version: 1.5.2
|
||||
appVersion: 0.7.0
|
||||
version: 1.6.0
|
||||
appVersion: 0.7.1
|
||||
description: Anchore container analysis and policy evaluation engine service
|
||||
keywords:
|
||||
- analysis
|
||||
|
||||
@@ -27,9 +27,6 @@ The recommended way to install the Anchore Engine Helm Chart is with a customize
|
||||
|
||||
Create a new file named `anchore_values.yaml` and add all desired custom values (examples below); then run the following command:
|
||||
|
||||
#### Helm v2 installation
|
||||
`helm install --name <release_name> -f anchore_values.yaml stable/anchore-engine`
|
||||
|
||||
#### Helm v3 installation
|
||||
`helm repo add stable https://kubernetes-charts.storage.googleapis.com`
|
||||
|
||||
@@ -59,8 +56,10 @@ anchoreGlobal:
|
||||
* Graphical user interface
|
||||
* Customizable UI dashboards
|
||||
* On-premises feeds service
|
||||
* Proprietary vulnerability data feed
|
||||
* Proprietary vulnerability data feed (vulnDB, MSRC)
|
||||
* Anchore reporting API
|
||||
* Notifications - Slack, GitHub, Jira, etc
|
||||
* Microsoft image vulnerability scanning
|
||||
|
||||
### Enabling Enterprise Services
|
||||
Enterprise services require an Anchore Enterprise license, as well as credentials with
|
||||
@@ -77,19 +76,12 @@ To use this Helm chart with the enterprise services enabled, perform these steps
|
||||
`kubectl create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username=<DOCKERHUB_USER> --docker-password=<DOCKERHUB_PASSWORD> --docker-email=<EMAIL_ADDRESS>`
|
||||
|
||||
1. (demo) Install the Helm chart using default values
|
||||
#### Helm v2 installation
|
||||
`helm install --name <release_name> --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine`
|
||||
|
||||
#### Helm v3 installation
|
||||
`helm repo add stable https://kubernetes-charts.storage.googleapis.com`
|
||||
|
||||
`helm install <release_name> --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine`
|
||||
`helm install <release_name> --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine`
|
||||
|
||||
2. (production) Install the Helm chart using a custom anchore_values.yaml file - *see examples below*
|
||||
|
||||
#### Helm v2 installation
|
||||
`helm install --name <release_name> -f anchore_values.yaml stable/anchore-engine`
|
||||
|
||||
#### Helm v3 installation
|
||||
`helm repo add stable https://kubernetes-charts.storage.googleapis.com`
|
||||
|
||||
@@ -215,6 +207,21 @@ anchore-feeds-db:
|
||||
anchore-ui-redis:
|
||||
password: <PASSWORD>
|
||||
```
|
||||
# Chart Updates
|
||||
See the anchore-engine [CHANGELOG](https://github.com/anchore/anchore-engine/blob/master/CHANGELOG.md) for updates to anchore engine.
|
||||
|
||||
## Upgrading from previous chart versions
|
||||
A Helm post-upgrade hook job has been added starting with Chart version 1.6.0 - this job will shut down all previously running Anchore services and perform the Anchore DB upgrade process using a kubernetes job. The upgrade will only be considered successful when this job completes successfully. Performing an update after v1.6.0 will cause the Helm client to block until the upgrade job completes and the new Anchore service pods are started. To view progress of the upgrade process, tail the logs of the upgrade jobs `anchore-engine-upgrade` and `anchore-enterprise-upgrade`. These job resources will be removed upon a successful helm upgrade.
|
||||
|
||||
## Chart version 1.6.0
|
||||
Changes with this version include:
|
||||
* Anchore database upgrades will now be handled using a helm post-upgrade hook job
|
||||
* Anchore Engine image updated to v0.7.1
|
||||
* Anchore Enterprise updated to v2.3.0 - see [CHANGELOG](https://docs.anchore.com/current/docs/releasenotes/230/)
|
||||
* Enterprise deployments now use the `anchore/enterprise` image for all components
|
||||
* Added GitHub advisory feeds
|
||||
* Added NuGet .NET feeds to Enterprise feed service
|
||||
* Updated resources to provide better minimum requirements baseline (these are still not production ready)
|
||||
|
||||
## Chart version 1.5.0
|
||||
Changes to the Helm Chart include:
|
||||
@@ -223,8 +230,6 @@ Changes to the Helm Chart include:
|
||||
* Default feed sync timeout increased to 180s
|
||||
* Added a optional configuration for including imagePullSecret on all anchore-engine images - .Values.anchoreGlobal.imagePullSecretName
|
||||
|
||||
See the anchore-engine [CHANGELOG](https://github.com/anchore/anchore-engine/blob/master/CHANGELOG.md#070-2020-03-26) for updates to anchore engine
|
||||
|
||||
## Chart version 1.4.0
|
||||
The following features were added with this chart version:
|
||||
* Enterprise notifications service
|
||||
@@ -366,11 +371,11 @@ Engine DB Version: 0.0.8
|
||||
Engine Code Version: 0.3.0
|
||||
```
|
||||
|
||||
## Configuration
|
||||
# Configuration
|
||||
|
||||
All configurations should be appended to your custom `anchore_values.yaml` file and utilized when installing the chart. While the configuration options of Anchore Engine are extensive, the options provided by the chart are:
|
||||
|
||||
### Exposing the service outside the cluster:
|
||||
## Exposing the service outside the cluster:
|
||||
|
||||
#### Using Ingress
|
||||
|
||||
|
||||
@@ -21,6 +21,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: {{ .Values.anchoreAnalyzer.replicaCount }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -40,10 +42,15 @@ spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
{{- else }}
|
||||
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
||||
imagePullSecrets:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.cloudsql.enabled }}
|
||||
- name: cloudsql-proxy
|
||||
@@ -62,13 +69,18 @@ spec:
|
||||
{{- end }}
|
||||
- name: {{ .Chart.Name }}-{{ $component }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.engineImage }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
{{- else }}
|
||||
image: {{ .Values.anchoreGlobal.image }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
{{- else }}
|
||||
command: ["anchore-manager"]
|
||||
args: ["service", "start", "analyzer"]
|
||||
{{- end }}
|
||||
args: ["service", "start", "--no-auto-upgrade", "analyzer"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -89,6 +101,11 @@ spec:
|
||||
- name: analyzer-api
|
||||
containerPort: {{ .Values.anchoreAnalyzer.containerPort }}
|
||||
volumeMounts:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
mountPath: /home/anchore/license.yaml
|
||||
subPath: license.yaml
|
||||
{{- end }}
|
||||
- name: analyzer-config-volume
|
||||
mountPath: /anchore_service/analyzer_config.yaml
|
||||
subPath: analyzer_config.yaml
|
||||
@@ -136,6 +153,11 @@ spec:
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreAnalyzer.resources | nindent 10 }}
|
||||
volumes:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
secret:
|
||||
secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ template "anchore-engine.fullname" .}}
|
||||
|
||||
@@ -21,6 +21,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: {{ .Values.anchoreApi.replicaCount }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -40,13 +42,15 @@ spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{ if and .Values.anchoreEnterpriseGlobal.enabled (or .Values.anchoreEnterpriseRbac.enabled .Values.anchoreEnterpriseReports.enabled) }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
{{- else }}
|
||||
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
||||
imagePullSecrets:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.cloudsql.enabled }}
|
||||
- name: cloudsql-proxy
|
||||
@@ -65,13 +69,18 @@ spec:
|
||||
{{- end }}
|
||||
- name: "{{ .Chart.Name }}-{{ $component }}"
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.engineImage }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
{{- else }}
|
||||
image: {{ .Values.anchoreGlobal.image }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
{{- else }}
|
||||
command: ["anchore-manager"]
|
||||
args: ["service", "start", "apiext"]
|
||||
{{- end }}
|
||||
args: ["service", "start", "--no-auto-upgrade", "apiext"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -97,6 +106,11 @@ spec:
|
||||
- containerPort: {{ .Values.anchoreApi.service.port }}
|
||||
name: external-api
|
||||
volumeMounts:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
mountPath: /home/anchore/license.yaml
|
||||
subPath: license.yaml
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
subPath: config.yaml
|
||||
@@ -143,7 +157,7 @@ spec:
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
args: ["service", "start", "rbac_manager"]
|
||||
args: ["service", "start", "--no-auto-upgrade", "rbac_manager"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -212,7 +226,7 @@ spec:
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
args: ["service", "start", "rbac_authorizer"]
|
||||
args: ["service", "start", "--no-auto-upgrade", "rbac_authorizer"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -281,7 +295,7 @@ spec:
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
args: ["service", "start", "reports"]
|
||||
args: ["service", "start", "--no-auto-upgrade", "reports"]
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreEnterpriseReports.service.port }}
|
||||
name: reports-api
|
||||
@@ -352,7 +366,7 @@ spec:
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
args: ["service", "start", "notifications"]
|
||||
args: ["service", "start", "--no-auto-upgrade", "notifications"]
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreEnterpriseNotifications.service.port }}
|
||||
name: notifi-api
|
||||
|
||||
@@ -21,6 +21,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: {{ .Values.anchoreCatalog.replicaCount }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -40,10 +42,15 @@ spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
{{- else }}
|
||||
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
||||
imagePullSecrets:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.cloudsql.enabled }}
|
||||
- name: cloudsql-proxy
|
||||
@@ -62,13 +69,18 @@ spec:
|
||||
{{- end }}
|
||||
- name: {{ .Chart.Name }}-{{ $component }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.engineImage }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
{{- else }}
|
||||
image: {{ .Values.anchoreGlobal.image }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
{{- else }}
|
||||
command: ["anchore-manager"]
|
||||
args: ["service", "start", "catalog"]
|
||||
{{- end }}
|
||||
args: ["service", "start", "--no-auto-upgrade", "catalog"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -89,6 +101,11 @@ spec:
|
||||
- name: catalog
|
||||
containerPort: {{ .Values.anchoreCatalog.service.port }}
|
||||
volumeMounts:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
mountPath: /home/anchore/license.yaml
|
||||
subPath: license.yaml
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
subPath: config.yaml
|
||||
@@ -131,6 +148,11 @@ spec:
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreCatalog.resources | nindent 10 }}
|
||||
volumes:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
secret:
|
||||
secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ template "anchore-engine.fullname" . }}
|
||||
|
||||
@@ -22,6 +22,14 @@ data:
|
||||
host_id: "${ANCHORE_POD_NAME}"
|
||||
internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
|
||||
auto_restart_services: false
|
||||
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
license_file: /home/anchore/license.yaml
|
||||
{{- end }}
|
||||
|
||||
global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }}
|
||||
global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ .Values.anchoreGlobal.enableMetrics }}
|
||||
auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }}
|
||||
@@ -55,9 +63,15 @@ data:
|
||||
# anchore support for finding out more about this service
|
||||
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
|
||||
vulndb: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
|
||||
# Enabling microsoft syncs MSRC data from an on-premise anchore enterprise feeds service. Please contact
|
||||
# anchore support for finding out more about this service
|
||||
microsoft: {{ .Values.anchoreEnterpriseFeeds.microsoftDriverEnabled }}
|
||||
{{- else }}
|
||||
vulndb: false
|
||||
microsoft: false
|
||||
{{- end }}
|
||||
# Sync github data if available for GHSA matches
|
||||
github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
|
||||
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
|
||||
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
||||
url: "https://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-engine-upgrade"
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
annotations:
|
||||
"helm.sh/hook": post-upgrade
|
||||
"helm.sh/hook-weight": "-5"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-engine-upgrade"
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
{{- else }}
|
||||
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
||||
imagePullSecrets:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: "{{ .Release.Name }}-enterprise-upgrade"
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
{{- else }}
|
||||
image: {{ .Values.anchoreGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
||||
{{- end }}
|
||||
command: ["/bin/bash", "-c"]
|
||||
{{- if .Values.anchoreGlobal.dbConfig.ssl }}
|
||||
args: ["anchore-manager db --db-use-ssl --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}} upgrade --dontask"]
|
||||
{{- else }}
|
||||
args: ["anchore-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask"]
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
- configMapRef:
|
||||
name: {{ template "anchore-engine.fullname" . }}-env
|
||||
env:
|
||||
{{- with .Values.anchoreGlobal.extraEnv }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -31,8 +31,12 @@ data:
|
||||
auto_restart_services: false
|
||||
license_file: /home/anchore/license.yaml
|
||||
|
||||
global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }}
|
||||
global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ .Values.anchoreGlobal.enableMetrics }}
|
||||
auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }}
|
||||
|
||||
# Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
|
||||
# Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
|
||||
|
||||
@@ -97,12 +97,16 @@ data:
|
||||
# To enable gem driver comment the enabled property and uncomment the db_connect property.
|
||||
enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.gemDriverEnabled }}
|
||||
db_connect: {{ default "'postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/gems'" .Values.anchoreEnterpriseFeeds.gemDbEndpoint }}
|
||||
amzn:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.amazonDriverEnabled }}
|
||||
centos:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.centosDriverEnabled }}
|
||||
debian:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.debianDriverEnabled }}
|
||||
ubuntu:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.ubuntuDriverEnabled }}
|
||||
rhel:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.rhelDriverEnabled }}
|
||||
ol:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.olDriverEnabled }}
|
||||
alpine:
|
||||
@@ -115,6 +119,16 @@ data:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.nvdv2DriverEnabled }}
|
||||
vulndb:
|
||||
enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
|
||||
msrc:
|
||||
enabled: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }}
|
||||
api_key: {{ .Values.anchoreEnterpriseFeeds.msrcApiKey }}
|
||||
{{- with .Values.anchoreEnterpriseFeeds.msrcWhitelist }}
|
||||
whitelist:
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
github:
|
||||
enabled: {{ .Values.anchoreEnterpriseFeeds.githubDriverEnabled }}
|
||||
token: {{ .Values.anchoreEnterpriseFeeds.githubDriverToken }}
|
||||
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
||||
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
||||
ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
|
||||
|
||||
@@ -22,6 +22,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -63,7 +65,7 @@ spec:
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
args: ["service", "start", "feeds"]
|
||||
args: ["service", "start", "--no-auto-upgrade", "feeds"]
|
||||
ports:
|
||||
- containerPort: {{ .Values.anchoreEnterpriseFeeds.service.port }}
|
||||
name: feeds-api
|
||||
|
||||
@@ -23,6 +23,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-enterprise-upgrade"
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
annotations:
|
||||
"helm.sh/hook": post-upgrade
|
||||
"helm.sh/hook-weight": "-3"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-enterprise-upgrade"
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: "{{ .Release.Name }}-enterprise-upgrade"
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
command: ["/bin/bash", "-c"]
|
||||
{{- if .Values.anchoreGlobal.dbConfig.ssl }}
|
||||
args: ["anchore-enterprise-manager db --db-use-ssl --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}} upgrade --dontask"]
|
||||
{{- else }}
|
||||
args: ["anchore-enterprise-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask"]
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
- configMapRef:
|
||||
name: {{ template "anchore-engine.fullname" . }}-env
|
||||
env:
|
||||
{{- with .Values.anchoreGlobal.extraEnv }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -21,6 +21,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: {{ .Values.anchorePolicyEngine.replicaCount }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -40,10 +42,15 @@ spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
{{- else }}
|
||||
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
||||
imagePullSecrets:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.cloudsql.enabled }}
|
||||
- name: cloudsql-proxy
|
||||
@@ -62,13 +69,18 @@ spec:
|
||||
{{- end }}
|
||||
- name: {{ .Chart.Name }}-{{ $component }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.engineImage }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
{{- else }}
|
||||
image: {{ .Values.anchoreGlobal.image }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
{{- else }}
|
||||
command: ["anchore-manager"]
|
||||
args: ["service", "start", "policy_engine"]
|
||||
{{- end }}
|
||||
args: ["service", "start", "--no-auto-upgrade", "policy_engine"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -89,6 +101,11 @@ spec:
|
||||
- name: policy
|
||||
containerPort: {{ .Values.anchorePolicyEngine.service.port }}
|
||||
volumeMounts:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
mountPath: /home/anchore/license.yaml
|
||||
subPath: license.yaml
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
subPath: config.yaml
|
||||
@@ -133,6 +150,11 @@ spec:
|
||||
resources:
|
||||
{{ toYaml .Values.anchorePolicyEngine.resources | nindent 10 }}
|
||||
volumes:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
secret:
|
||||
secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ template "anchore-engine.fullname" . }}
|
||||
@@ -199,4 +221,4 @@ spec:
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
component: {{ $component }}
|
||||
@@ -21,6 +21,8 @@ spec:
|
||||
app: {{ template "anchore-engine.fullname" . }}
|
||||
component: {{ $component }}
|
||||
replicas: {{ .Values.anchoreSimpleQueue.replicaCount }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -40,10 +42,15 @@ spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
||||
{{- else }}
|
||||
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
||||
imagePullSecrets:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.cloudsql.enabled }}
|
||||
- name: cloudsql-proxy
|
||||
@@ -62,13 +69,18 @@ spec:
|
||||
{{- end }}
|
||||
- name: "{{ .Chart.Name }}-{{ $component }}"
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.engineImage }}
|
||||
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
||||
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
||||
{{- else }}
|
||||
image: {{ .Values.anchoreGlobal.image }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
command: ["anchore-enterprise-manager"]
|
||||
{{- else }}
|
||||
command: ["anchore-manager"]
|
||||
args: ["service", "start", "simplequeue"]
|
||||
{{- end }}
|
||||
args: ["service", "start", "--no-auto-upgrade", "simplequeue"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
||||
@@ -89,6 +101,11 @@ spec:
|
||||
- name: simplequeue
|
||||
containerPort: {{ .Values.anchoreSimpleQueue.service.port }}
|
||||
volumeMounts:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
mountPath: /home/anchore/license.yaml
|
||||
subPath: license.yaml
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
mountPath: /config/config.yaml
|
||||
subPath: config.yaml
|
||||
@@ -131,6 +148,11 @@ spec:
|
||||
resources:
|
||||
{{ toYaml .Values.anchoreSimpleQueue.resources | nindent 10 }}
|
||||
volumes:
|
||||
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
||||
- name: anchore-license
|
||||
secret:
|
||||
secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ template "anchore-engine.fullname" .}}
|
||||
|
||||
@@ -19,7 +19,7 @@ postgresql:
|
||||
resourcePolicy: nil
|
||||
size: 20Gi
|
||||
|
||||
# If running operator on OpenShift - uncomment the image, imageTag & extraEnv values below.
|
||||
# If running on OpenShift - uncomment the image, imageTag & extraEnv values below.
|
||||
# image: registry.access.redhat.com/rhscl/postgresql-96-rhel7
|
||||
# imageTag: latest
|
||||
# extraEnv:
|
||||
@@ -90,7 +90,7 @@ ingress:
|
||||
# Global configuration shared by all anchore-engine services.
|
||||
anchoreGlobal:
|
||||
# Image used for all anchore engine deployments (excluding enterprise components).
|
||||
image: docker.io/anchore/anchore-engine:v0.7.0
|
||||
image: docker.io/anchore/anchore-engine:v0.7.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
# Set image pull secret name if using an anchore-engine image from a private registry
|
||||
imagePullSecretName:
|
||||
@@ -257,11 +257,11 @@ anchoreAnalyzer:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 4G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -294,11 +294,11 @@ anchoreApi:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 6Gi
|
||||
# cpu: 1
|
||||
# memory: 4G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 4Gi
|
||||
# memory: 1G
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -397,11 +397,11 @@ anchoreCatalog:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 2G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 500M
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -434,11 +434,11 @@ anchorePolicyEngine:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 4G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 1G
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -464,11 +464,11 @@ anchoreSimpleQueue:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 2Gi
|
||||
# memory: 256M
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -483,15 +483,12 @@ anchoreEnterpriseGlobal:
|
||||
# Create this secret with the following command - kubectl create secret generic anchore-license --from-file=license.yaml=<PATH TO LICENSE.YAML>
|
||||
licenseSecretName: anchore-enterprise-license
|
||||
|
||||
image: docker.io/anchore/enterprise:v0.6.2
|
||||
image: docker.io/anchore/enterprise:v2.3.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
# Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images.
|
||||
# Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username=<USERNAME> --docker-password=<PASSWORD> --docker-email=<EMAIL_ADDRESS>
|
||||
imagePullSecretName: anchore-enterprise-pullcreds
|
||||
|
||||
# Starting with chart v1.5.0 enterprise deployments use a different anchore-engine image then the OSS version.
|
||||
engineImage: docker.io/anchore/anchore-engine:v0.6.1
|
||||
|
||||
# Configure the second postgres database instance for the enterprise feeds service.
|
||||
# Only utilized if anchoreEnterpriseGlobal.enabled: true
|
||||
anchore-feeds-db:
|
||||
@@ -512,7 +509,7 @@ anchore-feeds-db:
|
||||
resourcePolicy: nil
|
||||
size: 20Gi
|
||||
|
||||
# If running operator on OpenShift - uncomment the image, imageTag & extraEnv values below.
|
||||
# If running on OpenShift - uncomment the image, imageTag & extraEnv values below.
|
||||
# image: registry.access.redhat.com/rhscl/postgresql-96-rhel7
|
||||
# imageTag: latest
|
||||
# extraEnv:
|
||||
@@ -534,6 +531,18 @@ anchoreEnterpriseFeeds:
|
||||
# If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance.
|
||||
enabled: true
|
||||
|
||||
# Enable github advisory feeds
|
||||
githubDriverEnabled: false
|
||||
# GitHub advisory feeds require a github developer personal access token with no permission scopes selected.
|
||||
githubDriverToken: null
|
||||
|
||||
# Enable microsoft feeds
|
||||
msrcDriverEnabled: false
|
||||
msrcApiKey: null
|
||||
# Uncomment to add MSRC product IDs for generating their feed data, this extends the pre-defined list of product IDs
|
||||
# msrcWhitelist:
|
||||
# - 12345
|
||||
|
||||
# Set extra environment variables. These will be set on all feeds containers.
|
||||
extraEnv: []
|
||||
# - name: foo
|
||||
@@ -563,11 +572,11 @@ anchoreEnterpriseFeeds:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 4G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# cpu: 1
|
||||
# memory: 2G
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -593,19 +602,19 @@ anchoreEnterpriseRbac:
|
||||
|
||||
# authResources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 256M
|
||||
|
||||
# managerResources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 256M
|
||||
|
||||
# Configure the Anchore Enterprise reporting component.
|
||||
anchoreEnterpriseReports:
|
||||
@@ -637,11 +646,11 @@ anchoreEnterpriseReports:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 256M
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -668,11 +677,11 @@ anchoreEnterpriseNotifications:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 256M
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -732,11 +741,11 @@ anchoreEnterpriseUi:
|
||||
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 8Gi
|
||||
# cpu: 1
|
||||
# memory: 1G
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 3Gi
|
||||
# memory: 256M
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
|
||||
Reference in New Issue
Block a user