From f31183bd57c370d1323ee564aeb48c02b7214ccc Mon Sep 17 00:00:00 2001 From: Brady Todhunter Date: Tue, 28 Apr 2020 23:26:25 -0700 Subject: [PATCH] Update to enterprise v2.3.0 & engine v0.7.1 (#22173) add pre-upgrade hook for updating DB Use enterprise image, pullPolicy & imagePullSecret when appropriate Use recreate deployment strategy for upgrade hook add global timeout to engine & enterprise add license to engine components when enterprise is enabled add license to engine configmap for enterprise installs use anchore-enterprise-manager for all services when enterprise is enabled update README Signed-off-by: Brady Todhunter --- stable/anchore-engine/Chart.yaml | 4 +- stable/anchore-engine/README.md | 37 ++++---- .../templates/analyzer_deployment.yaml | 28 +++++- .../templates/api_deployment.yaml | 32 +++++-- .../templates/catalog_deployment.yaml | 28 +++++- .../templates/engine_configmap.yaml | 14 +++ .../templates/engine_upgrade_job.yaml | 58 ++++++++++++ .../templates/enterprise_configmap.yaml | 4 + .../templates/enterprise_feeds_configmap.yaml | 14 +++ .../enterprise_feeds_deployment.yaml | 4 +- .../templates/enterprise_ui_deployment.yaml | 2 + .../templates/enterprise_upgrade_job.yaml | 48 ++++++++++ .../templates/policy_engine_deployment.yaml | 30 +++++- .../templates/simplequeue_deployment.yaml | 28 +++++- stable/anchore-engine/values.yaml | 93 ++++++++++--------- 15 files changed, 341 insertions(+), 83 deletions(-) create mode 100644 stable/anchore-engine/templates/engine_upgrade_job.yaml create mode 100644 stable/anchore-engine/templates/enterprise_upgrade_job.yaml diff --git a/stable/anchore-engine/Chart.yaml b/stable/anchore-engine/Chart.yaml index 6d026bea93..66fe4c9c36 100644 --- a/stable/anchore-engine/Chart.yaml +++ b/stable/anchore-engine/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: anchore-engine -version: 1.5.2 -appVersion: 0.7.0 +version: 1.6.0 +appVersion: 0.7.1 description: Anchore container analysis and policy evaluation engine service keywords: - analysis diff --git a/stable/anchore-engine/README.md b/stable/anchore-engine/README.md index 5693b8e155..af251ed9af 100644 --- a/stable/anchore-engine/README.md +++ b/stable/anchore-engine/README.md @@ -27,9 +27,6 @@ The recommended way to install the Anchore Engine Helm Chart is with a customize Create a new file named `anchore_values.yaml` and add all desired custom values (examples below); then run the following command: - #### Helm v2 installation - `helm install --name -f anchore_values.yaml stable/anchore-engine` - #### Helm v3 installation `helm repo add stable https://kubernetes-charts.storage.googleapis.com` @@ -59,8 +56,10 @@ anchoreGlobal: * Graphical user interface * Customizable UI dashboards * On-premises feeds service - * Proprietary vulnerability data feed + * Proprietary vulnerability data feed (vulnDB, MSRC) * Anchore reporting API + * Notifications - Slack, GitHub, Jira, etc + * Microsoft image vulnerability scanning ### Enabling Enterprise Services Enterprise services require an Anchore Enterprise license, as well as credentials with @@ -77,19 +76,12 @@ To use this Helm chart with the enterprise services enabled, perform these steps `kubectl create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username= --docker-password= --docker-email=` 1. (demo) Install the Helm chart using default values - #### Helm v2 installation - `helm install --name --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine` - #### Helm v3 installation `helm repo add stable https://kubernetes-charts.storage.googleapis.com` - `helm install --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine` + `helm install --set anchoreEnterpriseGlobal.enabled=true stable/anchore-engine` 2. (production) Install the Helm chart using a custom anchore_values.yaml file - *see examples below* - - #### Helm v2 installation - `helm install --name -f anchore_values.yaml stable/anchore-engine` - #### Helm v3 installation `helm repo add stable https://kubernetes-charts.storage.googleapis.com` @@ -215,6 +207,21 @@ anchore-feeds-db: anchore-ui-redis: password: ``` +# Chart Updates +See the anchore-engine [CHANGELOG](https://github.com/anchore/anchore-engine/blob/master/CHANGELOG.md) for updates to anchore engine. + +## Upgrading from previous chart versions +A Helm post-upgrade hook job has been added starting with Chart version 1.6.0 - this job will shut down all previously running Anchore services and perform the Anchore DB upgrade process using a kubernetes job. The upgrade will only be considered successful when this job completes successfully. Performing an update after v1.6.0 will cause the Helm client to block until the upgrade job completes and the new Anchore service pods are started. To view progress of the upgrade process, tail the logs of the upgrade jobs `anchore-engine-upgrade` and `anchore-enterprise-upgrade`. These job resources will be removed upon a successful helm upgrade. + +## Chart version 1.6.0 +Changes with this version include: + * Anchore database upgrades will now be handled using a helm post-upgrade hook job + * Anchore Engine image updated to v0.7.1 + * Anchore Enterprise updated to v2.3.0 - see [CHANGELOG](https://docs.anchore.com/current/docs/releasenotes/230/) + * Enterprise deployments now use the `anchore/enterprise` image for all components + * Added GitHub advisory feeds + * Added NuGet .NET feeds to Enterprise feed service + * Updated resources to provide better minimum requirements baseline (these are still not production ready) ## Chart version 1.5.0 Changes to the Helm Chart include: @@ -223,8 +230,6 @@ Changes to the Helm Chart include: * Default feed sync timeout increased to 180s * Added a optional configuration for including imagePullSecret on all anchore-engine images - .Values.anchoreGlobal.imagePullSecretName -See the anchore-engine [CHANGELOG](https://github.com/anchore/anchore-engine/blob/master/CHANGELOG.md#070-2020-03-26) for updates to anchore engine - ## Chart version 1.4.0 The following features were added with this chart version: * Enterprise notifications service @@ -366,11 +371,11 @@ Engine DB Version: 0.0.8 Engine Code Version: 0.3.0 ``` -## Configuration +# Configuration All configurations should be appended to your custom `anchore_values.yaml` file and utilized when installing the chart. While the configuration options of Anchore Engine are extensive, the options provided by the chart are: -### Exposing the service outside the cluster: +## Exposing the service outside the cluster: #### Using Ingress diff --git a/stable/anchore-engine/templates/analyzer_deployment.yaml b/stable/anchore-engine/templates/analyzer_deployment.yaml index 51c868ac8e..c0b9cec113 100644 --- a/stable/anchore-engine/templates/analyzer_deployment.yaml +++ b/stable/anchore-engine/templates/analyzer_deployment.yaml @@ -21,6 +21,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: {{ .Values.anchoreAnalyzer.replicaCount }} + strategy: + type: Recreate template: metadata: labels: @@ -40,10 +42,15 @@ spec: securityContext: runAsUser: 1000 runAsGroup: 1000 + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + imagePullSecrets: + - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + {{- else }} {{- with .Values.anchoreGlobal.imagePullSecretName }} imagePullSecrets: - name: {{ . }} {{- end }} + {{- end }} containers: {{- if .Values.cloudsql.enabled }} - name: cloudsql-proxy @@ -62,13 +69,18 @@ spec: {{- end }} - name: {{ .Chart.Name }}-{{ $component }} {{- if .Values.anchoreEnterpriseGlobal.enabled }} - image: {{ .Values.anchoreEnterpriseGlobal.engineImage }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} {{- else }} image: {{ .Values.anchoreGlobal.image }} - {{- end }} imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }} + {{- end }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + command: ["anchore-enterprise-manager"] + {{- else }} command: ["anchore-manager"] - args: ["service", "start", "analyzer"] + {{- end }} + args: ["service", "start", "--no-auto-upgrade", "analyzer"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -89,6 +101,11 @@ spec: - name: analyzer-api containerPort: {{ .Values.anchoreAnalyzer.containerPort }} volumeMounts: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + mountPath: /home/anchore/license.yaml + subPath: license.yaml + {{- end }} - name: analyzer-config-volume mountPath: /anchore_service/analyzer_config.yaml subPath: analyzer_config.yaml @@ -136,6 +153,11 @@ spec: resources: {{ toYaml .Values.anchoreAnalyzer.resources | nindent 10 }} volumes: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + secret: + secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }} + {{- end }} - name: config-volume configMap: name: {{ template "anchore-engine.fullname" .}} diff --git a/stable/anchore-engine/templates/api_deployment.yaml b/stable/anchore-engine/templates/api_deployment.yaml index 1446a5bbbb..1df8aaa34c 100644 --- a/stable/anchore-engine/templates/api_deployment.yaml +++ b/stable/anchore-engine/templates/api_deployment.yaml @@ -21,6 +21,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: {{ .Values.anchoreApi.replicaCount }} + strategy: + type: Recreate template: metadata: labels: @@ -40,13 +42,15 @@ spec: securityContext: runAsUser: 1000 runAsGroup: 1000 - {{ if and .Values.anchoreEnterpriseGlobal.enabled (or .Values.anchoreEnterpriseRbac.enabled .Values.anchoreEnterpriseReports.enabled) }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} imagePullSecrets: - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + {{- else }} {{- with .Values.anchoreGlobal.imagePullSecretName }} + imagePullSecrets: - name: {{ . }} {{- end }} - {{- end }} + {{- end }} containers: {{- if .Values.cloudsql.enabled }} - name: cloudsql-proxy @@ -65,13 +69,18 @@ spec: {{- end }} - name: "{{ .Chart.Name }}-{{ $component }}" {{- if .Values.anchoreEnterpriseGlobal.enabled }} - image: {{ .Values.anchoreEnterpriseGlobal.engineImage }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} {{- else }} image: {{ .Values.anchoreGlobal.image }} - {{- end }} imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }} + {{- end }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + command: ["anchore-enterprise-manager"] + {{- else }} command: ["anchore-manager"] - args: ["service", "start", "apiext"] + {{- end }} + args: ["service", "start", "--no-auto-upgrade", "apiext"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -97,6 +106,11 @@ spec: - containerPort: {{ .Values.anchoreApi.service.port }} name: external-api volumeMounts: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + mountPath: /home/anchore/license.yaml + subPath: license.yaml + {{- end }} - name: config-volume mountPath: /config/config.yaml subPath: config.yaml @@ -143,7 +157,7 @@ spec: image: {{ .Values.anchoreEnterpriseGlobal.image }} imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} command: ["anchore-enterprise-manager"] - args: ["service", "start", "rbac_manager"] + args: ["service", "start", "--no-auto-upgrade", "rbac_manager"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -212,7 +226,7 @@ spec: image: {{ .Values.anchoreEnterpriseGlobal.image }} imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} command: ["anchore-enterprise-manager"] - args: ["service", "start", "rbac_authorizer"] + args: ["service", "start", "--no-auto-upgrade", "rbac_authorizer"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -281,7 +295,7 @@ spec: image: {{ .Values.anchoreEnterpriseGlobal.image }} imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} command: ["anchore-enterprise-manager"] - args: ["service", "start", "reports"] + args: ["service", "start", "--no-auto-upgrade", "reports"] ports: - containerPort: {{ .Values.anchoreEnterpriseReports.service.port }} name: reports-api @@ -352,7 +366,7 @@ spec: image: {{ .Values.anchoreEnterpriseGlobal.image }} imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} command: ["anchore-enterprise-manager"] - args: ["service", "start", "notifications"] + args: ["service", "start", "--no-auto-upgrade", "notifications"] ports: - containerPort: {{ .Values.anchoreEnterpriseNotifications.service.port }} name: notifi-api diff --git a/stable/anchore-engine/templates/catalog_deployment.yaml b/stable/anchore-engine/templates/catalog_deployment.yaml index 9a34f83a38..a999a92864 100644 --- a/stable/anchore-engine/templates/catalog_deployment.yaml +++ b/stable/anchore-engine/templates/catalog_deployment.yaml @@ -21,6 +21,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: {{ .Values.anchoreCatalog.replicaCount }} + strategy: + type: Recreate template: metadata: labels: @@ -40,10 +42,15 @@ spec: securityContext: runAsUser: 1000 runAsGroup: 1000 + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + imagePullSecrets: + - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + {{- else }} {{- with .Values.anchoreGlobal.imagePullSecretName }} imagePullSecrets: - name: {{ . }} {{- end }} + {{- end }} containers: {{- if .Values.cloudsql.enabled }} - name: cloudsql-proxy @@ -62,13 +69,18 @@ spec: {{- end }} - name: {{ .Chart.Name }}-{{ $component }} {{- if .Values.anchoreEnterpriseGlobal.enabled }} - image: {{ .Values.anchoreEnterpriseGlobal.engineImage }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} {{- else }} image: {{ .Values.anchoreGlobal.image }} - {{- end }} imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }} + {{- end }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + command: ["anchore-enterprise-manager"] + {{- else }} command: ["anchore-manager"] - args: ["service", "start", "catalog"] + {{- end }} + args: ["service", "start", "--no-auto-upgrade", "catalog"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -89,6 +101,11 @@ spec: - name: catalog containerPort: {{ .Values.anchoreCatalog.service.port }} volumeMounts: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + mountPath: /home/anchore/license.yaml + subPath: license.yaml + {{- end }} - name: config-volume mountPath: /config/config.yaml subPath: config.yaml @@ -131,6 +148,11 @@ spec: resources: {{ toYaml .Values.anchoreCatalog.resources | nindent 10 }} volumes: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + secret: + secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }} + {{- end }} - name: config-volume configMap: name: {{ template "anchore-engine.fullname" . }} diff --git a/stable/anchore-engine/templates/engine_configmap.yaml b/stable/anchore-engine/templates/engine_configmap.yaml index 213a75df8c..5e6681b8ec 100644 --- a/stable/anchore-engine/templates/engine_configmap.yaml +++ b/stable/anchore-engine/templates/engine_configmap.yaml @@ -22,6 +22,14 @@ data: host_id: "${ANCHORE_POD_NAME}" internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }} auto_restart_services: false + + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + license_file: /home/anchore/license.yaml + {{- end }} + + global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }} + global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }} + metrics: enabled: {{ .Values.anchoreGlobal.enableMetrics }} auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }} @@ -55,9 +63,15 @@ data: # anchore support for finding out more about this service {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }} vulndb: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }} + # Enabling microsoft syncs MSRC data from an on-premise anchore enterprise feeds service. Please contact + # anchore support for finding out more about this service + microsoft: {{ .Values.anchoreEnterpriseFeeds.microsoftDriverEnabled }} {{- else }} vulndb: false + microsoft: false {{- end }} + # Sync github data if available for GHSA matches + github: {{ default "true" .Values.anchoreGlobal.syncGithub }} {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }} {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }} url: "https://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds" diff --git a/stable/anchore-engine/templates/engine_upgrade_job.yaml b/stable/anchore-engine/templates/engine_upgrade_job.yaml new file mode 100644 index 0000000000..1f6e46f972 --- /dev/null +++ b/stable/anchore-engine/templates/engine_upgrade_job.yaml @@ -0,0 +1,58 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: "{{ .Release.Name }}-engine-upgrade" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": post-upgrade + "helm.sh/hook-weight": "-5" +spec: + template: + metadata: + name: "{{ .Release.Name }}-engine-upgrade" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + spec: + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + imagePullSecrets: + - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + {{- else }} + {{- with .Values.anchoreGlobal.imagePullSecretName }} + imagePullSecrets: + - name: {{ . }} + {{- end }} + {{- end }} + restartPolicy: Never + containers: + - name: "{{ .Release.Name }}-enterprise-upgrade" + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} + {{- else }} + image: {{ .Values.anchoreGlobal.image }} + imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }} + {{- end }} + command: ["/bin/bash", "-c"] + {{- if .Values.anchoreGlobal.dbConfig.ssl }} + args: ["anchore-manager db --db-use-ssl --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}} upgrade --dontask"] + {{- else }} + args: ["anchore-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask"] + {{- end }} + envFrom: + - secretRef: + name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} + - configMapRef: + name: {{ template "anchore-engine.fullname" . }}-env + env: + {{- with .Values.anchoreGlobal.extraEnv }} + {{- toYaml . | nindent 8 }} + {{- end }} \ No newline at end of file diff --git a/stable/anchore-engine/templates/enterprise_configmap.yaml b/stable/anchore-engine/templates/enterprise_configmap.yaml index 41c2a54044..c6f80e5e2a 100644 --- a/stable/anchore-engine/templates/enterprise_configmap.yaml +++ b/stable/anchore-engine/templates/enterprise_configmap.yaml @@ -31,8 +31,12 @@ data: auto_restart_services: false license_file: /home/anchore/license.yaml + global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }} + global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }} + metrics: enabled: {{ .Values.anchoreGlobal.enableMetrics }} + auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }} # Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs. diff --git a/stable/anchore-engine/templates/enterprise_feeds_configmap.yaml b/stable/anchore-engine/templates/enterprise_feeds_configmap.yaml index e010c0f59e..fa0b1e7c30 100644 --- a/stable/anchore-engine/templates/enterprise_feeds_configmap.yaml +++ b/stable/anchore-engine/templates/enterprise_feeds_configmap.yaml @@ -97,12 +97,16 @@ data: # To enable gem driver comment the enabled property and uncomment the db_connect property. enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.gemDriverEnabled }} db_connect: {{ default "'postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/gems'" .Values.anchoreEnterpriseFeeds.gemDbEndpoint }} + amzn: + enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.amazonDriverEnabled }} centos: enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.centosDriverEnabled }} debian: enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.debianDriverEnabled }} ubuntu: enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.ubuntuDriverEnabled }} + rhel: + enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.rhelDriverEnabled }} ol: enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.olDriverEnabled }} alpine: @@ -115,6 +119,16 @@ data: enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.nvdv2DriverEnabled }} vulndb: enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }} + msrc: + enabled: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }} + api_key: {{ .Values.anchoreEnterpriseFeeds.msrcApiKey }} + {{- with .Values.anchoreEnterpriseFeeds.msrcWhitelist }} + whitelist: + - {{ . }} + {{- end }} + github: + enabled: {{ .Values.anchoreEnterpriseFeeds.githubDriverEnabled }} + token: {{ .Values.anchoreEnterpriseFeeds.githubDriverToken }} {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }} ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }} ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}" diff --git a/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml b/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml index d5e0b882ad..db4b9db501 100644 --- a/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml +++ b/stable/anchore-engine/templates/enterprise_feeds_deployment.yaml @@ -22,6 +22,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: 1 + strategy: + type: Recreate template: metadata: labels: @@ -63,7 +65,7 @@ spec: image: {{ .Values.anchoreEnterpriseGlobal.image }} imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} command: ["anchore-enterprise-manager"] - args: ["service", "start", "feeds"] + args: ["service", "start", "--no-auto-upgrade", "feeds"] ports: - containerPort: {{ .Values.anchoreEnterpriseFeeds.service.port }} name: feeds-api diff --git a/stable/anchore-engine/templates/enterprise_ui_deployment.yaml b/stable/anchore-engine/templates/enterprise_ui_deployment.yaml index 2fd8f6bda0..69613bb543 100644 --- a/stable/anchore-engine/templates/enterprise_ui_deployment.yaml +++ b/stable/anchore-engine/templates/enterprise_ui_deployment.yaml @@ -23,6 +23,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: 1 + strategy: + type: Recreate template: metadata: labels: diff --git a/stable/anchore-engine/templates/enterprise_upgrade_job.yaml b/stable/anchore-engine/templates/enterprise_upgrade_job.yaml new file mode 100644 index 0000000000..ef1d33c90d --- /dev/null +++ b/stable/anchore-engine/templates/enterprise_upgrade_job.yaml @@ -0,0 +1,48 @@ +{{- if .Values.anchoreEnterpriseGlobal.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: "{{ .Release.Name }}-enterprise-upgrade" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": post-upgrade + "helm.sh/hook-weight": "-3" +spec: + template: + metadata: + name: "{{ .Release.Name }}-enterprise-upgrade" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + spec: + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + imagePullSecrets: + - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + restartPolicy: Never + containers: + - name: "{{ .Release.Name }}-enterprise-upgrade" + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + command: ["/bin/bash", "-c"] + {{- if .Values.anchoreGlobal.dbConfig.ssl }} + args: ["anchore-enterprise-manager db --db-use-ssl --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}} upgrade --dontask"] + {{- else }} + args: ["anchore-enterprise-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask"] + {{- end }} + envFrom: + - secretRef: + name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} + - configMapRef: + name: {{ template "anchore-engine.fullname" . }}-env + env: + {{- with .Values.anchoreGlobal.extraEnv }} + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/stable/anchore-engine/templates/policy_engine_deployment.yaml b/stable/anchore-engine/templates/policy_engine_deployment.yaml index 0e2b248cbd..e454d621cf 100644 --- a/stable/anchore-engine/templates/policy_engine_deployment.yaml +++ b/stable/anchore-engine/templates/policy_engine_deployment.yaml @@ -21,6 +21,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: {{ .Values.anchorePolicyEngine.replicaCount }} + strategy: + type: Recreate template: metadata: labels: @@ -40,10 +42,15 @@ spec: securityContext: runAsUser: 1000 runAsGroup: 1000 + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + imagePullSecrets: + - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + {{- else }} {{- with .Values.anchoreGlobal.imagePullSecretName }} imagePullSecrets: - name: {{ . }} {{- end }} + {{- end }} containers: {{- if .Values.cloudsql.enabled }} - name: cloudsql-proxy @@ -62,13 +69,18 @@ spec: {{- end }} - name: {{ .Chart.Name }}-{{ $component }} {{- if .Values.anchoreEnterpriseGlobal.enabled }} - image: {{ .Values.anchoreEnterpriseGlobal.engineImage }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} {{- else }} image: {{ .Values.anchoreGlobal.image }} - {{- end }} imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }} + {{- end }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + command: ["anchore-enterprise-manager"] + {{- else }} command: ["anchore-manager"] - args: ["service", "start", "policy_engine"] + {{- end }} + args: ["service", "start", "--no-auto-upgrade", "policy_engine"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -89,6 +101,11 @@ spec: - name: policy containerPort: {{ .Values.anchorePolicyEngine.service.port }} volumeMounts: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + mountPath: /home/anchore/license.yaml + subPath: license.yaml + {{- end }} - name: config-volume mountPath: /config/config.yaml subPath: config.yaml @@ -133,6 +150,11 @@ spec: resources: {{ toYaml .Values.anchorePolicyEngine.resources | nindent 10 }} volumes: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + secret: + secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }} + {{- end }} - name: config-volume configMap: name: {{ template "anchore-engine.fullname" . }} @@ -199,4 +221,4 @@ spec: protocol: TCP selector: app: {{ template "anchore-engine.fullname" . }} - component: {{ $component }} + component: {{ $component }} \ No newline at end of file diff --git a/stable/anchore-engine/templates/simplequeue_deployment.yaml b/stable/anchore-engine/templates/simplequeue_deployment.yaml index 84578a8b73..2b3906792e 100644 --- a/stable/anchore-engine/templates/simplequeue_deployment.yaml +++ b/stable/anchore-engine/templates/simplequeue_deployment.yaml @@ -21,6 +21,8 @@ spec: app: {{ template "anchore-engine.fullname" . }} component: {{ $component }} replicas: {{ .Values.anchoreSimpleQueue.replicaCount }} + strategy: + type: Recreate template: metadata: labels: @@ -40,10 +42,15 @@ spec: securityContext: runAsUser: 1000 runAsGroup: 1000 + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + imagePullSecrets: + - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }} + {{- else }} {{- with .Values.anchoreGlobal.imagePullSecretName }} imagePullSecrets: - name: {{ . }} {{- end }} + {{- end }} containers: {{- if .Values.cloudsql.enabled }} - name: cloudsql-proxy @@ -62,13 +69,18 @@ spec: {{- end }} - name: "{{ .Chart.Name }}-{{ $component }}" {{- if .Values.anchoreEnterpriseGlobal.enabled }} - image: {{ .Values.anchoreEnterpriseGlobal.engineImage }} + image: {{ .Values.anchoreEnterpriseGlobal.image }} + imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }} {{- else }} image: {{ .Values.anchoreGlobal.image }} - {{- end }} imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }} + {{- end }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + command: ["anchore-enterprise-manager"] + {{- else }} command: ["anchore-manager"] - args: ["service", "start", "simplequeue"] + {{- end }} + args: ["service", "start", "--no-auto-upgrade", "simplequeue"] envFrom: - secretRef: name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }} @@ -89,6 +101,11 @@ spec: - name: simplequeue containerPort: {{ .Values.anchoreSimpleQueue.service.port }} volumeMounts: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + mountPath: /home/anchore/license.yaml + subPath: license.yaml + {{- end }} - name: config-volume mountPath: /config/config.yaml subPath: config.yaml @@ -131,6 +148,11 @@ spec: resources: {{ toYaml .Values.anchoreSimpleQueue.resources | nindent 10 }} volumes: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - name: anchore-license + secret: + secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }} + {{- end }} - name: config-volume configMap: name: {{ template "anchore-engine.fullname" .}} diff --git a/stable/anchore-engine/values.yaml b/stable/anchore-engine/values.yaml index 2f9f89114d..12959a793a 100644 --- a/stable/anchore-engine/values.yaml +++ b/stable/anchore-engine/values.yaml @@ -19,7 +19,7 @@ postgresql: resourcePolicy: nil size: 20Gi - # If running operator on OpenShift - uncomment the image, imageTag & extraEnv values below. + # If running on OpenShift - uncomment the image, imageTag & extraEnv values below. # image: registry.access.redhat.com/rhscl/postgresql-96-rhel7 # imageTag: latest # extraEnv: @@ -90,7 +90,7 @@ ingress: # Global configuration shared by all anchore-engine services. anchoreGlobal: # Image used for all anchore engine deployments (excluding enterprise components). - image: docker.io/anchore/anchore-engine:v0.7.0 + image: docker.io/anchore/anchore-engine:v0.7.1 imagePullPolicy: IfNotPresent # Set image pull secret name if using an anchore-engine image from a private registry imagePullSecretName: @@ -257,11 +257,11 @@ anchoreAnalyzer: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 4G # requests: - # cpu: 100m - # memory: 3Gi + # cpu: 1 + # memory: 1G labels: {} annotations: {} @@ -294,11 +294,11 @@ anchoreApi: # resources: # limits: - # cpu: 100m - # memory: 6Gi + # cpu: 1 + # memory: 4G # requests: # cpu: 100m - # memory: 4Gi + # memory: 1G labels: {} annotations: {} @@ -397,11 +397,11 @@ anchoreCatalog: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 2G # requests: # cpu: 100m - # memory: 3Gi + # memory: 500M labels: {} annotations: {} @@ -434,11 +434,11 @@ anchorePolicyEngine: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 4G # requests: # cpu: 100m - # memory: 3Gi + # memory: 1G labels: {} annotations: {} @@ -464,11 +464,11 @@ anchoreSimpleQueue: # resources: # limits: - # cpu: 100m - # memory: 3Gi + # cpu: 1 + # memory: 1G # requests: # cpu: 100m - # memory: 2Gi + # memory: 256M labels: {} annotations: {} @@ -483,15 +483,12 @@ anchoreEnterpriseGlobal: # Create this secret with the following command - kubectl create secret generic anchore-license --from-file=license.yaml= licenseSecretName: anchore-enterprise-license - image: docker.io/anchore/enterprise:v0.6.2 + image: docker.io/anchore/enterprise:v2.3.0 imagePullPolicy: IfNotPresent # Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images. # Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username= --docker-password= --docker-email= imagePullSecretName: anchore-enterprise-pullcreds - # Starting with chart v1.5.0 enterprise deployments use a different anchore-engine image then the OSS version. - engineImage: docker.io/anchore/anchore-engine:v0.6.1 - # Configure the second postgres database instance for the enterprise feeds service. # Only utilized if anchoreEnterpriseGlobal.enabled: true anchore-feeds-db: @@ -512,7 +509,7 @@ anchore-feeds-db: resourcePolicy: nil size: 20Gi - # If running operator on OpenShift - uncomment the image, imageTag & extraEnv values below. + # If running on OpenShift - uncomment the image, imageTag & extraEnv values below. # image: registry.access.redhat.com/rhscl/postgresql-96-rhel7 # imageTag: latest # extraEnv: @@ -534,6 +531,18 @@ anchoreEnterpriseFeeds: # If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance. enabled: true + # Enable github advisory feeds + githubDriverEnabled: false + # GitHub advisory feeds require a github developer personal access token with no permission scopes selected. + githubDriverToken: null + + # Enable microsoft feeds + msrcDriverEnabled: false + msrcApiKey: null + # Uncomment to add MSRC product IDs for generating their feed data, this extends the pre-defined list of product IDs + # msrcWhitelist: + # - 12345 + # Set extra environment variables. These will be set on all feeds containers. extraEnv: [] # - name: foo @@ -563,11 +572,11 @@ anchoreEnterpriseFeeds: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 4G # requests: - # cpu: 100m - # memory: 3Gi + # cpu: 1 + # memory: 2G labels: {} annotations: {} @@ -593,19 +602,19 @@ anchoreEnterpriseRbac: # authResources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 1G # requests: # cpu: 100m - # memory: 3Gi + # memory: 256M # managerResources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 1G # requests: # cpu: 100m - # memory: 3Gi + # memory: 256M # Configure the Anchore Enterprise reporting component. anchoreEnterpriseReports: @@ -637,11 +646,11 @@ anchoreEnterpriseReports: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 1G # requests: # cpu: 100m - # memory: 3Gi + # memory: 256M labels: {} annotations: {} @@ -668,11 +677,11 @@ anchoreEnterpriseNotifications: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 1G # requests: # cpu: 100m - # memory: 3Gi + # memory: 256M labels: {} annotations: {} @@ -732,11 +741,11 @@ anchoreEnterpriseUi: # resources: # limits: - # cpu: 100m - # memory: 8Gi + # cpu: 1 + # memory: 1G # requests: # cpu: 100m - # memory: 3Gi + # memory: 256M labels: {} annotations: {}