mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Brady Todhunter
bd048b272a
* set rollingUpdate to null for helm 2 compatibility Signed-off-by: Brady Todhunter <bradyt@anchore.com> * pass /bin/bash -c to entrypoint to fix upgrade job failures Signed-off-by: Brady Todhunter <bradyt@anchore.com>
523 lines
19 KiB
YAML
523 lines
19 KiB
YAML
{{- $component := "api" -}}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ template "anchore-engine.api.fullname" . }}
|
|
labels:
|
|
app: {{ template "anchore-engine.fullname" . }}
|
|
component: {{ $component }}
|
|
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
|
release: {{ .Release.Name }}
|
|
heritage: {{ .Release.Service }}
|
|
{{- with .Values.anchoreApi.labels }}
|
|
{{ toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreGlobal.labels }}
|
|
{{ toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "anchore-engine.fullname" . }}
|
|
component: {{ $component }}
|
|
replicas: {{ .Values.anchoreApi.replicaCount }}
|
|
strategy:
|
|
type: Recreate
|
|
rollingUpdate: null
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ template "anchore-engine.fullname" . }}
|
|
component: {{ $component }}
|
|
{{- with .Values.anchoreApi.labels }}
|
|
{{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreGlobal.labels }}
|
|
{{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreApi.annotations }}
|
|
annotations:
|
|
{{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
|
imagePullSecrets:
|
|
- name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
|
|
{{- else }}
|
|
{{- with .Values.anchoreGlobal.imagePullSecretName }}
|
|
imagePullSecrets:
|
|
- name: {{ . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
containers:
|
|
{{- if .Values.cloudsql.enabled }}
|
|
- name: cloudsql-proxy
|
|
image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
|
|
imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
|
|
command: ["/cloud_sql_proxy"]
|
|
args:
|
|
- "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
|
|
{{- if .Values.cloudsql.useExistingServiceAcc }}
|
|
- "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
|
|
volumeMounts:
|
|
- mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
|
|
name: {{ .Values.cloudsql.serviceAccSecretName }}
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- end }}
|
|
- name: "{{ .Chart.Name }}-{{ $component }}"
|
|
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
|
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
|
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
|
{{- else }}
|
|
image: {{ .Values.anchoreGlobal.image }}
|
|
imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
|
|
{{- end }}
|
|
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
|
args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "apiext"]
|
|
{{- else }}
|
|
args: ["anchore-manager", "service", "start", "--no-auto-upgrade", "apiext"]
|
|
{{- end }}
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
|
- configMapRef:
|
|
name: {{ template "anchore-engine.fullname" . }}-env
|
|
env:
|
|
{{- with .Values.anchoreGlobal.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreApi.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
- name: ANCHORE_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: ANCHORE_CLI_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
|
key: ANCHORE_ADMIN_PASSWORD
|
|
ports:
|
|
- containerPort: {{ .Values.anchoreApi.service.port }}
|
|
name: external-api
|
|
volumeMounts:
|
|
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
|
|
- name: anchore-license
|
|
mountPath: /home/anchore/license.yaml
|
|
subPath: license.yaml
|
|
{{- end }}
|
|
- name: config-volume
|
|
mountPath: /config/config.yaml
|
|
subPath: config.yaml
|
|
{{- if .Values.anchoreGlobal.openShiftDeployment }}
|
|
- name: service-config-volume
|
|
mountPath: /anchore_service_config
|
|
- name: logs
|
|
mountPath: /var/log/anchore
|
|
- name: run
|
|
mountPath: /var/run/anchore
|
|
{{- end }}
|
|
{{- if (.Values.anchoreGlobal.certStoreSecretName) }}
|
|
- name: certs
|
|
mountPath: /home/anchore/certs/
|
|
readOnly: true
|
|
{{- end }}
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: external-api
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
initialDelaySeconds: 120
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: external-api
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
resources:
|
|
{{ toYaml .Values.anchoreApi.resources | nindent 10 }}
|
|
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
|
|
- name: {{ .Chart.Name }}-rbac-manager
|
|
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
|
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
|
args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "rbac_manager"]
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
|
- configMapRef:
|
|
name: {{ template "anchore-engine.fullname" . }}-env
|
|
env:
|
|
{{- with .Values.anchoreGlobal.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreEnterpriseRbac.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
- name: ANCHORE_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
ports:
|
|
- containerPort: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
|
name: rbac-manager
|
|
volumeMounts:
|
|
- name: anchore-license
|
|
mountPath: /home/anchore/license.yaml
|
|
subPath: license.yaml
|
|
- name: enterprise-config-volume
|
|
mountPath: /config/config.yaml
|
|
subPath: config.yaml
|
|
{{- if (.Values.anchoreGlobal.certStoreSecretName) }}
|
|
- name: certs
|
|
mountPath: /home/anchore/certs/
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.anchoreGlobal.openShiftDeployment }}
|
|
- name: service-config-volume
|
|
mountPath: /anchore_service_config
|
|
- name: logs
|
|
mountPath: /var/log/anchore
|
|
- name: run
|
|
mountPath: /var/run/anchore
|
|
{{- end }}
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: rbac-manager
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
initialDelaySeconds: 120
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: rbac-manager
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
resources:
|
|
{{ toYaml .Values.anchoreEnterpriseRbac.managerResources | nindent 10 }}
|
|
- name: {{ .Chart.Name }}-rbac-authorizer
|
|
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
|
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
|
args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "rbac_authorizer"]
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
|
|
- configMapRef:
|
|
name: {{ template "anchore-engine.fullname" . }}-env
|
|
env:
|
|
{{- with .Values.anchoreGlobal.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreEnterpriseRbac.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
- name: ANCHORE_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
ports:
|
|
- containerPort: {{ .Values.anchoreEnterpriseRbac.service.authPort }}
|
|
name: rbac-auth
|
|
volumeMounts:
|
|
- name: anchore-license
|
|
mountPath: /home/anchore/license.yaml
|
|
subPath: license.yaml
|
|
- name: enterprise-config-volume
|
|
mountPath: /config/config.yaml
|
|
subPath: config.yaml
|
|
{{- if (.Values.anchoreGlobal.certStoreSecretName) }}
|
|
- name: certs
|
|
mountPath: /home/anchore/certs/
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.anchoreGlobal.openShiftDeployment }}
|
|
- name: service-config-volume
|
|
mountPath: /anchore_service_config
|
|
- name: logs
|
|
mountPath: /var/log/anchore
|
|
- name: run
|
|
mountPath: /var/run/anchore
|
|
{{- end }}
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- curl
|
|
- -f
|
|
- 'localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}/health'
|
|
initialDelaySeconds: 120
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- curl
|
|
- -f
|
|
- 'localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}/health'
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
resources:
|
|
{{ toYaml .Values.anchoreEnterpriseRbac.authResources | nindent 10 }}
|
|
{{- end }}
|
|
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseReports.enabled }}
|
|
- name: "{{ .Chart.Name }}-reports"
|
|
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
|
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
|
args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "reports"]
|
|
ports:
|
|
- containerPort: {{ .Values.anchoreEnterpriseReports.service.port }}
|
|
name: reports-api
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ template "anchore-engine.fullname" . }}
|
|
- configMapRef:
|
|
name: {{ template "anchore-engine.fullname" . }}-env
|
|
env:
|
|
{{- with .Values.anchoreGlobal.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreEnterpriseReports.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
- name: ANCHORE_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
volumeMounts:
|
|
- name: enterprise-config-volume
|
|
mountPath: /config/config.yaml
|
|
subPath: config.yaml
|
|
- name: anchore-license
|
|
mountPath: /home/anchore/license.yaml
|
|
subPath: license.yaml
|
|
{{- if (.Values.anchoreGlobal.certStoreSecretName) }}
|
|
- name: certs
|
|
mountPath: /home/anchore/certs/
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.anchoreGlobal.openShiftDeployment }}
|
|
- name: service-config-volume
|
|
mountPath: /anchore_service_config
|
|
- name: logs
|
|
mountPath: /var/log/anchore
|
|
- name: run
|
|
mountPath: /var/run/anchore
|
|
{{- end }}
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: reports-api
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
initialDelaySeconds: 120
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: reports-api
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
resources:
|
|
{{ toYaml .Values.anchoreEnterpriseReports.resources | nindent 10 }}
|
|
{{- end }}
|
|
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
|
|
- name: "{{ .Chart.Name }}-notifications"
|
|
image: {{ .Values.anchoreEnterpriseGlobal.image }}
|
|
imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
|
|
args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "notifications"]
|
|
ports:
|
|
- containerPort: {{ .Values.anchoreEnterpriseNotifications.service.port }}
|
|
name: notifi-api
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ template "anchore-engine.fullname" . }}
|
|
- configMapRef:
|
|
name: {{ template "anchore-engine.fullname" . }}-env
|
|
env:
|
|
{{- with .Values.anchoreGlobal.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreEnterpriseNotifications.extraEnv }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
- name: ANCHORE_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
volumeMounts:
|
|
- name: enterprise-config-volume
|
|
mountPath: /config/config.yaml
|
|
subPath: config.yaml
|
|
- name: anchore-license
|
|
mountPath: /home/anchore/license.yaml
|
|
subPath: license.yaml
|
|
{{- if (.Values.anchoreGlobal.certStoreSecretName) }}
|
|
- name: certs
|
|
mountPath: /home/anchore/certs/
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.anchoreGlobal.openShiftDeployment }}
|
|
- name: service-config-volume
|
|
mountPath: /anchore_service_config
|
|
- name: logs
|
|
mountPath: /var/log/anchore
|
|
- name: run
|
|
mountPath: /var/run/anchore
|
|
{{- end }}
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: notifi-api
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
initialDelaySeconds: 120
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: notifi-api
|
|
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
timeoutSeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
resources:
|
|
{{ toYaml .Values.anchoreEnterpriseNotifications.resources | nindent 10 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: config-volume
|
|
configMap:
|
|
name: {{ template "anchore-engine.fullname" . }}
|
|
{{- if .Values.anchoreGlobal.openShiftDeployment }}
|
|
- name: service-config-volume
|
|
emptyDir: {}
|
|
- name: logs
|
|
emptyDir: {}
|
|
- name: run
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{ if and .Values.anchoreEnterpriseGlobal.enabled (or .Values.anchoreEnterpriseRbac.enabled .Values.anchoreEnterpriseReports.enabled) }}
|
|
- name: anchore-license
|
|
secret:
|
|
secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
|
|
- name: enterprise-config-volume
|
|
configMap:
|
|
name: {{ template "anchore-engine.enterprise.fullname" . }}
|
|
{{- end}}
|
|
{{- with .Values.anchoreGlobal.certStoreSecretName }}
|
|
- name: certs
|
|
secret:
|
|
secretName: {{ . }}
|
|
{{- end }}
|
|
{{- if .Values.cloudsql.useExistingServiceAcc }}
|
|
- name: {{ .Values.cloudsql.serviceAccSecretName }}
|
|
secret:
|
|
secretName: {{ .Values.cloudsql.serviceAccSecretName }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreApi.nodeSelector }}
|
|
nodeSelector:
|
|
{{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreApi.affinity }}
|
|
affinity:
|
|
{{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreApi.tolerations }}
|
|
tolerations:
|
|
{{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ template "anchore-engine.api.fullname" . }}
|
|
labels:
|
|
app: {{ template "anchore-engine.fullname" . }}
|
|
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
|
release: {{ .Release.Name }}
|
|
heritage: {{ .Release.Service }}
|
|
component: {{ $component }}
|
|
{{- with .Values.anchoreApi.service.labels }}
|
|
{{ toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreGlobal.labels }}
|
|
{{ toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- with .Values.anchoreApi.service.annotations }}
|
|
annotations:
|
|
{{ toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
type: {{ .Values.anchoreApi.service.type }}
|
|
ports:
|
|
- name: anchore-external-api
|
|
port: {{ .Values.anchoreApi.service.port }}
|
|
targetPort: {{ .Values.anchoreApi.service.port }}
|
|
protocol: TCP
|
|
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
|
|
- name: anchore-rbac-manager
|
|
port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
|
targetPort: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseReports.enabled }}
|
|
- name: reports-api
|
|
port: {{ .Values.anchoreEnterpriseReports.service.port }}
|
|
targetPort: {{ .Values.anchoreEnterpriseReports.service.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
|
|
- name: notifi-api
|
|
port: {{ .Values.anchoreEnterpriseNotifications.service.port }}
|
|
targetPort: {{ .Values.anchoreEnterpriseNotifications.service.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
selector:
|
|
app: {{ template "anchore-engine.fullname" . }}
|
|
component: {{ $component }}
|