github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
deprecated-helm-charts/stable/anchore-engine/templates/engine_configmap.yaml
T
Brady Todhunter e2b517b7f7 fix msrc feeds value (#22746) 
Signed-off-by: Brady Todhunter <bradyt@anchore.com>
2020-06-12 15:51:57 -07:00

238 lines
13 KiB
YAML
Raw Permalink Blame History

kind: ConfigMap
apiVersion: v1
metadata:
name: {{ template "anchore-engine.fullname" . }}
labels:
app: {{ template "anchore-engine.fullname" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- with .Values.anchoreGlobal.labels }}
{{ toYaml . | nindent 4 }}
{{- end }}
data:
config.yaml: |
# Anchore Service Configuration File from ConfigMap
service_dir: {{ .Values.anchoreGlobal.serviceDir }}
tmp_dir: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
log_level: {{ .Values.anchoreGlobal.logLevel }}
image_analyze_timeout_seconds: {{ .Values.anchoreGlobal.imageAnalyzeTimeoutSeconds }}
cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
host_id: "${ANCHORE_POD_NAME}"
internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
auto_restart_services: false
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
license_file: /home/anchore/license.yaml
{{- end }}
global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }}
global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }}
metrics:
enabled: {{ .Values.anchoreGlobal.enableMetrics }}
auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }}
{{ if .Values.anchoreGlobal.webhooksEnabled }}
webhooks:
{{- toYaml .Values.anchoreGlobal.webhooks | nindent 6 }}
{{ end }}
# Configure what feeds to sync.
# The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
feeds:
sync_enabled: true
selective_sync:
# If enabled only sync specific feeds instead of all that are found.
enabled: true
feeds:
{{- if not .Values.anchoreEnterpriseGlobal.enabled }}
github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
{{- end }}
# Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
vulnerabilities: {{ default "true" .Values.anchoreGlobal.syncVulnerabilites }}
# NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
nvdv2: {{ default "true" .Values.anchoreGlobal.syncNvd }}
# Warning: enabling the package sync causes the service to require much
# more memory to do process the significant data volume. We recommend at least 4GB available for the container
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
packages: true
{{- else }}
packages: {{ default "false" .Values.anchoreGlobal.syncPackages }}
{{- end }}
# Enabling vulndb syncs vulndb vulnerability data from an on-premise anchore enterprise feeds service. Please contact
# anchore support for finding out more about this service
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
vulndb: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
# Enabling microsoft syncs MSRC data from an on-premise anchore enterprise feeds service. Please contact
# anchore support for finding out more about this service
microsoft: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }}
{{- else }}
vulndb: false
microsoft: false
{{- end }}
# Sync github data if available for GHSA matches
github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
url: "https://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
{{- else }}
url: "http://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
{{- end }}
ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
client_url:
token_url:
{{- else }}
client_url: "https://ancho.re/v1/account/users"
token_url: "https://ancho.re/oauth/token"
anonymous_user_username: anon@ancho.re
anonymous_user_password: pbiU2RYZ2XrmYQ
{{- end }}
connection_timeout_seconds: {{ default 3 .Values.anchoreGlobal.feedsConnectionTimeout }}
read_timeout_seconds: {{ default 180 .Values.anchoreGlobal.feedsReadTimeout }}
default_admin_password: ${ANCHORE_ADMIN_PASSWORD}
default_admin_email: {{ .Values.anchoreGlobal.defaultAdminEmail }}
# Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
# Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
keys:
secret: {{ .Values.anchoreGlobal.saml.secret }}
{{- with .Values.anchoreGlobal.saml.publicKeyName }}
public_key_path: /home/anchore/certs/{{- . }}
{{- end }}
{{- with .Values.anchoreGlobal.saml.privateKeyName }}
private_key_path: /home/anchore/certs/{{- . }}
{{- end }}
# Configuring supported user authentication and credential management
user_authentication:
oauth:
enabled: {{ .Values.anchoreGlobal.oauthEnabled }}
default_token_expiration_seconds: {{ .Values.anchoreGlobal.oauthTokenExpirationSeconds }}
# Set this to True to enable storing user passwords only as secure hashes in the db. This can dramatically increase CPU usage if you
# don't also use oauth and tokens for internal communications (which requires keys/secret to be configured as well)
# WARNING: you should not change this after a system has been initialized as it may cause a mismatch in existing passwords
hashed_passwords: {{ .Values.anchoreGlobal.hashedPasswords }}
credentials:
database:
{{- if .Values.anchoreGlobal.dbConfig.ssl }}
db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}}"
{{- else }}
db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
{{- end }}
db_connect_args:
timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
ssl: false
db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolMaxOverflow }}
services:
apiext:
enabled: true
require_auth: true
endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
listen: 0.0.0.0
port: {{ .Values.anchoreApi.service.port }}
{{- if .Values.anchoreApi.external }}
{{- if .Values.anchoreApi.external.use_tls }}
external_tls: {{ .Values.anchoreApi.external.use_tls }}
{{- end }}
{{- if .Values.anchoreApi.external.hostname }}
external_hostname: {{ .Values.anchoreApi.external.hostname }}
{{- end }}
external_port: {{ .Values.anchoreApi.external.port | default "null" }}
{{- end }}
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
authorization_handler: external
authorization_handler_config:
endpoint: "http://localhost:{{- .Values.anchoreEnterpriseRbac.service.authPort }}"
{{- end }}
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
{{- end }}
analyzer:
enabled: true
require_auth: true
endpoint_hostname: {{ template "anchore-engine.analyzer.fullname" . }}
listen: 0.0.0.0
port: {{ .Values.anchoreAnalyzer.containerPort }}
cycle_timer_seconds: 1
cycle_timers:
{{- toYaml .Values.anchoreAnalyzer.cycleTimers | nindent 10 }}
max_threads: {{ .Values.anchoreAnalyzer.concurrentTasksPerWorker }}
analyzer_driver: 'nodocker'
{{- if gt .Values.anchoreAnalyzer.layerCacheMaxGigabytes 0.0 }}
layer_cache_enable: true
{{- else }}
layer_cache_enable: false
{{- end }}
layer_cache_max_gigabytes: {{ .Values.anchoreAnalyzer.layerCacheMaxGigabytes }}
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
{{- end }}
catalog:
enabled: true
require_auth: true
endpoint_hostname: {{ template "anchore-engine.catalog.fullname" . }}
listen: 0.0.0.0
port: {{ .Values.anchoreCatalog.service.port }}
cycle_timer_seconds: 1
cycle_timers:
# Interval to check for an update to a tag
image_watcher: {{ .Values.anchoreCatalog.cycleTimers.image_watcher }}
# Interval to run a policy evaluation on images with the policy_eval subscription activated.
policy_eval: {{ .Values.anchoreCatalog.cycleTimers.policy_eval }}
# Interval to run a vulnerability scan on images with the vuln_update subscription activated.
vulnerability_scan: {{ .Values.anchoreCatalog.cycleTimers.vulnerability_scan }}
# Interval at which the catalog looks for new work to put on the image analysis queue.
analyzer_queue: {{ .Values.anchoreCatalog.cycleTimers.analyzer_queue }}
# Interval notifications will be processed for state changes
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
notifications: 0
{{- else }}
notifications: {{ .Values.anchoreCatalog.cycleTimers.notifications }}
{{- end }}
# Intervals service state updates are polled for the system status
service_watcher: {{ .Values.anchoreCatalog.cycleTimers.service_watcher }}
# Interval between checks to repo for new tags
repo_watcher: {{ .Values.anchoreCatalog.cycleTimers.repo_watcher }}
event_log:
{{- toYaml .Values.anchoreCatalog.events | nindent 10 }}
archive:
{{- toYaml .Values.anchoreCatalog.archive | nindent 10 }}
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
{{- end }}
simplequeue:
enabled: true
require_auth: true
endpoint_hostname: {{ template "anchore-engine.simplequeue.fullname" . }}
listen: 0.0.0.0
port: {{ .Values.anchoreSimpleQueue.service.port }}
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
{{- end }}
policy_engine:
enabled: true
require_auth: true
endpoint_hostname: {{ template "anchore-engine.policy-engine.fullname" . }}
listen: 0.0.0.0
port: {{ .Values.anchorePolicyEngine.service.port }}
cycle_timer_seconds: 1
cycle_timers:
{{- toYaml .Values.anchorePolicyEngine.cycleTimers | nindent 10 }}
{{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
{{- end }}
Reference in New Issue View Git Blame Copy Permalink