deprecated-helm-charts/stable/anchore-engine/values.yaml

# Default values for anchore_engine chart.

# Anchore engine has a dependency on Postgresql, configure here
postgresql:
  # To use an external DB, uncomment & set 'enabled: false'
  # externalEndpoint, postgresUser, postgresPassword & postgresDatabase are required values for external postgres
  # enabled: false
  postgresUser: anchoreengine
  postgresPassword: anchore-postgres,123
  postgresDatabase: anchore

  # Specify an external (already existing) postgres deployment for use.
  # Set to the host and port. eg. mypostgres.myserver.io:5432
  externalEndpoint: Null

  # Configure size of the persitant volume used with helm managed chart.
  # This is ignored if using an external endpoint.
  persistence:
    size: 8Gi

# Global configuration shared by all anchore-engine services.
anchoreGlobal:
  # Image used for all anchore engine deployments (excluding enterprise components).
  image:
    # Can use 'latest' tag but not recommended
    repository: docker.io/anchore/anchore-engine
    tag: v0.3.0
    pullPolicy: IfNotPresent

  # K8s service configuration for all anchore engine APIs, must be reachable inside the cluster by all other services and users
  service:
    type: ClusterIP
    ports:
      analyzer: 8084
      extApi: 8228
      simplequeue: 8083
      catalog: 8082
      policyEngine: 8087
      kubernetesWebhook: 8338
      # For enterprise customers only
      feedsApi: 8448
      uiHttp: 80
      rbacApi: 8229
      rbacAuth: 8089

  # Create an ingress resource for all external anchore engine services.
  # Ingress paths/hosts can be setup for the anchoreApi & anchoreEnterpriseUi deployments in the corresponding values sections.
  ingress:
    enabled: false
    annotations: {}
      # kubernetes.io/ingress.allow-http: false
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: true
    tls: []
    # Secrets must be manually created in the namespace.
    #  - secretName: chart-example-tls
    #    hosts:
    #      - chart-example.local

  # Set where default configs are placed at startup. This must be a writable location for the pod.
  serviceDir: /anchore_service_config
  logLevel: INFO

  # If true, if a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
  allowECRUseIAMRole: false

  # Enable prometheus metrics
  enableMetrics: false

  # Sets the password & email address for the default anchore-engine admin user.
  defaultAdminPassword: foobar
  defaultAdminEmail: example@email.com

  # Configure the database connection within anchore-engine & enterprise-ui. This may get split into 2 different configurations based on service utilized.
  dbConfig:
    timeout: 120
    # Use ssl, but the default postgresql config in helm's stable repo does not support ssl on server side, so this should be set for external dbs only for the time being
    ssl: false
    connectionPoolSize: 30
    connectionPoolMaxOverflow: 100

  # Enable to force all anchore-engine services to communicate internally using SSL
  internalServicesSslEnabled: false
  internalServicesSsl:
    # specify whether cert is verfied against the local certifacte bundle (allow self-signed certs if set to false)
    verifyCerts: false
    certDir: "/certs"
    certSecret: Null
    certSecretKeyName: "tls.key"
    certSecretCertName: "tls.crt"

  # To enable webhooks, set webhooksEnabled: true
  webhooksEnabled: false
  # Configure webhook outputs here. The service provides these webhooks for notifying external systems of updates
  webhooks:
    # User and password to be set (using HTTP basic auth) on all webhook calls if necessary
    webhook_user: Null
    webhook_password: Null
    ssl_verify: true

    # Endpoint for general notification delivery. These events are image/tag updates etc. This is globally configured
    # and updates for all users are sent to the same host but with a different path for each user.
    # <notification_type>/<userId> are required as documented at end of URI - only hostname:port should be configured.
    general: {}
      # url: "http://somehost:9090/<notification_type>/<userId>"

# Configuration for the analyzer pods that perform image analysis
# There may be many of these analyzers but best practice is to not have more than one per node since analysis
# is very IO intensive. Use of affinity/anti-affinity rules for scheduling the analyzers is future work.
anchoreAnalyzer:
  replicaCount: 1

  # The cycle timer is the interval between checks to the work queue for new jobs
  cycleTimers:
    image_analyzer: 5

  # Controls the concurrency of the analyzer itself. Can be configured to process more than one task at a time, but it IO bound, so may not
  # necessarily be faster depending on hardware. Should test and balance this value vs. number of analyzers for your deployment cluster performance.
  concurrentTasksPerWorker: 1

  # The analysisVolume controls the mounting of an external volume for scratch space for image analysis. Generally speaking
  # you need to provision 3x the size of the largest image (uncompressed) that you want to analyze for this space.
  scratchVolume:
    mountPath: /scratch
    details:
      # Specify volume configuration here
      emptyDir: {}

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}


# Pod configuration for the anchore engine api service.
anchoreApi:
  replicaCount: 1

  # Used to create Ingress record for the anchore engine external API (api service)
  # (should used with service.type: ClusterIP or NodePort depending on platform)
  ingress:
    path: /v1/*
    # You can bound on specific hostnames
    # hosts:
    #   - anchore-api.local

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 6Gi
  #  requests:
  #    cpu: 100m
  #    memory: 4Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}

anchoreCatalog:
  replicaCount: 1

  # Intervals to run specific events on (seconds)
  cycleTimers:
    # Interval to check for an update to a tag
    image_watcher: 3600
    # Interval to run a policy evaluation on images with the policy_eval subscription activated.
    policy_eval: 3600
    # Interval to run a vulnerability scan on images with the vuln_update subscription activated.
    vulnerability_scan: 14400
    # Interval at which the catalog looks for new work to put on the image analysis queue.
    analyzer_queue: 1
    # Interval notifications will be processed for state changes
    notifications: 30
    # Intervals service state updates are polled for the system status
    service_watcher: 15
    # Interval between checks to repo for new tags
    repo_watcher: 60

  # Event log configuration for webhooks
  events:
    notification:
      enabled: true
      # Send notifications for events with severity level that matches items in this list
      level:
        - error
        # - info

  archive:
    compression:
      enabled: true
      min_size_kbytes: 100
    storage_driver:
      # Valid storage driver names: 'db', 's3', 'swift'
      name: db
      config: {}

      # Example S3 Configuration:
      # name: s3
      # config:
      #   # All objects are stored in a single bucket, defined here
      #   bucket: "anchore-engine-testing"
      #   # A prefix for keys in the bucket if desired (optional)
      #   prefix: "internaltest"
      #   # Create the bucket if it doesn't already exist
      #   create_bucket: false
          # Url only needed for non-AWS S3 implementations (e.g. minio). Otherwise, configure the region instead
      #   #url: "https://s3.amazonaws.com"
      #   # AWS region to connect to if 'url' not specified, if both are set, then 'url' has precedent
      #   region: us-west-2
      #   # For Auth can provide access/secret keys or use 'iamauto' which will use an instance profile or any credentials found in normal aws search paths/metadata service
      #   access_key: XXXX
      #   secret_key: YYYY
      #   iamauto: false

      # Example Minio configuration (basically same as s3 example):
      # name: s3
      # config:
      #   url: http://<minio url>:9000
      #   bucket: mybucket
      #   access_key: xxxxxx
      #   secret_key: yyyyyy
      #   create_bucket: true

      # Example Swift Configuration:
      # name: swift
      # config:
      #     # Config for swift has a few options, just add the keys and names as used to configure a swiftclient here. All are passed directly to the client impl.
      #     user: "test:tester"
      #     key: "testing"
      #     auth: "http://swift_ephemeral:8080/auth/v1.0"
      #     # The swift container where data will be stored
      #     container: "local_test_anchore"
      #     # Create the container if it is not already present
      #     create_container: false

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}

# Pod configuration for the anchore engine policy service.
anchorePolicyEngine:
  replicaCount: 1

  cycleTimers:
    # Interval to run a feed sync to get latest cve data
    feed_sync: 14400
    # Interval between checks to see if there needs to be a task queued
    feed_sync_checker: 3600

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}

# Pod configuration for the anchore engine simplequeue service.
anchoreSimpleQueue:
  replicaCount: 1

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 3Gi
  #  requests:
  #    cpu: 100m
  #    memory: 2Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}

# This section is used for configuring anchore enterprise.
anchoreEnterpriseGlobal:
  enabled: false
  # Name of kubernetes secret containing your license.yaml file.
  # Create this secret with the following command - kubectl create secret generic anchore-license --from-file=license.yaml=<PATH TO LICENSE.YAML>
  licenseSecretName: anchore-enterprise-license
  # Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images.
  # Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username=<USERNAME> --docker-password=<PASSWORD> --docker-email=<EMAIL_ADDRESS>
  imagePullSecretName: anchore-enterprise-pullcreds

  image:
    repository: docker.io/anchore/enterprise
    tag: v0.3.0
    pullPolicy: IfNotPresent

# Configure the second postgres database instance for the enterprise feeds service.
# Only utilized if anchoreEnterpriseFeeds.enabled: true
anchore-feeds-db:
  # To use an external DB, uncomment & set 'enabled: false'
  # externalEndpoint, postgresUser, postgresPassword & postgresDatabase are required values for external postgres
  # enabled: false
  postgresUser: anchoreengine
  postgresPassword: anchore-postgres,123
  postgresDatabase: anchore-feeds

  # Specify an external (already existing) postgres deployment for use.
  # Set to the host and port. eg. mypostgres.myserver.io:5432
  externalEndpoint: Null

  # Configure size of the persitant volume used with helm managed chart.
  # This is ignored if using an external endpoint.
  persistence:
    size: 8Gi

# Configure & enable the Anchore Enterprise on-prem feeds service.
anchoreEnterpriseFeeds:
  # If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance.
  enabled: true

  # Time delay in seconds between consecutive driver runs for processing data
  cycleTimers:
    driver_sync: 7200

  # Configure the database connection within anchore-engine & enterprise-ui. This may get split into 2 different configurations based on service utilized.
  dbConfig:
    timeout: 120
    # Use ssl, but the default postgresql config in helm's stable repo does not support ssl on server side, so this should be set for external dbs only for the time being
    ssl: false
    connectionPoolSize: 30
    connectionPoolMaxOverflow: 100

  # Staging space for holding normalized output from drivers.
  scratchVolume:
    mountPath: /scratch
    details:
      # Specify volume configuration here
      emptyDir: {}

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}

# Configure the Anchore Enterprise role based access control component.
# This component consists of 2 containers that run as side-cars in the anchore engine api pod.
anchoreEnterpriseRbac:
  enabled: true
  # authResources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

  # managerResources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

# Configure the Anchore Enterprise UI.
anchoreEnterpriseUi:
  # If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance.
  enabled: true
  # Specifies whether to trust a reverse proxy when setting secure cookies (via the `X-Forwarded-Proto` header).
  enableProxy: false
  # Specifies if SSL is enabled in the web app container.
  enableSsl: false
  # Specifies if a single set of user credentials can be used to start multiple Anchore Enterprise UI sessions; for
  # example, by multiple users across different systems, or by a single user on a single system across multiple browsers.
  #
  # When set to `false`, only one session per credential is permitted at a time, and logging in will invalidate any other
  # sessions that are using the same set of credentials. Note that setting this property to `false` does not prevent a
  # single session from being viewed within multiple *tabs* inside the same browser.
  enableSharedLogin: true

  image:
    repository: docker.io/anchore/enterprise-ui
    tag: v0.3.0
    pullPolicy: IfNotPresent

  ingress:
    path: /*
    # You can bound on specific hostnames
    # hosts:
    #   - anchore-ui.local

  # resources:
  #  limits:
  #    cpu: 100m
  #    memory: 8Gi
  #  requests:
  #    cpu: 100m
  #    memory: 3Gi

  annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}

# Anchore Engine Enterprise UI is dependent on redis for storing sessions
# Only utilized if 'anchoreEnterpriseUi.enabled: true'
anchore-ui-redis:
  password: anchore-redis,123
  cluster:
    enabled: false
  persistence:
    enabled: false

  # To use an external redis endpoint, uncomment to set 'enabled: false'
  # enabled: false

  # If 'enabled: false', specify an external redis endpoint -
  # eg redis://:<password>@hostname:6379
  externalEndpoint: Null