Skip to content

Commit 903a0af

Browse files
BtodhunterHN23
Btodhunter
and
HN23
authored
stable/enterprise: Update Anchore Enterprise to v5.2.0 (#338)
* Ent 5.2.0 updates (#187) * add additional configs for 5.2.0 * updating helm unittests and readme to include changes * adding scratch for reports * update default of api delete keys to 365; add scratch volume to reports pod; add reports resources tests * adding additional reports resources test * Enterprise split reports api (#188) * move reports service to seperate deployment * use enterprise prefix for helper templates * add rbacAuth container back to api pod * make reports-worker fullname match values key for the service * update unit tests * bump chart version * fix reports worker descriptions & alphabetize the top level key * add rbacAuth container to reports pod (#189) * add rbacAuth container to reports pod * add rbacAuth unit test for reports template * updating error message for image_ttl_days (#192) * Make scratch volume configurable (#193) * use helper template for scratch volume details. Allow component specific configs * add unit tests * add necessary values and update readme * bump chart version * bump enterprise image to v5.2.0 * update test snapshots * bump feeds chart version * bump chart version * update readme and values table * remove reports service from the ingress configuration --------- Signed-off-by: Brady Todhunter <[email protected]> Signed-off-by: Hung Nguyen <[email protected]> Co-authored-by: Hung Nguyen <[email protected]>
1 parent 6ca8d1f commit 903a0af

29 files changed

+1234
-608
lines changed

‎stable/enterprise/Chart.lock

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@ dependencies:
77
version: 17.11.8
88
- name: feeds
99
repository: https://charts.anchore.io/stable
10-
version: 2.1.2
11-
digest: sha256:60e766cb4ec7976ab63530288e3c2c23a6fe2e2596bc92f550d6c453e2863336
12-
generated: "2024-01-03T16:51:40.920313-05:00"
10+
version: 2.2.0
11+
digest: sha256:e2fc0ac4d344f4baf4e9b818d05b1bb88ee87f9f760e3fb8237260b67ffc4d15
12+
generated: "2024-02-01T21:44:45.424502-08:00"

‎stable/enterprise/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: enterprise
3-
version: "2.2.4"
4-
appVersion: "5.1.1"
3+
version: "2.3.0"
4+
appVersion: "5.2.0"
55
kubeVersion: 1.23.x - 1.28.x || 1.23.x-x - 1.28.x-x
66
description: |
77
Anchore Enterprise is a complete container security workflow solution for professional teams. Easily integrating with CI/CD systems,

‎stable/enterprise/README.md

Lines changed: 277 additions & 255 deletions
Large diffs are not rendered by default.

‎stable/enterprise/files/default_config.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,16 @@ keys:
3434
private_key_path: ${ANCHORE_AUTH_PUBKEY}
3535

3636
user_authentication:
37-
hashed_passwords: ${ANCHORE_AUTH_ENABLE_HASHED_PASSWORDS}
38-
sso_require_existing_users: ${ANCHORE_SSO_REQUIRES_EXISTING_USERS}
3937
oauth:
4038
enabled: ${ANCHORE_OAUTH_ENABLED}
4139
default_token_expiration_seconds: ${ANCHORE_OAUTH_TOKEN_EXPIRATION}
4240
refresh_token_expiration_seconds: ${ANCHORE_OAUTH_REFRESH_TOKEN_EXPIRATION}
41+
hashed_passwords: ${ANCHORE_AUTH_ENABLE_HASHED_PASSWORDS}
42+
sso_require_existing_users: ${ANCHORE_SSO_REQUIRES_EXISTING_USERS}
4343
allow_api_keys_for_saml_users: {{ .Values.anchoreConfig.user_authentication.allow_api_keys_for_saml_users }}
4444
max_api_key_age_days: {{ .Values.anchoreConfig.user_authentication.max_api_key_age_days }}
4545
max_api_keys_per_user: {{ .Values.anchoreConfig.user_authentication.max_api_keys_per_user }}
46+
remove_deleted_user_api_keys_older_than_days: {{ .Values.anchoreConfig.user_authentication.remove_deleted_user_api_keys_older_than_days }}
4647

4748
credentials:
4849
database:
@@ -235,11 +236,13 @@ services:
235236
authorization_handler: external
236237
authorization_handler_config:
237238
endpoint: http://localhost:8089
239+
cycle_timers: {{- toYaml .Values.anchoreConfig.reports.cycle_timers | nindent 6 }}
238240
max_async_execution_threads: ${ANCHORE_ENTERPRISE_REPORTS_MAX_ASYNC_EXECUTION_THREADS}
239241
async_execution_timeout: ${ANCHORE_ENTERPRISE_REPORTS_ASYNC_EXECUTION_TIMEOUT}
240242
ssl_enable: ${ANCHORE_SSL_ENABLED}
241243
ssl_cert: ${ANCHORE_SSL_CERT}
242244
ssl_key: ${ANCHORE_SSL_KEY}
245+
use_volume: {{ .Values.anchoreConfig.reports.use_volume }}
243246

244247
reports_worker:
245248
enabled: true

‎stable/enterprise/templates/_common.tpl

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,7 @@ When calling this template, .component can be included in the context for compon
9090
{{ toYaml . }}
9191
{{- end }}
9292
- name: ANCHORE_ENDPOINT_HOSTNAME
93-
{{- if and (eq $component "reports") (eq .api "true") }}
94-
value: {{ template "enterprise.api.fullname" . }}
95-
{{- else }}
9693
value: {{ include (printf "enterprise.%s.fullname" $component) . }}
97-
{{- end }}
9894
{{- with (index .Values (print $component)).service }}
9995
- name: ANCHORE_PORT
10096
value: {{ .port | quote }}
@@ -274,6 +270,21 @@ successThreshold: {{ .Values.probes.readiness.successThreshold }}
274270
{{- end -}}
275271

276272

273+
{{/*
274+
Setup the common anchore scratch volume details config
275+
*/}}
276+
{{- define "enterprise.common.scratchVolume.details" -}}
277+
{{- $component := .component -}}
278+
{{- if (index .Values (print $component)).scratchVolume.details }}
279+
{{- toYaml (index .Values (print $component)).scratchVolume.details }}
280+
{{- else if .Values.scratchVolume.details }}
281+
{{- toYaml .Values.scratchVolume.details }}
282+
{{- else }}
283+
emptyDir: {}
284+
{{- end }}
285+
{{- end -}}
286+
287+
277288
{{/*
278289
Setup the common anchore volume mounts
279290
*/}}

‎stable/enterprise/templates/_helpers.tpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ Return the database user for the Anchore Enterprise UI config
148148
{{/*
149149
Set the nodePort for services if its defined
150150
*/}}
151-
{{- define "service.nodePort" -}}
151+
{{- define "enterprise.service.nodePort" -}}
152152
{{- $component := .component -}}
153153
{{- if (index .Values (print $component)).service.nodePort -}}
154154
nodePort: {{ (index .Values (print $component)).service.nodePort }}

‎stable/enterprise/templates/_names.tpl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
5252
{{- printf "%s-%s-%s" .Release.Name $name "reports"| trunc 63 | trimSuffix "-" -}}
5353
{{- end -}}
5454

55+
{{- define "enterprise.reportsWorker.fullname" -}}
56+
{{- $name := default .Chart.Name .Values.global.nameOverride -}}
57+
{{- printf "%s-%s-%s" .Release.Name $name "reportsworker"| trunc 63 | trimSuffix "-" -}}
58+
{{- end -}}
59+
5560
{{- define "enterprise.simpleQueue.fullname" -}}
5661
{{- $name := default .Chart.Name .Values.global.nameOverride -}}
5762
{{- printf "%s-%s-%s" .Release.Name $name "simplequeue"| trunc 63 | trimSuffix "-" -}}

‎stable/enterprise/templates/analyzer_deployment.yaml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,7 @@ spec:
2626
{{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
2727
volumes: {{- include "enterprise.common.volumes" . | nindent 8 }}
2828
- name: "anchore-scratch"
29-
{{- if .Values.scratchVolume.details }}
30-
{{- toYaml .Values.scratchVolume.details | nindent 10 }}
31-
{{- else }}
32-
emptyDir: {}
33-
{{- end }}
29+
{{- include "enterprise.common.scratchVolume.details" (merge (dict "component" $component) .) | nindent 10 }}
3430
- name: analyzer-config-volume
3531
configMap:
3632
name: {{ template "enterprise.analyzer.fullname" . }}

‎stable/enterprise/templates/api_deployment.yaml

Lines changed: 1 addition & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -71,28 +71,6 @@ spec:
7171
{{- with .Values.api.resources }}
7272
resources: {{- toYaml . | nindent 12 }}
7373
{{- end }}
74-
75-
- name: "{{ .Chart.Name }}-reports-api"
76-
image: {{ .Values.image }}
77-
imagePullPolicy: {{ .Values.imagePullPolicy }}
78-
{{- with .Values.containerSecurityContext }}
79-
securityContext:
80-
{{ toYaml . | nindent 12 }}
81-
{{- end }}
82-
command: ["/bin/sh", "-c"]
83-
args:
84-
- {{ print (include "enterprise.common.dockerEntrypoint" .) }} reports
85-
envFrom: {{- include "enterprise.common.envFrom" . | nindent 12 }}
86-
env: {{- include "enterprise.common.environment" (merge (dict "component" "reports" "api" "true") .) | nindent 12 }}
87-
ports:
88-
- containerPort: {{ .Values.reports.service.port }}
89-
name: reports
90-
volumeMounts: {{- include "enterprise.common.volumeMounts" . | nindent 12 }}
91-
livenessProbe: {{- include "enterprise.common.livenessProbe" (merge (dict "component" "reports") .) | nindent 12 }}
92-
readinessProbe: {{- include "enterprise.common.readinessProbe" (merge (dict "component" "reports") .) | nindent 12 }}
93-
{{- with .Values.reports.resources }}
94-
resources: {{- toYaml . | nindent 12 }}
95-
{{- end }}
9674
{{- include "enterprise.common.rbacAuthContainer" . | nindent 8 }}
9775

9876
---
@@ -110,12 +88,7 @@ spec:
11088
port: {{ .Values.api.service.port }}
11189
targetPort: {{ .Values.api.service.port }}
11290
protocol: TCP
113-
{{ include "service.nodePort" (merge (dict "component" $component) .) }}
114-
- name: reports
115-
port: {{ .Values.reports.service.port }}
116-
targetPort: {{ .Values.reports.service.port }}
117-
protocol: TCP
118-
{{ include "service.nodePort" (merge (dict "component" "reports") .) }}
91+
{{ include "enterprise.service.nodePort" (merge (dict "component" $component) .) }}
11992
selector:
12093
app.kubernetes.io/name: {{ template "enterprise.fullname" . }}
12194
app.kubernetes.io/component: {{ $component | lower }}

‎stable/enterprise/templates/catalog_deployment.yaml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,7 @@ spec:
2828
{{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
2929
volumes: {{- include "enterprise.common.volumes" . | nindent 8 }}
3030
- name: anchore-scratch
31-
{{- if .Values.scratchVolume.details }}
32-
{{- toYaml .Values.scratchVolume.details | nindent 10 }}
33-
{{- else }}
34-
emptyDir: {}
35-
{{- end }}
31+
{{- include "enterprise.common.scratchVolume.details" (merge (dict "component" $component) .) | nindent 10 }}
3632
{{- if .Values.anchoreConfig.policyBundles }}
3733
- name: policy-bundle-volume
3834
configMap:
@@ -92,7 +88,7 @@ spec:
9288
port: {{ .Values.catalog.service.port }}
9389
targetPort: {{ .Values.catalog.service.port }}
9490
protocol: TCP
95-
{{ include "service.nodePort" (merge (dict "component" $component) .) }}
91+
{{ include "enterprise.service.nodePort" (merge (dict "component" $component) .) }}
9692
selector:
9793
app.kubernetes.io/name: {{ template "enterprise.fullname" . }}
9894
app.kubernetes.io/component: {{ $component | lower }}

‎stable/enterprise/templates/envvars_configmap.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ data:
5050
ANCHORE_ENTERPRISE_REPORTS_VULNERABILITIES_BY_K8S_CONTAINER: "true"
5151
ANCHORE_ENTERPRISE_REPORTS_VULNERABILITIES_BY_K8S_NAMESPACE: "true"
5252
{{- if eq (toString .Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days) "-1" }}
53-
{{- fail "The Value `-1` is no longer valid for `.Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days`. Please use `.Values.anchoreConfig.catalog.runtime_inventory.image_ingest_overwrite=true` to force runtime inventory to be overwritten upon every update for that reported context. `.Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days` must be set to a value >1." -}}
53+
{{- fail "The Value `-1` is no longer valid for `.Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days`. Please use `.Values.anchoreConfig.catalog.runtime_inventory.image_ingest_overwrite=true` to force runtime inventory to be overwritten upon every update for that reported context. `.Values.anchoreConfig.catalog.runtime_inventory.inventory_ttl_days` must be set to a value >1." -}}
5454
{{- else }}
5555
ANCHORE_ENTERPRISE_RUNTIME_INVENTORY_TTL_DAYS: "{{ .Values.anchoreConfig.catalog.runtime_inventory.inventory_ttl_days }}"
5656
ANCHORE_ENTERPRISE_RUNTIME_INVENTORY_INGEST_OVERWRITE: "{{ .Values.anchoreConfig.catalog.runtime_inventory.inventory_ingest_overwrite }}"

‎stable/enterprise/templates/ingress.yaml

Lines changed: 1 addition & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ spec:
2929
{{- end }}
3030
{{- end }}
3131
rules:
32-
{{- if or .Values.ingress.apiHosts .Values.ingress.uiHosts .Values.ingress.feedsHosts .Values.ingress.reportsHosts }}
32+
{{- if or .Values.ingress.apiHosts .Values.ingress.uiHosts .Values.ingress.feedsHosts }}
3333
{{- range $apiHostIndex, $apiHostName := .Values.ingress.apiHosts }}
3434
- host: {{ $apiHostName | quote }}
3535
http:
@@ -88,26 +88,6 @@ spec:
8888
{{- end }}
8989
{{- end }}
9090
{{- end }}
91-
{{- range $reportsHostIndex, $reportsHostName := .Values.ingress.reportsHosts }}
92-
- host: {{ $reportsHostName | quote }}
93-
http:
94-
paths:
95-
{{- range $reportsPathIndex, $reportsPath := $.Values.ingress.reportsPaths }}
96-
- path: {{ $reportsPath }}
97-
{{- if $.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress" }}
98-
pathType: Prefix
99-
backend:
100-
service:
101-
name: {{ template "enterprise.api.fullname" $ }}
102-
port:
103-
number: {{ $.Values.api.service.reportsPort }}
104-
{{- else }}
105-
backend:
106-
serviceName: {{ template "enterprise.api.fullname" $ }}
107-
servicePort: {{ $.Values.api.service.reportsPort }}
108-
{{- end }}
109-
{{- end }}
110-
{{- end }}
11191
{{- else }}
11292
- http:
11393
paths:
@@ -156,20 +136,5 @@ spec:
156136
servicePort: {{ $.Values.feeds.service.port }}
157137
{{- end }}
158138
{{- end }}
159-
{{- range .Values.ingress.reportsPaths }}
160-
- path: {{ . }}
161-
{{- if $.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress" }}
162-
pathType: Prefix
163-
backend:
164-
service:
165-
name: {{ template "enterprise.api.fullname" $ }}
166-
port:
167-
number: {{ $.Values.api.service.reportsPort }}
168-
{{- else }}
169-
backend:
170-
serviceName: {{ template "enterprise.api.fullname" $ }}
171-
servicePort: {{ $.Values.api.service.reportsPort }}
172-
{{- end }}
173-
{{- end }}
174139
{{- end }}
175140
{{- end -}}

‎stable/enterprise/templates/notifications_deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ spec:
6666
port: {{ .Values.notifications.service.port }}
6767
targetPort: {{ .Values.notifications.service.port }}
6868
protocol: TCP
69-
{{ include "service.nodePort" (merge (dict "component" $component) .) }}
69+
{{ include "enterprise.service.nodePort" (merge (dict "component" $component) .) }}
7070
selector:
7171
app.kubernetes.io/name: {{ template "enterprise.fullname" . }}
7272
app.kubernetes.io/component: {{ $component | lower }}

‎stable/enterprise/templates/policyengine_deployment.yaml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,7 @@ spec:
2525
{{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
2626
volumes: {{- include "enterprise.common.volumes" . | nindent 8 }}
2727
- name: anchore-scratch
28-
{{- if .Values.scratchVolume.details }}
29-
{{- toYaml .Values.scratchVolume.details | nindent 10 }}
30-
{{- else }}
31-
emptyDir: {}
32-
{{- end }}
28+
{{- include "enterprise.common.scratchVolume.details" (merge (dict "component" $component) .) | nindent 10 }}
3329
{{- if and .Values.scratchVolume.fixGroupPermissions .Values.securityContext.fsGroup }}
3430
initContainers:
3531
{{- include "enterprise.common.fixPermissionsInitContainer" . | nindent 8 }}
@@ -77,7 +73,7 @@ spec:
7773
port: {{ .Values.policyEngine.service.port }}
7874
targetPort: {{ .Values.policyEngine.service.port }}
7975
protocol: TCP
80-
{{ include "service.nodePort" (merge (dict "component" $component) .) }}
76+
{{ include "enterprise.service.nodePort" (merge (dict "component" $component) .) }}
8177
selector:
8278
app.kubernetes.io/name: {{ template "enterprise.fullname" . }}
8379
app.kubernetes.io/component: {{ $component | lower }}

‎stable/enterprise/templates/rbacmanager_deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ spec:
6666
port: {{ .Values.rbacManager.service.port }}
6767
targetPort: {{ .Values.rbacManager.service.port }}
6868
protocol: TCP
69-
{{ include "service.nodePort" (merge (dict "component" $component) .) }}
69+
{{ include "enterprise.service.nodePort" (merge (dict "component" $component) .) }}
7070
selector:
7171
app.kubernetes.io/name: {{ template "enterprise.fullname" . }}
7272
app.kubernetes.io/component: {{ $component | lower }}

‎stable/enterprise/templates/reports_deployment.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,14 @@ spec:
2424
spec:
2525
{{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
2626
volumes: {{- include "enterprise.common.volumes" . | nindent 8 }}
27+
{{- if .Values.anchoreConfig.reports.use_volume }}
28+
- name: "anchore-scratch"
29+
{{- include "enterprise.common.scratchVolume.details" (merge (dict "component" $component) .) | nindent 10 }}
30+
{{- end }}
31+
{{- if and .Values.anchoreConfig.reports.use_volume .Values.scratchVolume.fixGroupPermissions .Values.securityContext.fsGroup }}
32+
initContainers:
33+
{{- include "enterprise.common.fixPermissionsInitContainer" . | nindent 8 }}
34+
{{- end }}
2735
containers:
2836
{{- if .Values.cloudsql.enabled }}
2937
{{- include "enterprise.common.cloudsqlContainer" . | nindent 8 }}
@@ -37,18 +45,23 @@ spec:
3745
{{- end }}
3846
command: ["/bin/sh", "-c"]
3947
args:
40-
- {{ print (include "enterprise.common.dockerEntrypoint" .) }} reports_worker
48+
- {{ print (include "enterprise.common.dockerEntrypoint" .) }} reports
4149
ports:
4250
- containerPort: {{ .Values.reports.service.port }}
4351
name: {{ $component | lower }}
4452
envFrom: {{- include "enterprise.common.envFrom" . | nindent 12 }}
4553
env: {{- include "enterprise.common.environment" (merge (dict "component" $component) .) | nindent 12 }}
4654
volumeMounts: {{- include "enterprise.common.volumeMounts" . | nindent 12 }}
55+
{{- if .Values.anchoreConfig.reports.use_volume }}
56+
- name: "anchore-scratch"
57+
mountPath: {{ .Values.scratchVolume.mountPath }}
58+
{{- end }}
4759
livenessProbe: {{- include "enterprise.common.livenessProbe" (merge (dict "component" $component) .) | nindent 12 }}
4860
readinessProbe: {{- include "enterprise.common.readinessProbe" (merge (dict "component" $component) .) | nindent 12 }}
4961
{{- with .Values.reports.resources }}
5062
resources: {{- toYaml . | nindent 12 }}
5163
{{- end }}
64+
{{- include "enterprise.common.rbacAuthContainer" . | nindent 8 }}
5265

5366
---
5467
apiVersion: v1
@@ -65,7 +78,7 @@ spec:
6578
port: {{ .Values.reports.service.port }}
6679
targetPort: {{ .Values.reports.service.port }}
6780
protocol: TCP
68-
{{ include "service.nodePort" (merge (dict "component" $component) .) }}
81+
{{ include "enterprise.service.nodePort" (merge (dict "component" $component) .) }}
6982
selector:
7083
app.kubernetes.io/name: {{ template "enterprise.fullname" . }}
7184
app.kubernetes.io/component: {{ $component | lower }}

0 commit comments

Comments
 (0)