@@ -242,6 +243,14 @@ See the anchore-engine [CHANGELOG](https://github.com/anchore/anchore-engine/blo
...
@@ -242,6 +243,14 @@ See the anchore-engine [CHANGELOG](https://github.com/anchore/anchore-engine/blo
A Helm post-upgrade hook job will shut down all previously running Anchore services and perform the Anchore DB upgrade process using a kubernetes job. The upgrade will only be considered successful when this job completes successfully. Performing an upgrade will cause the Helm client to block until the upgrade job completes and the new Anchore service pods are started. To view progress of the upgrade process, tail the logs of the upgrade jobs `anchore-engine-upgrade` and `anchore-enterprise-upgrade`. These job resources will be removed upon a successful helm upgrade.
A Helm post-upgrade hook job will shut down all previously running Anchore services and perform the Anchore DB upgrade process using a kubernetes job. The upgrade will only be considered successful when this job completes successfully. Performing an upgrade will cause the Helm client to block until the upgrade job completes and the new Anchore service pods are started. To view progress of the upgrade process, tail the logs of the upgrade jobs `anchore-engine-upgrade` and `anchore-enterprise-upgrade`. These job resources will be removed upon a successful helm upgrade.
## Chart version 1.13.0
---
* Anchore Engine image updated to v0.10.0 - [Release Notes](https://engine.anchore.io/docs/releasenotes/0100/)
* Anchore Enterprise image updated to v3.1.0 - [Release Notes](https://docs.anchore.com/current/docs/releasenotes/310/)
* If utilizing the Enterprise Runtime Inventory feature, the catalog service can now be configured to automatically setup RBAC for image discovery within the cluster. This is configured under `.Values.anchoreCatalog.runtimeInventory`
{{- if and (hasKey (index .Values "anchore-ui-redis") "enabled")}}
{{- if or (hasKey (index .Values "anchore-ui-redis") "enabled") (hasKey .Values.postgresql "enabled")}}
{{- if and (not (index .Values "anchore-ui-redis" "enabled")) .Values.anchoreEnterpriseGlobal.enabled}}
{{- if and (or (not (index .Values "anchore-ui-redis" "enabled")) (not .Values.postgresql.enabled)) .Values.anchoreEnterpriseGlobal.enabled}}
---
---
# if external redis is enabled, the ui pod will require egress as it depends on redis
# if external redis is enabled OR external postgres is enabled, the ui pod will require egress as it depends on redis and interacts with the db to perform specific functions such as SAML
# Warning: enabling the package sync causes the service to require much
# more memory to do process the significant data volume. We recommend at least 4GB available for the container
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
# Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
# Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
# Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
# Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
# Warning: enabling the packages and nvd sync causes the service to require much more memory to do process the significant data volume. We recommend at least 4GB available for the container
# packages feed is synced if it is enabled regardless of the provider
packages:
{{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
# Set image pull secret name if using an anchore-engine image from a private registry
# Set image pull secret name if using an anchore-engine image from a private registry
imagePullSecretName:private-registry
imagePullSecretName:private-registry
# Specify a service account name utilized to run all Anchore pods
# Specify a service account name utilized to run all Anchore pods
serviceAccountName:
serviceAccountName:Null
# Set this value to true to setup the chart for OpenShift deployment compatibility.
# Set this value to true to setup the chart for OpenShift deployment compatibility.
openShiftDeployment:false
openShiftDeployment:false
...
@@ -185,8 +185,8 @@ anchoreGlobal:
...
@@ -185,8 +185,8 @@ anchoreGlobal:
# Add common annotations to set on all pods. Useful expecially when inject secrets directly into pods as ENV from vault via mutation-webhook-injection method.
# Add common annotations to set on all pods. Useful expecially when inject secrets directly into pods as ENV from vault via mutation-webhook-injection method.
# If true, when a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
# If true, when a user adds an ECR registry with username = awsauto then the system will look for an instance profile to use for auth against the registry
allowECRUseIAMRole:false
allowECRUseIAMRole:false
# Twisted has a global server side timeout on all established connections which defaults to 60, anything lasting longer
# than this (+ a 15 min abort final timeout) will have the connection killed by twisted
serverRequestTimeout:60
# Enable prometheus metrics
# Enable prometheus metrics
enableMetrics:false
enableMetrics:false
...
@@ -370,6 +374,11 @@ anchoreAnalyzer:
...
@@ -370,6 +374,11 @@ anchoreAnalyzer:
# For more info see - https://docs.anchore.com/current/docs/engine/engine_installation/configuration/content_hints
# For more info see - https://docs.anchore.com/current/docs/engine/engine_installation/configuration/content_hints
enableHints:false
enableHints:false
# If enabled, the Anchore Analyzer will filter packages out that are contained by others. (e.g. a python package installed by an RPM using yum or dnf).
# When disabled, the Anchore Analyzer will report all packages as content regardless of "containership". In the above example, this would cause the
# python package to be returned as it's own entry in the image's content.
enableOwnedPackageFiltering:true
configFile:
configFile:
# Anchore analyzer config file
# Anchore analyzer config file
#
#
...
@@ -494,6 +503,7 @@ anchoreCatalog:
...
@@ -494,6 +503,7 @@ anchoreCatalog:
image_gc:60
image_gc:60
# Interval for the runtime inventory image execution poll
# Interval for the runtime inventory image execution poll
k8s_watcher:300
k8s_watcher:300
k8s_image_watcher:150
# Event log configuration for webhooks
# Event log configuration for webhooks
events:
events:
...
@@ -621,6 +631,13 @@ anchoreCatalog:
...
@@ -621,6 +631,13 @@ anchoreCatalog:
tolerations:[]
tolerations:[]
affinity:{}
affinity:{}
# If enabled, the Anchore Helm Chart will create a Service Account with read-only permission to the cluster (pods & namespaces)
# This is largely to support the Out-Of-The-Box Runtime Inventory feature currently. See catalog_deployment.yaml for
# detailed information on the Service Account, Cluster Role & Binding.
# If using an existing service account, leave this value set to `false` & use anchoreGlobal.serviceAccountName to specify
# what service account to use. Existing service account must have adequate permissions to use this feature.
createServiceAccount:false
runtimeInventory:
runtimeInventory:
# This setting tells Anchore how long an image can be missing from an inventory report before it is removed from
# This setting tells Anchore how long an image can be missing from an inventory report before it is removed from
# The working set. Note: The image will still have a historical record in the reports service, subject to data history
# The working set. Note: The image will still have a historical record in the reports service, subject to data history
...
@@ -630,8 +647,14 @@ anchoreCatalog:
...
@@ -630,8 +647,14 @@ anchoreCatalog:
# Since Anchore is running in Kubernetes, we can collect runtime inventory data out of the box
# Since Anchore is running in Kubernetes, we can collect runtime inventory data out of the box
reportAnchoreCluster:
reportAnchoreCluster:
# If set to true, Anchore will use its own service-account to try and collect runtime inventory data for all namespaces
# If set to true, Anchore will use its own service account's permissions
# Note: requires a value for clusterName to populate inventory image context
# (if anchoreCatalog.createServiceAccount is true, see `catalog_deployment.yaml`) to try and collect runtime
# inventory data for all namespaces.
#
# Note: this feature requires a value for clusterName to populate inventory image context
# Note: If anchoreCatalog.createServiceAccount is set to false, and anchoreGlobal.serviceAccountName is unspecified,
# then the Anchore Catalog service won't have enough permission to be able to read cluster information
# (pods & namespaces) for the embedded runtime inventory.
enabled:true
enabled:true
clusterName:anchore-k8s
clusterName:anchore-k8s
namespaces:
namespaces:
...
@@ -652,6 +675,12 @@ anchorePolicyEngine:
...
@@ -652,6 +675,12 @@ anchorePolicyEngine:
feed_sync:14400
feed_sync:14400
# Interval between checks to see if there needs to be a task queued
# Interval between checks to see if there needs to be a task queued
feed_sync_checker:3600
feed_sync_checker:3600
# 1 minute between checks to verify local grype-db is up to date
grypedb_sync:60
# Available providers are legacy and grype. Legacy provider offers the same matching logic as previous versions of anchore-engine (<= 0.9.4)
# grype is a new provider that was introduced in 1.0.0, it uses the grype tool for all things vulnerabilities
vulnerabilityProvider:legacy
# kubernetes service configuration for anchore policy engine api
# kubernetes service configuration for anchore policy engine api
service:
service:
...
@@ -719,7 +748,7 @@ anchoreEnterpriseGlobal:
...
@@ -719,7 +748,7 @@ anchoreEnterpriseGlobal:
# Create this secret with the following command - kubectl create secret generic anchore-enterprise-license --from-file=license.yaml=<PATH TO LICENSE.YAML>
# Create this secret with the following command - kubectl create secret generic anchore-enterprise-license --from-file=license.yaml=<PATH TO LICENSE.YAML>
# Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images.
# Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images.
# Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username=<USERNAME> --docker-password=<PASSWORD> --docker-email=<EMAIL_ADDRESS>
# Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username=<USERNAME> --docker-password=<PASSWORD> --docker-email=<EMAIL_ADDRESS>
...
@@ -778,7 +807,7 @@ anchoreEnterpriseFeeds:
...
@@ -778,7 +807,7 @@ anchoreEnterpriseFeeds:
# If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance.
# If enabled is set to false, set anchore-feeds-db.enabled to false to ensure that helm doesn't stand up a unneccessary postgres instance.
enabled:true
enabled:true
# Set custom feeds URL if multiple Anchore deployments are using the same feeds service
# Set custom feeds URL if multiple Anchore deployments are using the same internal feeds service.
@@ -186,3 +186,11 @@ In `chart/templates/enterprise_feeds_configmap.yaml` also modify the metrics lin
...
@@ -186,3 +186,11 @@ In `chart/templates/enterprise_feeds_configmap.yaml` also modify the metrics lin
metrics:
metrics:
enabled:{{.Values.monitoring.enabled}}
enabled:{{.Values.monitoring.enabled}}
```
```
To resolve a race condition in Big Bang CI pipelines, an additional sleep argument was added in `chart/templates/engine_upgrade_job.yaml`, `enterprise_upgrade_job.yaml`, and `enterprise_feeds_upgrade_jobs.yaml`:
```yaml
-|
sleep 60
anchore-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask;
