UNCLASSIFIED

Skip to content

GitLab

You need to sign in or sign up before continuing.
Commit 8570696d authored by bhearn's avatar bhearn
Browse files

set container resources

parent e2a27a8a
Hide whitespace changes
Inline Side-by-side
Showing with 233 additions and 102 deletions
CHANGELOG.md
View file @ 8570696d
...@@ -4,6 +4,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ...@@ -4,6 +4,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
--- ---
## [1.13.0-bb.6]
## Changed
- updated bb-test-lib dependency to gluon `0.2.3` to resolve OPA Gatekeeper violations
- updated Redis dependency to `14.1.0-bb.3` to resolve OPA Gatekeeper violations
- set resource requests and limits for all containers to resolve OPA Gatekeeper violations
- set resource requests and limits equal to eachother to resolve OPA Gatekeeper violations
## [1.13.0-bb.5] ## [1.13.0-bb.5]
## Added ## Added
- `.Values.postgresqlSuperUser.postgresUsername` and `.Values.postgresqlSuperUser.postgresPassword` for conditionally changing the commands in the ensure db jobs to allow for finer-grain postgres user permissions - `.Values.postgresqlSuperUser.postgresUsername` and `.Values.postgresqlSuperUser.postgresPassword` for conditionally changing the commands in the ensure db jobs to allow for finer-grain postgres user permissions
......
chart/Chart.lock
View file @ 8570696d
...@@ -7,9 +7,9 @@ dependencies: ...@@ -7,9 +7,9 @@ dependencies:
version: 1.0.1 version: 1.0.1
- name: redis - name: redis
repository: file://./deps/redis repository: file://./deps/redis
version: 14.1.0-bb.2 version: 14.1.0-bb.3
- name: bb-test-lib - name: gluon
repository: oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates repository: oci://registry.dso.mil/platform-one/big-bang/apps/library-charts/gluon
version: 0.5.2 version: 0.2.3
digest: sha256:b6031a1579e20adfbd8f708ede7fc9665a21a5c030ca7304af18acdff3b56150 digest: sha256:18e2ebc2abf59245eb530874f5c9aab50f3041a4959aa6534b6411810191d078
generated: "2021-07-13T16:37:10.13824-04:00" generated: "2021-08-18T14:00:09.786881-04:00"
chart/Chart.yaml
View file @ 8570696d
apiVersion: v2 apiVersion: v2
name: anchore-engine name: anchore-engine
version: 1.13.0-bb.5 version: 1.13.0-bb.6
appVersion: 0.10.0 appVersion: 0.10.0
description: Anchore container analysis and policy evaluation engine service description: Anchore container analysis and policy evaluation engine service
keywords: keywords:
...@@ -33,10 +33,10 @@ dependencies: ...@@ -33,10 +33,10 @@ dependencies:
condition: anchore-feeds-db.enabled,anchoreEnterpriseGlobal.enabled condition: anchore-feeds-db.enabled,anchoreEnterpriseGlobal.enabled
alias: anchore-feeds-db alias: anchore-feeds-db
- name: redis - name: redis
version: "14.1.0-bb.2" version: "14.1.0-bb.3"
repository: "file://./deps/redis" repository: "file://./deps/redis"
condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled
alias: anchore-ui-redis alias: anchore-ui-redis
- name: bb-test-lib - name: gluon
version: "0.5.2" version: "0.2.3"
repository: "oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates" repository: oci://registry.dso.mil/platform-one/big-bang/apps/library-charts/gluon
\ No newline at end of file
chart/deps/redis/Chart.yaml
View file @ 8570696d
...@@ -25,4 +25,4 @@ name: redis ...@@ -25,4 +25,4 @@ name: redis
sources: sources:
- https://github.com/bitnami/bitnami-docker-redis - https://github.com/bitnami/bitnami-docker-redis
- http://redis.io/ - http://redis.io/
version: 14.1.0-bb.2 version: 14.1.0-bb.3
chart/deps/redis/Kptfile
View file @ 8570696d
...@@ -5,7 +5,7 @@ metadata: ...@@ -5,7 +5,7 @@ metadata:
upstream: upstream:
type: git type: git
git: git:
commit: ca398b827ba384da78213d9b2f21abf83a9eea8a commit: f24af16a6d583e9e125f519127ffab11f48f42f8
repo: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/redis repo: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/redis
directory: /chart directory: /chart
ref: 14.1.0-bb.2 ref: 14.1.0-bb.3
chart/deps/redis/templates/bigbang/redis-upgrade.yaml
View file @ 8570696d
...@@ -124,4 +124,7 @@ spec: ...@@ -124,4 +124,7 @@ spec:
echo "No PVCs to clean up." echo "No PVCs to clean up."
fi fi
echo "Done with upgrade steps." echo "Done with upgrade steps."
{{- if .Values.cleanUpgrade.resources }}
resources: {{- toYaml .Values.cleanUpgrade.resources | nindent 12 }}
{{- end }}
{{- end }} {{- end }}
chart/deps/redis/values.yaml
View file @ 8570696d
...@@ -23,6 +23,13 @@ monitoring: ...@@ -23,6 +23,13 @@ monitoring:
cleanUpgrade: cleanUpgrade:
enabled: true enabled: true
image: "registry1.dso.mil/ironbank/big-bang/base:8.4" image: "registry1.dso.mil/ironbank/big-bang/base:8.4"
resources:
requests:
memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
# NOTE: We default this to true in case packages consuming Redis forget to turn it on and have API traffic blocked # NOTE: We default this to true in case packages consuming Redis forget to turn it on and have API traffic blocked
networkPolicies: networkPolicies:
...@@ -879,8 +886,12 @@ sentinel: ...@@ -879,8 +886,12 @@ sentinel:
## @param sentinel.resources.requests The requested resources for the Redis(TM) Sentinel containers ## @param sentinel.resources.requests The requested resources for the Redis(TM) Sentinel containers
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## Configure Container Security Context ## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param sentinel.containerSecurityContext.enabled Enabled Redis(TM) Sentinel containers' Security Context ## @param sentinel.containerSecurityContext.enabled Enabled Redis(TM) Sentinel containers' Security Context
...@@ -1123,8 +1134,12 @@ metrics: ...@@ -1123,8 +1134,12 @@ metrics:
## @param metrics.resources.requests The requested resources for the Redis(TM) exporter container ## @param metrics.resources.requests The requested resources for the Redis(TM) exporter container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## @param metrics.podLabels Extra labels for Redis(TM) exporter pods ## @param metrics.podLabels Extra labels for Redis(TM) exporter pods
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
## ##
...@@ -1209,8 +1224,12 @@ metrics: ...@@ -1209,8 +1224,12 @@ metrics:
## @param metrics.sentinel.resources.requests The requested resources for the Redis(TM) Sentinel exporter container ## @param metrics.sentinel.resources.requests The requested resources for the Redis(TM) Sentinel exporter container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## Redis(TM) Sentinel exporter service parameters ## Redis(TM) Sentinel exporter service parameters
## ##
service: service:
...@@ -1364,8 +1383,12 @@ volumePermissions: ...@@ -1364,8 +1383,12 @@ volumePermissions:
## @param volumePermissions.resources.requests The requested resources for the init container ## @param volumePermissions.resources.requests The requested resources for the init container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## Init container Container Security Context ## Init container Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser
...@@ -1416,5 +1439,9 @@ sysctl: ...@@ -1416,5 +1439,9 @@ sysctl:
## @param sysctl.resources.requests The requested resources for the init container ## @param sysctl.resources.requests The requested resources for the init container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
chart/templates/bigbang/db/ensure-anchore-db.yaml
View file @ 8570696d
...@@ -61,6 +61,8 @@ spec: ...@@ -61,6 +61,8 @@ spec:
- secretRef: - secretRef:
name: anchore-db-credentials name: anchore-db-credentials
{{- end }} {{- end }}
resources:
{{ toYaml .Values.ensureDbJobs.resources | nindent 12 }}
restartPolicy: OnFailure restartPolicy: OnFailure
{{- end }} {{- end }}
{{- end }} {{- end }}
chart/templates/bigbang/db/ensure-feeds-db.yaml
View file @ 8570696d
...@@ -61,6 +61,8 @@ spec: ...@@ -61,6 +61,8 @@ spec:
- secretRef: - secretRef:
name: feeds-db-credentials name: feeds-db-credentials
{{- end }} {{- end }}
resources:
{{ toYaml .Values.ensureDbJobs.resources | nindent 12 }}
restartPolicy: OnFailure restartPolicy: OnFailure
{{- end }} {{- end }}
{{- end }} {{- end }}
chart/templates/bigbang/sso/configure-sso.yaml
View file @ 8570696d
...@@ -61,6 +61,8 @@ spec: ...@@ -61,6 +61,8 @@ spec:
- name: anchore-sso - name: anchore-sso
mountPath: "/tmp" mountPath: "/tmp"
readOnly: true readOnly: true
resources:
{{ toYaml .Values.sso.resources | nindent 12 }}
volumes: volumes:
- name: anchore-sso - name: anchore-sso
secret: secret:
......
chart/templates/engine_upgrade_job.yaml
View file @ 8570696d
...@@ -109,6 +109,8 @@ spec: ...@@ -109,6 +109,8 @@ spec:
mountPath: /home/anchore/certs/ mountPath: /home/anchore/certs/
readOnly: true readOnly: true
{{- end }} {{- end }}
resources:
{{ toYaml .Values.anchoreEngineUpgradeJob.resources | nindent 10 }}
{{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }} {{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }}
volumes: volumes:
{{- with .Values.anchoreGlobal.certStoreSecretName }} {{- with .Values.anchoreGlobal.certStoreSecretName }}
......
chart/templates/enterprise_feeds_upgrade_job.yaml
View file @ 8570696d
...@@ -100,6 +100,8 @@ spec: ...@@ -100,6 +100,8 @@ spec:
mountPath: /home/anchore/certs/ mountPath: /home/anchore/certs/
readOnly: true readOnly: true
{{- end }} {{- end }}
resources:
{{ toYaml .Values.anchoreEnterpriseFeedsUpgradeJob.resources | nindent 10 }}
{{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }} {{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }}
volumes: volumes:
{{- with .Values.anchoreGlobal.certStoreSecretName }} {{- with .Values.anchoreGlobal.certStoreSecretName }}
......
chart/templates/enterprise_upgrade_job.yaml
View file @ 8570696d
...@@ -97,6 +97,8 @@ spec: ...@@ -97,6 +97,8 @@ spec:
mountPath: /home/anchore/certs/ mountPath: /home/anchore/certs/
readOnly: true readOnly: true
{{- end }} {{- end }}
resources:
{{ toYaml .Values.anchoreEnterpriseEngineUpgradeJob.resources | nindent 10 }}
{{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }} {{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }}
volumes: volumes:
{{- with .Values.anchoreGlobal.certStoreSecretName }} {{- with .Values.anchoreGlobal.certStoreSecretName }}
......
chart/templates/tests/test-scripts.yaml
View file @ 8570696d
{{- include "bb-test-lib.script-configmap.base" . }} {{- include "gluon.tests.script-configmap.base" .}}
--- ---
{{- include "bb-test-lib.script-runner.base" . }} {{- include "gluon.tests.script-runner.base" .}}
\ No newline at end of file \ No newline at end of file
chart/values.yaml
View file @ 8570696d
...@@ -37,6 +37,16 @@ postgresqlSuperUser: ...@@ -37,6 +37,16 @@ postgresqlSuperUser:
postgresUsername: "" postgresUsername: ""
postgresPassword: "" postgresPassword: ""
# Configure resource requests and limits in ./chart/templates/bigbang/db/ensure-anchore-db.yaml and ./chart/templates/bigbang/db/ensure-feeds-db.yaml
ensureDbJobs:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Enable Prometheus Monitoring # Enable Prometheus Monitoring
monitoring: monitoring:
enabled: false enabled: false
...@@ -61,7 +71,14 @@ sso: ...@@ -61,7 +71,14 @@ sso:
requireSignedAssertions: false requireSignedAssertions: false
requireSignedResponse: true requireSignedResponse: true
idpMetadataUrl: "https://login.dso.mil/auth/realms/baby-yoda/protocol/saml/descriptor" idpMetadataUrl: "https://login.dso.mil/auth/realms/baby-yoda/protocol/saml/descriptor"
# Configure resource requests and limits in the ./chart/templates/bigbang/sso/configure-sso.yaml job
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Upstream Anchore Values # Upstream Anchore Values
# ----------------------- # -----------------------
...@@ -88,6 +105,25 @@ postgresql: ...@@ -88,6 +105,25 @@ postgresql:
size: 20Gi size: 20Gi
subPath: "pgdata" subPath: "pgdata"
mountPath: /var/lib/postgresql mountPath: /var/lib/postgresql
# Configure resource limits and requests for the postgresql deployment
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Configure resource limits and requests for postgresql metrics (disabled by default)
metrics:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Set the configs to allow listening and connecting from other pods # Set the configs to allow listening and connecting from other pods
postgresConfig: {"listen_addresses": "*"} postgresConfig: {"listen_addresses": "*"}
...@@ -427,13 +463,13 @@ anchoreAnalyzer: ...@@ -427,13 +463,13 @@ anchoreAnalyzer:
# db_update_enabled: true # db_update_enabled: true
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 4G memory: 1000Mi
# requests: requests:
# cpu: 1 cpu: 500m
# memory: 1G memory: 1000Mi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -464,13 +500,13 @@ anchoreApi: ...@@ -464,13 +500,13 @@ anchoreApi:
# hostname: anchore-api.example.com # hostname: anchore-api.example.com
# port: 8443 # port: 8443
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 4G memory: 4G
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 1G memory: 4G
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -622,13 +658,13 @@ anchoreCatalog: ...@@ -622,13 +658,13 @@ anchoreCatalog:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 2G memory: 2Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 500M memory: 2Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -694,13 +730,13 @@ anchorePolicyEngine: ...@@ -694,13 +730,13 @@ anchorePolicyEngine:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 4G memory: 3Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 1G memory: 3Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -724,13 +760,13 @@ anchoreSimpleQueue: ...@@ -724,13 +760,13 @@ anchoreSimpleQueue:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 4G
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 4G
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -741,6 +777,15 @@ anchoreSimpleQueue: ...@@ -741,6 +777,15 @@ anchoreSimpleQueue:
# Pod configuration for the helm post-install-hook engine upgrade Job # Pod configuration for the helm post-install-hook engine upgrade Job
anchoreEngineUpgradeJob: anchoreEngineUpgradeJob:
enabled: true enabled: true
resources:
limits:
cpu: 500m
memory: 1.5Gi
requests:
cpu: 500m
memory: 1.5Gi
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
...@@ -784,6 +829,25 @@ anchore-feeds-db: ...@@ -784,6 +829,25 @@ anchore-feeds-db:
subPath: "pgdata" subPath: "pgdata"
mountPath: /var/lib/postgresql mountPath: /var/lib/postgresql
# Configure resource limits and requests for the postgresql deployment
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Configure resource limits and requests for postgresql metrics (disabled by default)
metrics:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Set the configs to allow listening and connecting from other pods # Set the configs to allow listening and connecting from other pods
postgresConfig: {"listen_addresses": "*"} postgresConfig: {"listen_addresses": "*"}
pgHbaConf: |- pgHbaConf: |-
...@@ -866,13 +930,13 @@ anchoreEnterpriseFeeds: ...@@ -866,13 +930,13 @@ anchoreEnterpriseFeeds:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 1
# memory: 4G memory: 4G
# requests: requests:
# cpu: 1 cpu: 1
# memory: 2G memory: 4G
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -883,6 +947,15 @@ anchoreEnterpriseFeeds: ...@@ -883,6 +947,15 @@ anchoreEnterpriseFeeds:
# Pod configuration for the helm post-install-hook feeds upgrade Job # Pod configuration for the helm post-install-hook feeds upgrade Job
anchoreEnterpriseFeedsUpgradeJob: anchoreEnterpriseFeedsUpgradeJob:
enabled: true enabled: true
resources:
limits:
cpu: 500m
memory: 1.5Gi
requests:
cpu: 500m
memory: 1.5Gi
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
...@@ -907,20 +980,20 @@ anchoreEnterpriseRbac: ...@@ -907,20 +980,20 @@ anchoreEnterpriseRbac:
authPort: 8089 authPort: 8089
authResources: authResources:
limits: limits:
cpu: 500m cpu: 500m
memory: 1G memory: 1G
requests: requests:
cpu: 500m cpu: 500m
memory: 1G memory: 1G
managerResources: managerResources:
limits: limits:
cpu: 500m cpu: 1
memory: 1G memory: 4G
requests: requests:
cpu: 500m cpu: 1
memory: 1G memory: 4G
# Configure the Anchore Enterprise reporting component. # Configure the Anchore Enterprise reporting component.
anchoreEnterpriseReports: anchoreEnterpriseReports:
...@@ -950,13 +1023,13 @@ anchoreEnterpriseReports: ...@@ -950,13 +1023,13 @@ anchoreEnterpriseReports:
service: service:
port: 8558 port: 8558
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 3Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 3Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -984,13 +1057,13 @@ anchoreEnterpriseNotifications: ...@@ -984,13 +1057,13 @@ anchoreEnterpriseNotifications:
service: service:
port: 8668 port: 8668
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 1.5Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 1.5Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -1093,13 +1166,13 @@ anchoreEnterpriseUi: ...@@ -1093,13 +1166,13 @@ anchoreEnterpriseUi:
labels: {} labels: {}
sessionAffinity: ClientIP sessionAffinity: ClientIP
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 1.5Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 1.5Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -1123,6 +1196,15 @@ anchore-ui-redis: ...@@ -1123,6 +1196,15 @@ anchore-ui-redis:
# Pod configuration for the helm post-install-hook enterprise engine upgrade Job # Pod configuration for the helm post-install-hook enterprise engine upgrade Job
anchoreEnterpriseEngineUpgradeJob: anchoreEnterpriseEngineUpgradeJob:
enabled: true enabled: true
resources:
limits:
cpu: 500m
memory: 1.5Gi
requests:
cpu: 500m
memory: 1.5Gi
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

UNCLASSIFIED