UNCLASSIFIED

Skip to content

GitLab

Commit 8570696d authored by bhearn's avatar bhearn
Browse files

set container resources

parent e2a27a8a
Hide whitespace changes
Inline Side-by-side
Showing with 233 additions and 102 deletions
CHANGELOG.md
View file @ 8570696d
...@@ -4,6 +4,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ...@@ -4,6 +4,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
--- ---
## [1.13.0-bb.6]
## Changed
- updated bb-test-lib dependency to gluon `0.2.3` to resolve OPA Gatekeeper violations
- updated Redis dependency to `14.1.0-bb.3` to resolve OPA Gatekeeper violations
- set resource requests and limits for all containers to resolve OPA Gatekeeper violations
- set resource requests and limits equal to eachother to resolve OPA Gatekeeper violations
## [1.13.0-bb.5] ## [1.13.0-bb.5]
## Added ## Added
- `.Values.postgresqlSuperUser.postgresUsername` and `.Values.postgresqlSuperUser.postgresPassword` for conditionally changing the commands in the ensure db jobs to allow for finer-grain postgres user permissions - `.Values.postgresqlSuperUser.postgresUsername` and `.Values.postgresqlSuperUser.postgresPassword` for conditionally changing the commands in the ensure db jobs to allow for finer-grain postgres user permissions
......
chart/Chart.lock
View file @ 8570696d
...@@ -7,9 +7,9 @@ dependencies: ...@@ -7,9 +7,9 @@ dependencies:
version: 1.0.1 version: 1.0.1
- name: redis - name: redis
repository: file://./deps/redis repository: file://./deps/redis
version: 14.1.0-bb.2 version: 14.1.0-bb.3
- name: bb-test-lib - name: gluon
repository: oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates repository: oci://registry.dso.mil/platform-one/big-bang/apps/library-charts/gluon
version: 0.5.2 version: 0.2.3
digest: sha256:b6031a1579e20adfbd8f708ede7fc9665a21a5c030ca7304af18acdff3b56150 digest: sha256:18e2ebc2abf59245eb530874f5c9aab50f3041a4959aa6534b6411810191d078
generated: "2021-07-13T16:37:10.13824-04:00" generated: "2021-08-18T14:00:09.786881-04:00"
chart/Chart.yaml
View file @ 8570696d
apiVersion: v2 apiVersion: v2
name: anchore-engine name: anchore-engine
version: 1.13.0-bb.5 version: 1.13.0-bb.6
appVersion: 0.10.0 appVersion: 0.10.0
description: Anchore container analysis and policy evaluation engine service description: Anchore container analysis and policy evaluation engine service
keywords: keywords:
...@@ -33,10 +33,10 @@ dependencies: ...@@ -33,10 +33,10 @@ dependencies:
condition: anchore-feeds-db.enabled,anchoreEnterpriseGlobal.enabled condition: anchore-feeds-db.enabled,anchoreEnterpriseGlobal.enabled
alias: anchore-feeds-db alias: anchore-feeds-db
- name: redis - name: redis
version: "14.1.0-bb.2" version: "14.1.0-bb.3"
repository: "file://./deps/redis" repository: "file://./deps/redis"
condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled
alias: anchore-ui-redis alias: anchore-ui-redis
- name: bb-test-lib - name: gluon
version: "0.5.2" version: "0.2.3"
repository: "oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates" repository: oci://registry.dso.mil/platform-one/big-bang/apps/library-charts/gluon
\ No newline at end of file
chart/deps/redis/Chart.yaml
View file @ 8570696d
...@@ -25,4 +25,4 @@ name: redis ...@@ -25,4 +25,4 @@ name: redis
sources: sources:
- https://github.com/bitnami/bitnami-docker-redis - https://github.com/bitnami/bitnami-docker-redis
- http://redis.io/ - http://redis.io/
version: 14.1.0-bb.2 version: 14.1.0-bb.3
chart/deps/redis/Kptfile
View file @ 8570696d
...@@ -5,7 +5,7 @@ metadata: ...@@ -5,7 +5,7 @@ metadata:
upstream: upstream:
type: git type: git
git: git:
commit: ca398b827ba384da78213d9b2f21abf83a9eea8a commit: f24af16a6d583e9e125f519127ffab11f48f42f8
repo: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/redis repo: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/redis
directory: /chart directory: /chart
ref: 14.1.0-bb.2 ref: 14.1.0-bb.3
chart/deps/redis/templates/bigbang/redis-upgrade.yaml
View file @ 8570696d
...@@ -124,4 +124,7 @@ spec: ...@@ -124,4 +124,7 @@ spec:
echo "No PVCs to clean up." echo "No PVCs to clean up."
fi fi
echo "Done with upgrade steps." echo "Done with upgrade steps."
{{- if .Values.cleanUpgrade.resources }}
resources: {{- toYaml .Values.cleanUpgrade.resources | nindent 12 }}
{{- end }}
{{- end }} {{- end }}
chart/deps/redis/values.yaml
View file @ 8570696d
...@@ -23,6 +23,13 @@ monitoring: ...@@ -23,6 +23,13 @@ monitoring:
cleanUpgrade: cleanUpgrade:
enabled: true enabled: true
image: "registry1.dso.mil/ironbank/big-bang/base:8.4" image: "registry1.dso.mil/ironbank/big-bang/base:8.4"
resources:
requests:
memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
# NOTE: We default this to true in case packages consuming Redis forget to turn it on and have API traffic blocked # NOTE: We default this to true in case packages consuming Redis forget to turn it on and have API traffic blocked
networkPolicies: networkPolicies:
...@@ -879,8 +886,12 @@ sentinel: ...@@ -879,8 +886,12 @@ sentinel:
## @param sentinel.resources.requests The requested resources for the Redis(TM) Sentinel containers ## @param sentinel.resources.requests The requested resources for the Redis(TM) Sentinel containers
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## Configure Container Security Context ## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param sentinel.containerSecurityContext.enabled Enabled Redis(TM) Sentinel containers' Security Context ## @param sentinel.containerSecurityContext.enabled Enabled Redis(TM) Sentinel containers' Security Context
...@@ -1123,8 +1134,12 @@ metrics: ...@@ -1123,8 +1134,12 @@ metrics:
## @param metrics.resources.requests The requested resources for the Redis(TM) exporter container ## @param metrics.resources.requests The requested resources for the Redis(TM) exporter container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## @param metrics.podLabels Extra labels for Redis(TM) exporter pods ## @param metrics.podLabels Extra labels for Redis(TM) exporter pods
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
## ##
...@@ -1209,8 +1224,12 @@ metrics: ...@@ -1209,8 +1224,12 @@ metrics:
## @param metrics.sentinel.resources.requests The requested resources for the Redis(TM) Sentinel exporter container ## @param metrics.sentinel.resources.requests The requested resources for the Redis(TM) Sentinel exporter container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## Redis(TM) Sentinel exporter service parameters ## Redis(TM) Sentinel exporter service parameters
## ##
service: service:
...@@ -1364,8 +1383,12 @@ volumePermissions: ...@@ -1364,8 +1383,12 @@ volumePermissions:
## @param volumePermissions.resources.requests The requested resources for the init container ## @param volumePermissions.resources.requests The requested resources for the init container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
## Init container Container Security Context ## Init container Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser
...@@ -1416,5 +1439,9 @@ sysctl: ...@@ -1416,5 +1439,9 @@ sysctl:
## @param sysctl.resources.requests The requested resources for the init container ## @param sysctl.resources.requests The requested resources for the init container
## ##
resources: resources:
limits: {} requests:
requests: {} memory: 256Mi
cpu: 100m
limits:
memory: 256Mi
cpu: 100m
chart/templates/bigbang/db/ensure-anchore-db.yaml
View file @ 8570696d
...@@ -61,6 +61,8 @@ spec: ...@@ -61,6 +61,8 @@ spec:
- secretRef: - secretRef:
name: anchore-db-credentials name: anchore-db-credentials
{{- end }} {{- end }}
resources:
{{ toYaml .Values.ensureDbJobs.resources | nindent 12 }}
restartPolicy: OnFailure restartPolicy: OnFailure
{{- end }} {{- end }}
{{- end }} {{- end }}
chart/templates/bigbang/db/ensure-feeds-db.yaml
View file @ 8570696d
...@@ -61,6 +61,8 @@ spec: ...@@ -61,6 +61,8 @@ spec:
- secretRef: - secretRef:
name: feeds-db-credentials name: feeds-db-credentials
{{- end }} {{- end }}
resources:
{{ toYaml .Values.ensureDbJobs.resources | nindent 12 }}
restartPolicy: OnFailure restartPolicy: OnFailure
{{- end }} {{- end }}
{{- end }} {{- end }}
chart/templates/bigbang/sso/configure-sso.yaml
View file @ 8570696d
...@@ -61,6 +61,8 @@ spec: ...@@ -61,6 +61,8 @@ spec:
- name: anchore-sso - name: anchore-sso
mountPath: "/tmp" mountPath: "/tmp"
readOnly: true readOnly: true
resources:
{{ toYaml .Values.sso.resources | nindent 12 }}
volumes: volumes:
- name: anchore-sso - name: anchore-sso
secret: secret:
......
chart/templates/engine_upgrade_job.yaml
View file @ 8570696d
...@@ -109,6 +109,8 @@ spec: ...@@ -109,6 +109,8 @@ spec:
mountPath: /home/anchore/certs/ mountPath: /home/anchore/certs/
readOnly: true readOnly: true
{{- end }} {{- end }}
resources:
{{ toYaml .Values.anchoreEngineUpgradeJob.resources | nindent 10 }}
{{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }} {{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }}
volumes: volumes:
{{- with .Values.anchoreGlobal.certStoreSecretName }} {{- with .Values.anchoreGlobal.certStoreSecretName }}
......
chart/templates/enterprise_feeds_upgrade_job.yaml
View file @ 8570696d
...@@ -100,6 +100,8 @@ spec: ...@@ -100,6 +100,8 @@ spec:
mountPath: /home/anchore/certs/ mountPath: /home/anchore/certs/
readOnly: true readOnly: true
{{- end }} {{- end }}
resources:
{{ toYaml .Values.anchoreEnterpriseFeedsUpgradeJob.resources | nindent 10 }}
{{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }} {{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }}
volumes: volumes:
{{- with .Values.anchoreGlobal.certStoreSecretName }} {{- with .Values.anchoreGlobal.certStoreSecretName }}
......
chart/templates/enterprise_upgrade_job.yaml
View file @ 8570696d
...@@ -97,6 +97,8 @@ spec: ...@@ -97,6 +97,8 @@ spec:
mountPath: /home/anchore/certs/ mountPath: /home/anchore/certs/
readOnly: true readOnly: true
{{- end }} {{- end }}
resources:
{{ toYaml .Values.anchoreEnterpriseEngineUpgradeJob.resources | nindent 10 }}
{{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }} {{- if or .Values.anchoreGlobal.certStoreSecretName .Values.cloudsql.useExistingServiceAcc }}
volumes: volumes:
{{- with .Values.anchoreGlobal.certStoreSecretName }} {{- with .Values.anchoreGlobal.certStoreSecretName }}
......
chart/templates/tests/test-scripts.yaml
View file @ 8570696d
{{- include "bb-test-lib.script-configmap.base" . }} {{- include "gluon.tests.script-configmap.base" .}}
--- ---
{{- include "bb-test-lib.script-runner.base" . }} {{- include "gluon.tests.script-runner.base" .}}
\ No newline at end of file \ No newline at end of file
chart/values.yaml
View file @ 8570696d
...@@ -37,6 +37,16 @@ postgresqlSuperUser: ...@@ -37,6 +37,16 @@ postgresqlSuperUser:
postgresUsername: "" postgresUsername: ""
postgresPassword: "" postgresPassword: ""
# Configure resource requests and limits in ./chart/templates/bigbang/db/ensure-anchore-db.yaml and ./chart/templates/bigbang/db/ensure-feeds-db.yaml
ensureDbJobs:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Enable Prometheus Monitoring # Enable Prometheus Monitoring
monitoring: monitoring:
enabled: false enabled: false
...@@ -61,7 +71,14 @@ sso: ...@@ -61,7 +71,14 @@ sso:
requireSignedAssertions: false requireSignedAssertions: false
requireSignedResponse: true requireSignedResponse: true
idpMetadataUrl: "https://login.dso.mil/auth/realms/baby-yoda/protocol/saml/descriptor" idpMetadataUrl: "https://login.dso.mil/auth/realms/baby-yoda/protocol/saml/descriptor"
# Configure resource requests and limits in the ./chart/templates/bigbang/sso/configure-sso.yaml job
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Upstream Anchore Values # Upstream Anchore Values
# ----------------------- # -----------------------
...@@ -88,6 +105,25 @@ postgresql: ...@@ -88,6 +105,25 @@ postgresql:
size: 20Gi size: 20Gi
subPath: "pgdata" subPath: "pgdata"
mountPath: /var/lib/postgresql mountPath: /var/lib/postgresql
# Configure resource limits and requests for the postgresql deployment
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Configure resource limits and requests for postgresql metrics (disabled by default)
metrics:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Set the configs to allow listening and connecting from other pods # Set the configs to allow listening and connecting from other pods
postgresConfig: {"listen_addresses": "*"} postgresConfig: {"listen_addresses": "*"}
...@@ -427,13 +463,13 @@ anchoreAnalyzer: ...@@ -427,13 +463,13 @@ anchoreAnalyzer:
# db_update_enabled: true # db_update_enabled: true
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 4G memory: 1000Mi
# requests: requests:
# cpu: 1 cpu: 500m
# memory: 1G memory: 1000Mi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -464,13 +500,13 @@ anchoreApi: ...@@ -464,13 +500,13 @@ anchoreApi:
# hostname: anchore-api.example.com # hostname: anchore-api.example.com
# port: 8443 # port: 8443
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 4G memory: 4G
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 1G memory: 4G
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -622,13 +658,13 @@ anchoreCatalog: ...@@ -622,13 +658,13 @@ anchoreCatalog:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 2G memory: 2Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 500M memory: 2Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -694,13 +730,13 @@ anchorePolicyEngine: ...@@ -694,13 +730,13 @@ anchorePolicyEngine:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 4G memory: 3Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 1G memory: 3Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -724,13 +760,13 @@ anchoreSimpleQueue: ...@@ -724,13 +760,13 @@ anchoreSimpleQueue:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 4G
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 4G
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -741,6 +777,15 @@ anchoreSimpleQueue: ...@@ -741,6 +777,15 @@ anchoreSimpleQueue:
# Pod configuration for the helm post-install-hook engine upgrade Job # Pod configuration for the helm post-install-hook engine upgrade Job
anchoreEngineUpgradeJob: anchoreEngineUpgradeJob:
enabled: true enabled: true
resources:
limits:
cpu: 500m
memory: 1.5Gi
requests:
cpu: 500m
memory: 1.5Gi
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
...@@ -784,6 +829,25 @@ anchore-feeds-db: ...@@ -784,6 +829,25 @@ anchore-feeds-db:
subPath: "pgdata" subPath: "pgdata"
mountPath: /var/lib/postgresql mountPath: /var/lib/postgresql
# Configure resource limits and requests for the postgresql deployment
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Configure resource limits and requests for postgresql metrics (disabled by default)
metrics:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 100m
memory: 256Mi
# Set the configs to allow listening and connecting from other pods # Set the configs to allow listening and connecting from other pods
postgresConfig: {"listen_addresses": "*"} postgresConfig: {"listen_addresses": "*"}
pgHbaConf: |- pgHbaConf: |-
...@@ -866,13 +930,13 @@ anchoreEnterpriseFeeds: ...@@ -866,13 +930,13 @@ anchoreEnterpriseFeeds:
annotations: {} annotations: {}
labels: {} labels: {}
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 1
# memory: 4G memory: 4G
# requests: requests:
# cpu: 1 cpu: 1
# memory: 2G memory: 4G
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -883,6 +947,15 @@ anchoreEnterpriseFeeds: ...@@ -883,6 +947,15 @@ anchoreEnterpriseFeeds:
# Pod configuration for the helm post-install-hook feeds upgrade Job # Pod configuration for the helm post-install-hook feeds upgrade Job
anchoreEnterpriseFeedsUpgradeJob: anchoreEnterpriseFeedsUpgradeJob:
enabled: true enabled: true
resources:
limits:
cpu: 500m
memory: 1.5Gi
requests:
cpu: 500m
memory: 1.5Gi
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
...@@ -907,20 +980,20 @@ anchoreEnterpriseRbac: ...@@ -907,20 +980,20 @@ anchoreEnterpriseRbac:
authPort: 8089 authPort: 8089
authResources: authResources:
limits: limits:
cpu: 500m cpu: 500m
memory: 1G memory: 1G
requests: requests:
cpu: 500m cpu: 500m
memory: 1G memory: 1G
managerResources: managerResources:
limits: limits:
cpu: 500m cpu: 1
memory: 1G memory: 4G
requests: requests:
cpu: 500m cpu: 1
memory: 1G memory: 4G
# Configure the Anchore Enterprise reporting component. # Configure the Anchore Enterprise reporting component.
anchoreEnterpriseReports: anchoreEnterpriseReports:
...@@ -950,13 +1023,13 @@ anchoreEnterpriseReports: ...@@ -950,13 +1023,13 @@ anchoreEnterpriseReports:
service: service:
port: 8558 port: 8558
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 3Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 3Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -984,13 +1057,13 @@ anchoreEnterpriseNotifications: ...@@ -984,13 +1057,13 @@ anchoreEnterpriseNotifications:
service: service:
port: 8668 port: 8668
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 1.5Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 1.5Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -1093,13 +1166,13 @@ anchoreEnterpriseUi: ...@@ -1093,13 +1166,13 @@ anchoreEnterpriseUi:
labels: {} labels: {}
sessionAffinity: ClientIP sessionAffinity: ClientIP
# resources: resources:
# limits: limits:
# cpu: 1 cpu: 500m
# memory: 1G memory: 1.5Gi
# requests: requests:
# cpu: 100m cpu: 500m
# memory: 256M memory: 1.5Gi
labels: {} labels: {}
annotations: {} annotations: {}
...@@ -1123,6 +1196,15 @@ anchore-ui-redis: ...@@ -1123,6 +1196,15 @@ anchore-ui-redis:
# Pod configuration for the helm post-install-hook enterprise engine upgrade Job # Pod configuration for the helm post-install-hook enterprise engine upgrade Job
anchoreEnterpriseEngineUpgradeJob: anchoreEnterpriseEngineUpgradeJob:
enabled: true enabled: true
resources:
limits:
cpu: 500m
memory: 1.5Gi
requests:
cpu: 500m
memory: 1.5Gi
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

UNCLASSIFIED