Affinity is exposed through values options for Anchore. If you want to schedule your pods to deploy on specific nodes you can do that through the `nodeSelector` value and as needed the `affinity` value. Additional info is provided below as well to help in configuring this.
Affinity is exposed through values options for Anchore. If you want to schedule your pods to deploy on specific nodes you can do that through the `nodeSelector` value and as needed the `affinity` value. Additional info is provided below as well to help in configuring this.
It is good to have a basic knowledge of node affinity and available options to you before customizing in this way - the upstream kubernetes documentation [has a good walkthrough of this](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity).
It is good to have a basic knowledge of node affinity and available options to you before customizing in this way - the upstream kubernetes documentation [has a good walk-through of this](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity).
@@ -8,16 +8,16 @@ Each of these services can be scaled and configured independently.
...
@@ -8,16 +8,16 @@ Each of these services can be scaled and configured independently.
See [Anchore Engine](https://github.com/anchore/anchore-engine) for more project details.
See [Anchore Engine](https://github.com/anchore/anchore-engine) for more project details.
NOTE: Big Bang's implementation is designed to be enabled and consumed from within a customer implementation of the Big Bang release. It is fully functional as a standalone Helm install, but Big Bang will enable best integration for Big Bang "extras" and ease of use.
NOTE: Big Bang's implementation is designed to be enabled and consumed from within a customer implementation of the Big Bang release. It is fully functional as a standalone Helm install, but Big Bang will enable best integration for Big Bang "extras" and ease of use.
## Chart Details
## Chart Details
The chart is split into global and service specific configurations for the OSS Anchore Engine, as well as global and services specific configurations for the Enterprise components. Additionally included are Big Bang specific configs.
The chart is split into global and service specific configurations for the OSS Anchore Engine, as well as global and services specific configurations for the Enterprise components. Additionally included are Big Bang specific configs.
* The top section provides customizable Big Bang values for SSO, Istio, and automating the license secret creation for enterprise.
* The top section provides customizable Big Bang values for SSO, Istio, and automating the license secret creation for enterprise.
* The `anchoreGlobal` section is for configuration values required by all Anchore Engine components.
* The `anchoreGlobal` section is for configuration values required by all Anchore Engine components.
* The `anchoreEnterpriseGlobal` section is for configuration values required by all Anchore Engine Enterprise components.
* The `anchoreEnterpriseGlobal` section is for configuration values required by all Anchore Engine Enterprise components.
* Service specific configuration values allow customization for each individual service.
* Service specific configuration values allow customization for each individual service.
For a description of each component, view the official documentation at: [Anchore Enterprise Service Overview](https://docs.anchore.com/current/docs/overview/architecture/)
For a description of each component, view the official documentation at: [Anchore Enterprise Service Overview](https://docs.anchore.com/current/docs/overview/architecture/)
...
@@ -59,15 +59,15 @@ stringData:
...
@@ -59,15 +59,15 @@ stringData:
The following features are available to Anchore Enterprise customers. Please contact the Anchore team for more information about getting a license for the enterprise features. [Anchore Enterprise Demo](https://anchore.com/demo/)
The following features are available to Anchore Enterprise customers. Please contact the Anchore team for more information about getting a license for the enterprise features. [Anchore Enterprise Demo](https://anchore.com/demo/)
* Role based access control
* Role based access control
* LDAP integration
* LDAP integration
* Graphical user interface
* Graphical user interface
* Customizable UI dashboards
* Customizable UI dashboards
* On-premises feeds service
* On-premises feeds service
* Proprietary vulnerability data feed (vulnDB, MSRC)
* Proprietary vulnerability data feed (vulnDB, MSRC)
* Anchore reporting API
* Anchore reporting API
* Notifications - Slack, GitHub, Jira, etc
* Notifications - Slack, GitHub, Jira, etc
* Microsoft image vulnerability scanning
* Microsoft image vulnerability scanning
### Enabling Enterprise Services
### Enabling Enterprise Services
...
@@ -179,6 +179,7 @@ stringData:
...
@@ -179,6 +179,7 @@ stringData:
### Configuring Istio
### Configuring Istio
Istio can be configured to utilize your desired gateway(s) and host(s). To configure istio, pass the following options to the Anchore values:
Istio can be configured to utilize your desired gateway(s) and host(s). To configure istio, pass the following options to the Anchore values:
@@ -10,7 +10,7 @@ This repo contains Big Bang's implementation of Anchore. This includes the upstr
...
@@ -10,7 +10,7 @@ This repo contains Big Bang's implementation of Anchore. This includes the upstr
-[Chart](./CHART.md)
-[Chart](./CHART.md)
-[Affinity](./Affinity.md)
-[Affinity](./Affinity.md)
# Structure
## Structure
This repo contains 3 main sections. The main chart is provided under the `chart` folder. Documentation is provided under the `docs` folder. Test and CI files are under the `tests` folder.
This repo contains 3 main sections. The main chart is provided under the `chart` folder. Documentation is provided under the `docs` folder. Test and CI files are under the `tests` folder.
Anchore Enterprise provides container inspection and compliance solutions. It protects against internal and external threats, enforces
Anchore Enterprise provides container inspection and compliance solutions. It protects against internal and external threats, enforces
security best practices, and speed up DevSecOps workflows. Anchore Enterprise integrates seamlessly to enforce defined polices.
security best practices, and speed up DevSecOps workflows. Anchore Enterprise integrates seamlessly to enforce defined polices.
Anchore Enterprises can be installed using the [Helm Chart](https://github.com/anchore/anchore-charts/tree/master/stable/anchore-engine), integrated into container based CI/CD
Anchore Enterprises can be installed using the [Helm Chart](https://github.com/anchore/anchore-charts/tree/master/stable/anchore-engine), integrated into container based CI/CD
pipeline with a [Jenkins Plugin](https://plugins.jenkins.io/anchore-container-scanner/), and used with the GitLab CI pipelines with the [GitLab integration guide](https://docs.anchore.com/current/docs/using/integration/ci_cd/gitlab/).
pipeline with a [Jenkins Plugin](https://plugins.jenkins.io/anchore-container-scanner/), and used with the GitLab CI pipelines with the [GitLab integration guide](https://docs.anchore.com/current/docs/using/integration/ci_cd/gitlab/).
Anchore Enterprise supports user login to the User Interface through identities from external identity providers that support Security Assertion Markup Language (SAML). Anchore
Anchore Enterprise supports user login to the User Interface through identities from external identity providers that support Security Assertion Markup Language (SAML). Anchore
does not store any user credentials. However, usernames and anchore permissions are stored. The identity provider validates the user's access while an external provider validates the username and all first time user login information.
does not store any user credentials. However, usernames and anchore permissions are stored. The identity provider validates the user's access while an external provider validates the username and all first time user login information.
The Anchore Enterprise deployment must be configured to utilize the SAML SSO.
The Anchore Enterprise deployment must be configured to utilize the SAML SSO.
- It is required to Enable Oauth to ensure that Anchore can issue bearer tokens for subsequent API usage by the UI to the system APIs.
- It is required to Enable Oauth to ensure that Anchore can issue bearer tokens for subsequent API usage by the UI to the system APIs.
- Hashed passwords are recommended.
- Hashed passwords are recommended.
- From the user's browser, reach the Identity Provider's login URL.
- From the user's browser, reach the Identity Provider's login URL.
- Access the metadata XML endpoint in the Identity Provider.
- Access the metadata XML endpoint in the Identity Provider.
Configuration of SAML SSO is done using API/UI operations but requires configuration both in the user's Identity Provider and within Anchore.
Configuration of SAML SSO is done using API/UI operations but requires configuration both in the user's Identity Provider and within Anchore.
...
@@ -21,6 +20,6 @@ The Identity Provider must:
...
@@ -21,6 +20,6 @@ The Identity Provider must:
- Support HTTP Redirect binding
- Support HTTP Redirect binding
- Support signed assertions and signed documents
- Support signed assertions and signed documents
- Allow unsigned client requests from Anchore
- Allow unsigned client requests from Anchore
- Allow unencrypted requests and responses
- Allow unencrypted requests and responses
Click the [link](https://docs.anchore.com/current/docs/overview/sso/) for more Anchore security information.
Click the [link](https://docs.anchore.com/current/docs/overview/sso/) for more Anchore security information.