Skip to content

Commit e51a7c9

Browse files
HN23zhillasomyaInfraInnovator
authored
Enterprise V5.10.0 Release (#407)
* fix: adds log_saml_assertions to the default config with value=false to facilitate better SSO debugging (#243) Signed-off-by: Zach Hill <[email protected]> * fix: adds log_saml_assertions to the default config with value=false to facilitate better SSO debugging (#243) Signed-off-by: Zach Hill <[email protected]> Signed-off-by: Hung Nguyen <[email protected]> * feat: chart for enterprise v5.10.0 helm chart for enterprise v5.10.0 with hosted feeds Signed-off-by: Arvind Somya <[email protected]> Signed-off-by: Hung Nguyen <[email protected]> * Adding test for dataSyncer resource (#245) * Added test for dataSyncer resource; updated common_helpers_test.yaml with the new dataSyncer test; updated .gitignore for vscode use Signed-off-by: Jesse Tamburino <[email protected]> * Updated tests and added missing tests Signed-off-by: Jesse Tamburino <[email protected]> * Bumped the version of the chart Signed-off-by: Jesse Tamburino <[email protected]> --------- Signed-off-by: Jesse Tamburino <[email protected]> Co-authored-by: Jesse Tamburino <[email protected]> Signed-off-by: Hung Nguyen <[email protected]> * fix readme removing unused code make osaa_config in line with default config license secret creation not dependent on useExistingSecrets bumping chart version for dev-sync to prod bump feeds app version to correct version Signed-off-by: Hung Nguyen <[email protected]> * fix: adds log_saml_assertions to the default config with value=false to facilitate better SSO debugging (#243) update readme adding tests update tests to add required values move required check into configmap Signed-off-by: Hung Nguyen <[email protected]> Signed-off-by: Zach Hill <[email protected]> --------- Signed-off-by: Zach Hill <[email protected]> Signed-off-by: Hung Nguyen <[email protected]> Signed-off-by: Arvind Somya <[email protected]> Signed-off-by: Jesse Tamburino <[email protected]> Co-authored-by: Zach Hill <[email protected]> Co-authored-by: Arvind Somya <[email protected]> Co-authored-by: Jesse <[email protected]> Co-authored-by: Jesse Tamburino <[email protected]>
1 parent cb3d666 commit e51a7c9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1089
-916
lines changed

‎.github/workflows/openshift-test.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ on:
44
pull_request:
55
paths:
66
- 'stable/enterprise/Chart.yaml'
7-
- 'stable/feeds/Chart.yaml'
87
- 'stable/ecs-inventory/Chart.yaml'
98
- 'stable/k8s-inventory/Chart.yaml'
109

@@ -129,7 +128,7 @@ jobs:
129128
mv ci/openshift-test.yaml ci/openshift-test-values.yaml
130129
popd
131130
done
132-
ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
131+
ct install --config ct-config.yaml --helm-extra-args "--timeout 600s" --helm-extra-set-args "--set=useExistingPullCredSecret=true--set=useExistingLicenseSecret=true --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers=[] --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types=[]"
133132
env:
134133
KUBECONFIG: ./tmp/kubeconfig
135134
TARGET_BRANCH: "${{ github.event.pull_request.base.ref }}"

‎.github/workflows/test.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -99,4 +99,4 @@ jobs:
9999
100100
- name: Run chart-testing
101101
if: steps.list-changed.outputs.CHANGED == 'true'
102-
run: ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
102+
run: ct install --config ct-config.yaml --helm-extra-args "--timeout 600s" --helm-extra-set-args "--set=useExistingPullCredSecret=true --set=useExistingLicenseSecret=true --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers=[] --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types=[]"

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ examples/
44
charts/
55
.idea/
66
*.code-workspace
7+
.DS_Store
8+
.vscode/

‎ct-config.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ chart-repos:
77
- bitnami=https://charts.bitnami.com/bitnami
88
namespace: anchore
99
release-label: anchore
10+
exclude-deprecated: true

‎stable/enterprise/Chart.lock

+2-5
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,5 @@ dependencies:
55
- name: redis
66
repository: oci://registry-1.docker.io/bitnamicharts
77
version: 17.11.8
8-
- name: feeds
9-
repository: https://charts.anchore.io/stable
10-
version: 2.9.0
11-
digest: sha256:794234e4be51cccf563f5efc4b205fef8042f1ddd3113c2578f839eb4b6e10dd
12-
generated: "2024-09-04T11:58:57.913094-04:00"
8+
digest: sha256:0ecd9810e416973f8bc4caa4641764b10ff5224edaecb1a5b66d3b1f82948537
9+
generated: "2024-08-15T22:30:42.63806-07:00"

‎stable/enterprise/Chart.yaml

+2-12
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: enterprise
3-
version: "2.10.0"
4-
appVersion: "5.9.0"
3+
version: "3.0.0"
4+
appVersion: "5.10.0"
55
kubeVersion: 1.23.x - 1.30.x || 1.23.x-x - 1.30.x-x
66
description: |
77
Anchore Enterprise is a complete container security workflow solution for professional teams. Easily integrating with CI/CD systems,
@@ -38,13 +38,3 @@ dependencies:
3838
repository: "oci://registry-1.docker.io/bitnamicharts"
3939
condition: ui-redis.chartEnabled
4040
alias: ui-redis
41-
- name: feeds
42-
version: "~2"
43-
repository: "@anchore"
44-
# repository: file://../feeds
45-
condition: feeds.chartEnabled
46-
import-values:
47-
- child: service
48-
parent: feeds.service
49-
- child: anchoreConfig.internalServicesSSL
50-
parent: feeds.anchoreConfig.internalServicesSSL

‎stable/enterprise/README.md

+140-449
Large diffs are not rendered by default.

‎stable/enterprise/ci/openshift-test.yaml

+1-4
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@ securityContext:
22
fsGroup: null
33
runAsGroup: null
44
runAsUser: null
5-
feeds:
6-
chartEnabled: false
7-
url: "my-release-feeds"
85
postgresql:
96
primary:
107
containerSecurityContext:
@@ -16,4 +13,4 @@ ui-redis:
1613
podSecurityContext:
1714
enabled: false
1815
containerSecurityContext:
19-
enabled: false
16+
enabled: false

‎stable/enterprise/files/default_config.yaml

+20-8
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@ audit:
5555
- "/user/api-keys/{key_name}"
5656
- "/user/credentials"
5757

58-
5958
metrics:
6059
enabled: ${ANCHORE_ENABLE_METRICS}
6160
auth_disabled: ${ANCHORE_DISABLE_METRICS_AUTH}
@@ -82,6 +81,7 @@ user_authentication:
8281
max_api_keys_per_user: {{ .Values.anchoreConfig.user_authentication.max_api_keys_per_user }}
8382
remove_deleted_user_api_keys_older_than_days: {{ .Values.anchoreConfig.user_authentication.remove_deleted_user_api_keys_older_than_days }}
8483
disallow_native_users: {{ .Values.anchoreConfig.user_authentication.disallow_native_users }}
84+
log_saml_assertions: {{ .Values.anchoreConfig.user_authentication.log_saml_assertions }}
8585
credentials:
8686
database:
8787
user: "${ANCHORE_DB_USER}"
@@ -199,14 +199,10 @@ services:
199199
data:
200200
grypedb:
201201
enabled: true
202-
url: {{ template "enterprise.grypeProviderURL" . }}
203-
packages:
204-
enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
205-
url: {{ template "enterprise.feedsURL" . }}
206-
vulnerability_annotations:
207-
enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
208-
url: {{ template "enterprise.feedsURL" . }}
209202
matching:
203+
exclude:
204+
providers: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers }}
205+
package_types: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types }}
210206
default:
211207
search:
212208
by_cpe:
@@ -295,3 +291,19 @@ services:
295291
ssl_enable: ${ANCHORE_SSL_ENABLED}
296292
ssl_cert: ${ANCHORE_SSL_CERT}
297293
ssl_key: ${ANCHORE_SSL_KEY}
294+
295+
data_syncer:
296+
enabled: true
297+
require_auth: true
298+
endpoint_hostname: ${ANCHORE_ENDPOINT_HOSTNAME}
299+
listen: 0.0.0.0
300+
port: ${ANCHORE_PORT}
301+
auto_sync_enabled: true
302+
upload_dir: {{ .Values.scratchVolume.mountPath }}
303+
datasets:
304+
vulnerability_db:
305+
versions: ["5"]
306+
clamav_db:
307+
versions: ["1"]
308+
kev_db:
309+
versions: ["1"]

‎stable/enterprise/files/osaa_config.yaml

+57-9
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
service_dir: ${ANCHORE_SERVICE_DIR}
22
tmp_dir: ${ANCHORE_TMP_DIR}
3-
log_level: ${ANCHORE_LOG_LEVEL}
3+
log_level: ${ANCHORE_LOG_LEVEL} # Deprecated - prefer use of logging.log_level
4+
5+
logging:
6+
{{- toYaml .Values.anchoreConfig.logging | nindent 2 }}
7+
8+
server:
9+
{{- toYaml .Values.anchoreConfig.server | nindent 2 }}
410

511
allow_awsecr_iam_auto: ${ANCHORE_ALLOW_ECR_IAM_AUTO}
612
host_id: "${ANCHORE_HOST_ID}"
@@ -19,6 +25,36 @@ max_import_content_size_mb: ${ANCHORE_MAX_IMPORT_CONTENT_SIZE_MB}
1925

2026
max_compressed_image_size_mb: ${ANCHORE_MAX_COMPRESSED_IMAGE_SIZE_MB}
2127

28+
audit:
29+
enabled: {{ .Values.anchoreConfig.audit.enabled }}
30+
mode: log
31+
verbs:
32+
- post
33+
- put
34+
- delete
35+
- patch
36+
resource_uris:
37+
- "/accounts"
38+
- "/accounts/{account_name}"
39+
- "/accounts/{account_name}/state"
40+
- "/accounts/{account_name}/users"
41+
- "/accounts/{account_name}/users/{username}"
42+
- "/accounts/{account_name}/users/{username}/api-keys"
43+
- "/accounts/{account_name}/users/{username}/api-keys/{key_name}"
44+
- "/accounts/{account_name}/users/{username}/credentials"
45+
- "/rbac-manager/roles"
46+
- "/rbac-manager/roles/{role_name}/members"
47+
- "/rbac-manager/saml/idps"
48+
- "/rbac-manager/saml/idps/{name}"
49+
- "/rbac-manager/saml/idps/{name}/user-group-mappings"
50+
- "/system/user-groups"
51+
- "/system/user-groups/{group_uuid}"
52+
- "/system/user-groups/{group_uuid}/roles"
53+
- "/system/user-groups/{group_uuid}/users"
54+
- "/user/api-keys"
55+
- "/user/api-keys/{key_name}"
56+
- "/user/credentials"
57+
2258
metrics:
2359
enabled: ${ANCHORE_ENABLE_METRICS}
2460
auth_disabled: ${ANCHORE_DISABLE_METRICS_AUTH}
@@ -45,7 +81,7 @@ user_authentication:
4581
max_api_keys_per_user: {{ .Values.anchoreConfig.user_authentication.max_api_keys_per_user }}
4682
remove_deleted_user_api_keys_older_than_days: {{ .Values.anchoreConfig.user_authentication.remove_deleted_user_api_keys_older_than_days }}
4783
disallow_native_users: {{ .Values.anchoreConfig.user_authentication.disallow_native_users }}
48-
84+
log_saml_assertions: {{ .Values.anchoreConfig.user_authentication.log_saml_assertions }}
4985
credentials:
5086
database:
5187
user: "${ANCHORE_DB_USER}"
@@ -171,14 +207,10 @@ services:
171207
data:
172208
grypedb:
173209
enabled: true
174-
url: {{ template "enterprise.grypeProviderURL" . }}
175-
packages:
176-
enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
177-
url: {{ template "enterprise.feedsURL" . }}
178-
vulnerability_annotations:
179-
enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
180-
url: {{ template "enterprise.feedsURL" . }}
181210
matching:
211+
exclude:
212+
providers: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers }}
213+
package_types: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types }}
182214
default:
183215
search:
184216
by_cpe:
@@ -267,3 +299,19 @@ services:
267299
ssl_enable: ${ANCHORE_SSL_ENABLED}
268300
ssl_cert: ${ANCHORE_SSL_CERT}
269301
ssl_key: ${ANCHORE_SSL_KEY}
302+
303+
data_syncer:
304+
enabled: true
305+
require_auth: true
306+
endpoint_hostname: ${ANCHORE_ENDPOINT_HOSTNAME}
307+
listen: 0.0.0.0
308+
port: ${ANCHORE_PORT}
309+
auto_sync_enabled: true
310+
upload_dir: {{ .Values.scratchVolume.mountPath }}
311+
datasets:
312+
vulnerability_db:
313+
versions: ["5"]
314+
clamav_db:
315+
versions: ["1"]
316+
kev_db:
317+
versions: ["1"]

‎stable/enterprise/templates/_common.tpl

+6-1
Original file line numberDiff line numberDiff line change
@@ -258,10 +258,15 @@ securityContext: {{- toYaml . | nindent 2 }}
258258
{{- if or .Values.serviceAccountName (index .Values (print $component)).serviceAccountName (eq $component "upgradeJob") (eq $component "osaaMigrationJob") }}
259259
serviceAccountName: {{ include "enterprise.serviceAccountName" (merge (dict "component" $component) .) }}
260260
{{- end }}
261+
{{- if .Values.useExistingPullCredSecret }}
261262
{{- with .Values.imagePullSecretName }}
262263
imagePullSecrets:
263264
- name: {{ . }}
264265
{{- end }}
266+
{{- else }}
267+
imagePullSecrets:
268+
- name: {{ template "enterprise.fullname" . }}-pullcreds
269+
{{- end }}
265270
{{- with (default .Values.nodeSelector (index .Values (print $component)).nodeSelector) }}
266271
nodeSelector: {{- toYaml . | nindent 2 }}
267272
{{- end }}
@@ -335,7 +340,7 @@ Setup the common anchore volumes
335340
{{- include "enterprise.common.extraVolumes" (merge (dict "component" $component) .) }}
336341
- name: anchore-license
337342
secret:
338-
secretName: {{ .Values.licenseSecretName }}
343+
{{- include "enterprise.licenseSecret" . | nindent 4 }}
339344
- name: anchore-scripts
340345
configMap:
341346
name: {{ .Release.Name }}-enterprise-scripts

‎stable/enterprise/templates/_helpers.tpl

+17-52
Original file line numberDiff line numberDiff line change
@@ -57,46 +57,6 @@ Allows passing in a feature flag to the ui application on startup
5757
{{- end }}
5858
{{- end }}
5959

60-
{{/*
61-
Returns the proper URL for the feeds service
62-
*/}}
63-
{{- define "enterprise.feedsURL" }}
64-
{{- $anchoreFeedsURL := "" }}
65-
{{- if .Values.feeds.url }}
66-
{{- /* remove everything from the URL after /v2 to get the hostname, then use that to construct the proper URL */}}
67-
{{- $regexSearchPattern := (printf "/v2.*$" | toString) }}
68-
{{- $urlPathSuffix := (default "" (regexFind $regexSearchPattern .Values.feeds.url) ) }}
69-
{{- $anchoreFeedsHost := (trimSuffix $urlPathSuffix .Values.feeds.url) -}}
70-
{{- $anchoreFeedsURL = (printf "%s/v2/feeds" $anchoreFeedsHost) -}}
71-
{{- else if .Values.feeds.chartEnabled }}
72-
{{- $anchoreFeedsURL = (printf "%s://%s:%s/v2/feeds" (include "enterprise.feeds.setProtocol" .) (include "enterprise.feeds.fullname" .) (.Values.feeds.service.port | toString)) -}}
73-
{{- end }}
74-
{{- print $anchoreFeedsURL -}}
75-
{{- end -}}
76-
77-
78-
{{/*
79-
Returns the proper URL for the grype provider
80-
*/}}
81-
{{- define "enterprise.grypeProviderURL" }}
82-
{{- $grypeProviderFeedsExternalURL := "" -}}
83-
{{- $regexSearchPattern := (printf "/v2.*$" | toString) }}
84-
{{- if .Values.feeds.url }}
85-
{{- /* remove everything from the URL after /v2 to get the hostname, then use that to construct the proper URL */}}
86-
{{- $urlPathSuffix := (default "" ( regexFind $regexSearchPattern .Values.feeds.url )) -}}
87-
{{- $anchoreFeedsHost := (trimSuffix $urlPathSuffix .Values.feeds.url) -}}
88-
{{- $grypeProviderFeedsExternalURL = (printf "%s/v2/databases/grypedb" $anchoreFeedsHost) -}}
89-
{{- else if .Values.feeds.chartEnabled }}
90-
{{- $grypeProviderFeedsExternalURL = (printf "%s://%s:%s/v2/databases/grypedb" (include "enterprise.feeds.setProtocol" .) (include "enterprise.feeds.fullname" .) (.Values.feeds.service.port | toString)) -}}
91-
{{- end }}
92-
93-
{{- /* Set the grypeProviderFeedsExternalURL to upstream feeds if still unset or if specifically overridden */}}
94-
{{- if or (empty $grypeProviderFeedsExternalURL) .Values.anchoreConfig.policy_engine.overrideFeedsToUpstream -}}
95-
{{- $grypeProviderFeedsExternalURL = "https://toolbox-data.anchore.io/grype/databases/listing.json" -}}
96-
{{- end }}
97-
{{- print $grypeProviderFeedsExternalURL -}}
98-
{{- end -}}
99-
10060

10161
{{/*
10262
Set the appropriate kubernetes service account name.
@@ -128,18 +88,6 @@ Return the proper protocol when Anchore internal SSL is enabled
12888
{{- end -}}
12989

13090

131-
{{/*
132-
Return the proper protocol when Anchore internal SSL is enabled
133-
*/}}
134-
{{- define "enterprise.feeds.setProtocol" -}}
135-
{{- if .Values.feeds.anchoreConfig.internalServicesSSL.enabled }}
136-
{{- print "https" -}}
137-
{{- else -}}
138-
{{- print "http" -}}
139-
{{- end }}
140-
{{- end -}}
141-
142-
14391
{{/*
14492
Return the database password for the Anchore Enterprise UI config
14593
*/}}
@@ -190,3 +138,20 @@ Checks if the appVersion.minor has increased, which is indicitive of requiring a
190138
{{- end -}}
191139

192140
{{- end -}}
141+
142+
{{/*
143+
Constructs a proper dockerconfig json string for use in the image pull secret that is managed by the chart
144+
*/}}
145+
{{- define "enterprise.imagePullSecret" }}
146+
{{- printf "{\"auths\":{\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"email\":\"%s\",\"auth\":\"%s\"}}}" .Values.imageCredentials.registry .Values.imageCredentials.username .Values.imageCredentials.password .Values.imageCredentials.email (printf "%s:%s" .Values.imageCredentials.username .Values.imageCredentials.password | b64enc) | b64enc }}
147+
{{- end }}
148+
149+
{{- define "enterprise.licenseSecret" -}}
150+
{{- if .Values.useExistingLicenseSecret }}
151+
{{- with .Values.licenseSecretName }}
152+
secretName: {{ . }}
153+
{{- end }}
154+
{{- else }}
155+
secretName: {{ template "enterprise.fullname" . }}-license
156+
{{- end }}
157+
{{- end -}}

‎stable/enterprise/templates/_names.tpl

+5-9
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
2727
{{- printf "%s-%s-%s" .Release.Name $name "catalog"| trunc 63 | trimSuffix "-" -}}
2828
{{- end -}}
2929

30+
{{- define "enterprise.dataSyncer.fullname" -}}
31+
{{- $name := default .Chart.Name .Values.global.nameOverride -}}
32+
{{- printf "%s-%s-%s" .Release.Name $name "datasyncer"| trunc 63 | trimSuffix "-" -}}
33+
{{- end -}}
34+
3035
{{- define "enterprise.notifications.fullname" -}}
3136
{{- $name := default .Chart.Name .Values.global.nameOverride -}}
3237
{{- printf "%s-%s-%s" .Release.Name $name "notifications"| trunc 63 | trimSuffix "-" -}}
@@ -76,15 +81,6 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
7681
{{- printf "%s-%s-%s-%s" .Release.Name $name (.Chart.AppVersion | replace "." "") "smoke-test" | trunc 63 | trimSuffix "-" -}}
7782
{{- end -}}
7883

79-
{{- define "enterprise.feeds.fullname" -}}
80-
{{- if .Values.feeds.fullnameOverride }}
81-
{{- .Values.feeds.fullnameOverride | trunc 63 | trimSuffix "-" }}
82-
{{- else }}
83-
{{- $name := default "feeds" .Values.feeds.nameOverride -}}
84-
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
85-
{{- end }}
86-
{{- end -}}
87-
8884
{{- define "postgres.fullname" -}}
8985
{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
9086
{{- end -}}

‎stable/enterprise/templates/anchore_configmap.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- $exclude_providers := required "anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers is required" .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers -}}
2+
{{- $exclude_package := required "anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types is required" .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types -}}
13
kind: ConfigMap
24
apiVersion: v1
35
metadata:

0 commit comments

Comments
 (0)