# helm_charts_engine_configmap.yaml
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ template "anchore-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  config.yaml: |
    # Anchore Service Configuration File from ConfigMap
    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    image_analyze_timeout_seconds: {{ .Values.anchoreGlobal.imageAnalyzeTimeoutSeconds }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: false

    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
    license_file: /home/anchore/license.yaml
    {{- end }}

    global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }}
    global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }}

    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}
      auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }}
    {{ if .Values.anchoreGlobal.webhooksEnabled }}
    webhooks:
      {{- toYaml .Values.anchoreGlobal.webhooks | nindent 6 }}
    {{ end }}
    # Configure what feeds to sync.
    # The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
    feeds:
      sync_enabled: true
      selective_sync:
        # If enabled only sync specific feeds instead of all that are found.
        enabled: true
        feeds:
          {{- if not .Values.anchoreEnterpriseGlobal.enabled }}
          github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
          {{- end }}
          # Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
          vulnerabilities: {{ default "true" .Values.anchoreGlobal.syncVulnerabilites }}
          # NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
          nvdv2: {{ default "true" .Values.anchoreGlobal.syncNvd }}
          # Warning: enabling the package sync causes the service to require much
          #   more memory to do process the significant data volume. We recommend at least 4GB available for the container
          {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
          packages: true
          {{- else }}
          packages: {{ default "false" .Values.anchoreGlobal.syncPackages }}
          {{- end }}
          # Enabling vulndb syncs vulndb vulnerability data from an on-premise anchore enterprise feeds service. Please contact
          # anchore support for finding out more about this service
          {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
          vulndb: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
          # Enabling microsoft syncs MSRC data from an on-premise anchore enterprise feeds service. Please contact
          # anchore support for finding out more about this service
          microsoft: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }}
          {{- else }}
          vulndb: false
          microsoft: false
          {{- end }}
          # Sync github data if available for GHSA matches
          github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
      {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
      url: "https://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
      {{- else }}
      url: "http://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
      {{- end }}
      ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
      client_url:
      token_url:
      {{- else }}
      client_url: "https://ancho.re/v1/account/users"
      token_url: "https://ancho.re/oauth/token"
      anonymous_user_username: anon@ancho.re
      anonymous_user_password: pbiU2RYZ2XrmYQ
      {{- end }}
      connection_timeout_seconds: {{ default 3 .Values.anchoreGlobal.feedsConnectionTimeout }}
      read_timeout_seconds: {{ default 180 .Values.anchoreGlobal.feedsReadTimeout }}
    default_admin_password: ${ANCHORE_ADMIN_PASSWORD}
    default_admin_email: {{ .Values.anchoreGlobal.defaultAdminEmail }}

    # Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
    # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
    keys:
      secret: {{ .Values.anchoreGlobal.saml.secret }}
      {{- with .Values.anchoreGlobal.saml.publicKeyName }}
      public_key_path: /home/anchore/certs/{{- . }}
      {{- end }}
      {{- with .Values.anchoreGlobal.saml.privateKeyName }}
      private_key_path: /home/anchore/certs/{{- . }}
      {{- end }}

    # Configuring supported user authentication and credential management
    user_authentication:
      oauth:
        enabled: {{ .Values.anchoreGlobal.oauthEnabled }}
        default_token_expiration_seconds: {{ .Values.anchoreGlobal.oauthTokenExpirationSeconds }}

      # Set this to True to enable storing user passwords only as secure hashes in the db. This can dramatically increase CPU usage if you
      # don't also use oauth and tokens for internal communications (which requires keys/secret to be configured as well)
      # WARNING: you should not change this after a system has been initialized as it may cause a mismatch in existing passwords
      hashed_passwords: {{ .Values.anchoreGlobal.hashedPasswords }}

    credentials:
      database:
        {{- if .Values.anchoreGlobal.dbConfig.ssl }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}}"
        {{- else }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        {{- end }}
        db_connect_args:
          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
          ssl: false
        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolMaxOverflow }}
    services:
      apiext:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreApi.service.port }}
        {{- if .Values.anchoreApi.external }}
        {{- if .Values.anchoreApi.external.use_tls }}
        external_tls: {{ .Values.anchoreApi.external.use_tls }}
        {{- end }}
        {{- if .Values.anchoreApi.external.hostname }}
        external_hostname: {{ .Values.anchoreApi.external.hostname }}
        {{- end }}
        external_port: {{ .Values.anchoreApi.external.port | default "null" }}
        {{- end }}
        {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{- .Values.anchoreEnterpriseRbac.service.authPort }}"
        {{- end }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      analyzer:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.analyzer.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreAnalyzer.containerPort }}
        cycle_timer_seconds: 1
        cycle_timers:
          {{- toYaml .Values.anchoreAnalyzer.cycleTimers | nindent 10 }}
        max_threads: {{ .Values.anchoreAnalyzer.concurrentTasksPerWorker }}
        analyzer_driver: 'nodocker'
        {{- if gt .Values.anchoreAnalyzer.layerCacheMaxGigabytes 0.0 }}
        layer_cache_enable: true
        {{- else }}
        layer_cache_enable: false
        {{- end }}
        layer_cache_max_gigabytes: {{ .Values.anchoreAnalyzer.layerCacheMaxGigabytes }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      catalog:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.catalog.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreCatalog.service.port }}
        cycle_timer_seconds: 1
        cycle_timers:
          # Interval to check for an update to a tag
          image_watcher: {{ .Values.anchoreCatalog.cycleTimers.image_watcher }}
          # Interval to run a policy evaluation on images with the policy_eval subscription activated.
          policy_eval: {{ .Values.anchoreCatalog.cycleTimers.policy_eval }}
          # Interval to run a vulnerability scan on images with the vuln_update subscription activated.
          vulnerability_scan: {{ .Values.anchoreCatalog.cycleTimers.vulnerability_scan }}
          # Interval at which the catalog looks for new work to put on the image analysis queue.
          analyzer_queue: {{ .Values.anchoreCatalog.cycleTimers.analyzer_queue }}
          # Interval notifications will be processed for state changes
          {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
          notifications: 0
          {{- else }}
          notifications: {{ .Values.anchoreCatalog.cycleTimers.notifications }}
          {{- end }}
          # Intervals service state updates are polled for the system status
          service_watcher: {{ .Values.anchoreCatalog.cycleTimers.service_watcher }}
          # Interval between checks to repo for new tags
          repo_watcher: {{ .Values.anchoreCatalog.cycleTimers.repo_watcher }}
        event_log:
          {{- toYaml .Values.anchoreCatalog.events | nindent 10 }}
        archive:
          {{- toYaml .Values.anchoreCatalog.archive | nindent 10 }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      simplequeue:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.simplequeue.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreSimpleQueue.service.port }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      policy_engine:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.policy-engine.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchorePolicyEngine.service.port }}
        cycle_timer_seconds: 1
        cycle_timers:
          {{- toYaml .Values.anchorePolicyEngine.cycleTimers | nindent 10 }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}