# helm_charts_enterprise_feeds_configmap.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled -}}
{{- $component := "enterprise-feeds" -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  config.yaml: |
    # Anchore Enterprise Service Configuration File
    # General system-wide configuration options, these should not need to
    # be altered for basic operation
    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: false
    license_file: /home/anchore/license.yaml
    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}

    # Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
    # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
    keys:
      secret: {{ .Values.anchoreGlobal.saml.secret }}
      {{- with .Values.anchoreGlobal.saml.publicKeyName }}
      public_key_path: /home/anchore/certs/{{- . }}
      {{- end }}
      {{- with .Values.anchoreGlobal.saml.privateKeyName }}
      private_key_path: /home/anchore/certs/{{- . }}
      {{- end }}

    # Configuring supported user authentication and credential management
    user_authentication:
      oauth:
        enabled: {{ .Values.anchoreGlobal.oauthEnabled }}
        default_token_expiration_seconds: {{ .Values.anchoreGlobal.oauthTokenExpirationSeconds }}

      # Set this to True to enable storing user passwords only as secure hashes in the db. This can dramatically increase CPU usage if you
      # don't also use oauth and tokens for internal communications (which requires keys/secret to be configured as well)
      # WARNING: you should not change this after a system has been initialized as it may cause a mismatch in existing passwords
      hashed_passwords: {{ .Values.anchoreGlobal.hashedPasswords }}

    credentials:
      database:
        {{- if .Values.anchoreEnterpriseFeeds.dbConfig.ssl }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreEnterpriseFeeds.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreEnterpriseFeeds.dbConfig.sslRootCertName }}"
        {{- else }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        {{- end }}
        db_connect_args:
          timeout: {{ .Values.anchoreEnterpriseFeeds.dbConfig.timeout }}
          ssl: false
        db_pool_size: {{ .Values.anchoreEnterpriseFeeds.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreEnterpriseFeeds.dbConfig.connectionPoolMaxOverflow }}
    services:
      feeds:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreEnterpriseFeeds.service.port }}
        # Time delay in seconds between consecutive driver runs for processing data
        cycle_timers:
          {{- toYaml .Values.anchoreEnterpriseFeeds.cycleTimers | nindent 10 }}
        # Staging space for holding normalized output from drivers.
        local_workspace: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
        # Drivers process data from external sources and store normalized data in local_workspace. Processing large data sets
        # is a time consuming process for some drivers. To speed it up the container is shipped with pre-loaded data which is used
        # by default if local_workspace is empty.
        workspace_preload:
          # Do not use pre-loaded data if local_workspace is empty. Drivers will generate normalized data from scratch
          # disabled: true
          # To load the workspace from a different location, uncomment and configure workspace_preload_file property to point to the tar.gz file
          workspace_preload_file: "/workspace_preload/data.tar.gz"
        # If api_only is set to true, the service will not update feed data in the system.
        # API end points will be functional and serve feed data if any is available.
        api_only: {{ default "false" .Values.anchoreEnterpriseFeeds.apiOnly }}
        drivers:
          # Configuration section for drivers collecting and processing feed data.
          # All drivers are enabled by default unless explicitly disabled. npm and gem drivers are explicitly disabled out of the box
          npm:
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.npmDriverEnabled }}
          gem:
            # rubygem data comes packaged as a PostgreSQL dump file. gem driver loads the pg dump and normalizes the data.
            # To enable gem driver comment the enabled property and uncomment the db_connect property.
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.gemDriverEnabled }}
            db_connect: {{ default "'postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/gems'" .Values.anchoreEnterpriseFeeds.gemDbEndpoint }}
          amzn:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.amazonDriverEnabled }}
          centos:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.centosDriverEnabled }}
          debian:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.debianDriverEnabled }}
          ubuntu:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.ubuntuDriverEnabled }}
          rhel:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.rhelDriverEnabled }}
          ol:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.olDriverEnabled }}
          alpine:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.alpineDriverEnabled }}
          snyk:
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.snykDriverEnabled }}
          nvddb:
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.nvdDriverEnabled }}
          nvdv2:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.nvdv2DriverEnabled }}
          vulndb:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
          msrc:
            enabled: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }}
            api_key: {{ .Values.anchoreEnterpriseFeeds.msrcApiKey }}
            {{- with .Values.anchoreEnterpriseFeeds.msrcWhitelist }}
            whitelist:
              - {{ . }}
            {{- end }}
          github:
            enabled: {{ .Values.anchoreEnterpriseFeeds.githubDriverEnabled }}
            token: {{ .Values.anchoreEnterpriseFeeds.githubDriverToken }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
{{- end -}}