# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.analyzer.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "analyzer"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.catalog.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "catalog"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.api.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "api"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.policy-engine.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "policy"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.simplequeue.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "simplequeue"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.enterprise.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "enterprise"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.enterprise-ui.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "enterprise-ui"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.enterprise-feeds.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "enterprise-feeds"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.enterprise-reports.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "enterprise-reports"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "anchore-engine.enterprise-notifications.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s-%s" .Release.Name $name "enterprise-notifications"| trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified dependency name for the db.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "postgres.fullname" -}}
{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified dependency name for the feeds db.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "postgres.anchore-feeds-db.fullname" -}}
{{- printf "%s-%s" .Release.Name "anchore-feeds-db" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified dependency name for the db.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "redis.fullname" -}}
{{- printf "%s-%s" .Release.Name "anchore-ui-redis" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Return Anchore Engine default admin password
*/}}
{{- define "anchore-engine.defaultAdminPassword" -}}
{{- if .Values.anchoreGlobal.defaultAdminPassword }}
    {{- .Values.anchoreGlobal.defaultAdminPassword -}}
{{- else -}}
    {{- randAlphaNum 32 -}}
{{- end -}}
{{- end -}}
 # analyzer_configmap.yaml
{{- $component := "analyzer" -}}
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ template "anchore-engine.analyzer.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  analyzer_config.yaml: |
    {{- with .Values.anchoreAnalyzer.configFile }}
    {{- toYaml . | nindent 4 }}
    {{- end }} # analyzer_deployment.yaml
{{- $component := "analyzer" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "anchore-engine.analyzer.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreAnalyzer.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: {{ .Values.anchoreAnalyzer.replicaCount }}
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        {{- with .Values.anchoreAnalyzer.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchoreAnalyzer.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
    {{- else }}
      {{- with .Values.anchoreGlobal.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ . }}
      {{- end }}
    {{- end }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: {{ .Chart.Name }}-{{ $component }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        {{- else }}
        image: {{ .Values.anchoreGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
        {{- end }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "analyzer"]
        {{- else }}
        args: ["anchore-manager", "service", "start", "--no-auto-upgrade", "analyzer"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreAnalyzer.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - name: analyzer-api
          containerPort: {{ .Values.anchoreAnalyzer.containerPort }}
        volumeMounts:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- end }}
        - name: analyzer-config-volume
          mountPath: /anchore_service/analyzer_config.yaml
          subPath: analyzer_config.yaml
        - name: config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        - name: {{ $component }}-scratch
          mountPath: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: analyzer-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: analyzer-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreAnalyzer.resources | nindent 10 }}
      volumes:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          secret:
            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
        {{- end }}
        - name: config-volume
          configMap:
            name: {{ template "anchore-engine.fullname" .}}
        - name: {{ $component }}-scratch
          {{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          emptyDir: {}
        - name: logs
          emptyDir: {}
        - name: run
          emptyDir: {}
        {{- end }}
        - name: analyzer-config-volume
          configMap:
            name: {{ template "anchore-engine.analyzer.fullname" . }}
        {{- with .Values.anchoreGlobal.certStoreSecretName }}
        - name: certs
          secret:
            secretName: {{ . }}
        {{- end }}
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - name: {{ .Values.cloudsql.serviceAccSecretName }}
          secret:
            secretName: {{ .Values.cloudsql.serviceAccSecretName }}
        {{- end }}
      {{- with .Values.anchoreAnalyzer.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreAnalyzer.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreAnalyzer.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
 # api_deployment.yaml
{{- $component := "api" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "anchore-engine.api.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreApi.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: {{ .Values.anchoreApi.replicaCount }}
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        {{- with .Values.anchoreApi.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchoreApi.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
    {{- else }}
      {{- with .Values.anchoreGlobal.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ . }}
      {{- end }}
    {{- end }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: "{{ .Chart.Name }}-{{ $component }}"
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        {{- else }}
        image: {{ .Values.anchoreGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
        {{- end }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "apiext"]
        {{- else }}
        args: ["anchore-manager", "service", "start", "--no-auto-upgrade", "apiext"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreApi.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: ANCHORE_CLI_PASS
          valueFrom:
            secretKeyRef:
              name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
              key: ANCHORE_ADMIN_PASSWORD
        ports:
        - containerPort: {{ .Values.anchoreApi.service.port }}
          name: external-api
        volumeMounts:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- end }}
        - name: config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: external-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: external-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreApi.resources | nindent 10 }}
      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
      - name: {{ .Chart.Name }}-rbac-manager
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "rbac_manager"]
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreEnterpriseRbac.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - containerPort: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
          name: rbac-manager
        volumeMounts:
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        - name: enterprise-config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: rbac-manager
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: rbac-manager
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreEnterpriseRbac.managerResources | nindent 10 }}
      - name: {{ .Chart.Name }}-rbac-authorizer
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "rbac_authorizer"]
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreEnterpriseRbac.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - containerPort: {{ .Values.anchoreEnterpriseRbac.service.authPort }}
          name: rbac-auth
        volumeMounts:
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        - name: enterprise-config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        livenessProbe:
          exec:
            command:
              - curl
              - -f
              - 'localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}/health'
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          exec:
            command:
              - curl
              - -f
              - 'localhost:{{ .Values.anchoreEnterpriseRbac.service.authPort }}/health'
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreEnterpriseRbac.authResources | nindent 10 }}
      {{- end }}
      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseReports.enabled }}
      - name: "{{ .Chart.Name }}-reports"
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "reports"]
        ports:
        - containerPort: {{ .Values.anchoreEnterpriseReports.service.port }}
          name: reports-api
        envFrom:
        - secretRef:
            name: {{ template "anchore-engine.fullname" . }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreEnterpriseReports.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: enterprise-config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: reports-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: reports-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreEnterpriseReports.resources | nindent 10 }}
      {{- end }}
      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
      - name: "{{ .Chart.Name }}-notifications"
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "notifications"]
        ports:
        - containerPort: {{ .Values.anchoreEnterpriseNotifications.service.port }}
          name: notifi-api
        envFrom:
        - secretRef:
            name: {{ template "anchore-engine.fullname" . }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreEnterpriseNotifications.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: enterprise-config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: notifi-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: notifi-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreEnterpriseNotifications.resources | nindent 10 }}
      {{- end }}
      volumes:
        - name: config-volume
          configMap:
            name: {{ template "anchore-engine.fullname" . }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          emptyDir: {}
        - name: logs
          emptyDir: {}
        - name: run
          emptyDir: {}
        {{- end }}
        {{ if and .Values.anchoreEnterpriseGlobal.enabled (or .Values.anchoreEnterpriseRbac.enabled .Values.anchoreEnterpriseReports.enabled) }}
        - name: anchore-license
          secret:
            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
        - name: enterprise-config-volume
          configMap:
            name: {{ template "anchore-engine.enterprise.fullname" . }}
        {{- end}}
        {{- with .Values.anchoreGlobal.certStoreSecretName }}
        - name: certs
          secret:
            secretName: {{ . }}
        {{- end }}
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - name: {{ .Values.cloudsql.serviceAccSecretName }}
          secret:
            secretName: {{ .Values.cloudsql.serviceAccSecretName }}
        {{- end }}
      {{- with .Values.anchoreApi.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreApi.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreApi.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
      {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "anchore-engine.api.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreApi.service.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.anchoreApi.service.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.anchoreApi.service.type }}
  ports:
    - name: anchore-external-api
      port: {{ .Values.anchoreApi.service.port }}
      targetPort: {{ .Values.anchoreApi.service.port }}
      protocol: TCP
    {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
    - name: anchore-rbac-manager
      port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
      targetPort: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
      protocol: TCP
    {{- end }}
    {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseReports.enabled }}
    - name: reports-api
      port: {{ .Values.anchoreEnterpriseReports.service.port }}
      targetPort: {{ .Values.anchoreEnterpriseReports.service.port }}
      protocol: TCP
    {{- end }}
    {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
    - name: notifi-api
      port: {{ .Values.anchoreEnterpriseNotifications.service.port }}
      targetPort: {{ .Values.anchoreEnterpriseNotifications.service.port }}
      protocol: TCP
    {{- end }}
  selector:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}
 # catalog_deployment.yaml
{{- $component := "catalog" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "anchore-engine.catalog.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreCatalog.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: {{ .Values.anchoreCatalog.replicaCount }}
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        {{- with .Values.anchoreCatalog.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchoreCatalog.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
    {{- else }}
      {{- with .Values.anchoreGlobal.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ . }}
      {{- end }}
    {{- end }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: {{ .Chart.Name }}-{{ $component }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        {{- else }}
        image: {{ .Values.anchoreGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
        {{- end }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "catalog"]
        {{- else }}
        args: ["anchore-manager", "service", "start", "--no-auto-upgrade", "catalog"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreCatalog.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - name: catalog
          containerPort: {{ .Values.anchoreCatalog.service.port }}
        volumeMounts:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- end }}
        - name: config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: catalog
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: catalog
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreCatalog.resources | nindent 10 }}
      volumes:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          secret:
            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
        {{- end }}
        - name: config-volume
          configMap:
            name: {{ template "anchore-engine.fullname" . }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          emptyDir: {}
        - name: logs
          emptyDir: {}
        - name: run
          emptyDir: {}
        {{- end }}
        {{- with .Values.anchoreGlobal.certStoreSecretName }}
        - name: certs
          secret:
            secretName: {{ . }}
        {{- end }}
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - name: {{ .Values.cloudsql.serviceAccSecretName }}
          secret:
            secretName: {{ .Values.cloudsql.serviceAccSecretName }}
        {{- end }}
      {{- with .Values.anchoreCatalog.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreCatalog.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreCatalog.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
      {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "anchore-engine.catalog.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreCatalog.service.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.anchoreCatalog.service.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.anchoreCatalog.service.type }}
  ports:
    - name: anchore-catalog-api
      port: {{ .Values.anchoreCatalog.service.port }}
      targetPort: {{ .Values.anchoreCatalog.service.port }}
      protocol: TCP
  selector:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}
 # configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "postgresql.fullname" . }}
  labels:
    app: {{ template "postgresql.name" . }}
    chart: {{ template "postgresql.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
data:
  {{- if .Values.metrics.customMetrics }}
  custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }}
  {{- end }}
  {{- if .Values.pgHbaConf }}
  pg_hba.conf: {{ .Values.pgHbaConf | quote }}
  {{- end }}
 # deployment.yaml
apiVersion: {{- if .Capabilities.APIVersions.Has "apps/v1" }} apps/v1 {{- else }} extensions/v1beta1 {{- end }}
kind: Deployment
metadata:
  name: {{ template "postgresql.fullname" . }}
  labels:
    app: {{ template "postgresql.name" . }}
    chart: {{ template "postgresql.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- with .Values.deploymentAnnotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- with .Values.strategy }}
  strategy:
{{ toYaml . | indent 4 }}
{{- end }}
  selector:
    matchLabels:
      app: {{ template "postgresql.name" . }}
      release: {{ .Release.Name }}
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: {{ template "postgresql.name" . }}
        release: {{ .Release.Name }}
{{- with .Values.podAnnotations }}
      annotations:
{{ toYaml . | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.schedulerName }}
      schedulerName: "{{ .Values.schedulerName }}"
      {{- end }}
      {{- if .Values.terminationGracePeriodSeconds }}
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      {{- end }}
      containers:
      - name: {{ template "postgresql.fullname" . }}
        image: "{{ .Values.image }}"
        imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
        args:
          {{- range $key, $value := default dict .Values.postgresConfig }}
          - -c
          - '{{ $key | snakecase }}={{ $value }}'
          {{- end }}
          {{- if .Values.pgHbaConf }}
          - -c
          - hba_file=/pg_hba/pg_hba.conf
          {{- end }}
        env:
        - name: POSTGRES_USER
          value: {{ default "postgres" .Values.postgresUser | quote }}
          # Required for pg_isready in the health probes.
        - name: PGUSER
          value: {{ default "postgres" .Values.postgresUser | quote }}
        - name: POSTGRES_DB
          value: {{ default "" .Values.postgresDatabase | quote }}
        - name: POSTGRES_INITDB_ARGS
          value: {{ default "" .Values.postgresInitdbArgs | quote }}
        - name: PGDATA
          value: /var/lib/postgresql/data/pgdata
        {{- if .Values.usePasswordFile }}
        - name: POSTGRES_PASSWORD_FILE
          value: /conf/postgres-password
        {{- else }}
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "postgresql.secretName" . }}
              key: postgres-password
        {{- end }}
        - name: POD_IP
          valueFrom: { fieldRef: { fieldPath: status.podIP } }
{{- if .Values.extraEnv }}
{{ toYaml .Values.extraEnv | indent 8 }}
{{- end }}
        ports:
        - name: postgresql
          containerPort: 5432
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - exec pg_isready --host $POD_IP
          initialDelaySeconds: {{ .Values.probes.liveness.initialDelay }}
          timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
          failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
        readinessProbe:
          exec:
            command:
            - sh
            - -c
            - exec pg_isready --host $POD_IP
          initialDelaySeconds: {{ .Values.probes.readiness.initialDelay }}
          timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
          periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
        - name: data
          mountPath: {{ .Values.persistence.mountPath }}
          subPath: {{ .Values.persistence.subPath }}
        {{- if .Values.usePasswordFile }}
        - name: password-file
          mountPath: /conf
          readOnly: true
        {{- end }}
        {{- if .Values.pgHbaConf }}
        - name: pg-hba-conf
          mountPath: /pg_hba
          readOnly: true
        {{- end }}
{{- if .Values.metrics.enabled }}
      - name: metrics
        image: "{{ .Values.metrics.image }}:{{ .Values.metrics.imageTag }}"
        imagePullPolicy: {{ default "" .Values.metrics.imagePullPolicy | quote }}
        env:
        - name: DATA_SOURCE_NAME
          value: postgresql://{{ default "postgres" .Values.postgresUser }}@127.0.0.1:5432?sslmode=disable
        {{- if .Values.metrics.customMetrics }}
        - name: PG_EXPORTER_EXTEND_QUERY_PATH
          value: /conf/custom-metrics.yaml
        {{- end }}
        ports:
        - name: metrics
          containerPort: 9187
        {{- if .Values.metrics.customMetrics }}
        volumeMounts:
          - name: custom-metrics
            mountPath: /conf
            readOnly: true
        {{- end }}
        livenessProbe:
          httpGet:
            path: /metrics
            port: metrics
        readinessProbe:
          httpGet:
            path: /metrics
            port: metrics
        resources:
{{ toYaml .Values.metrics.resources | indent 10 }}
{{- end }}
      volumes:
      - name: data
      {{- if .Values.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.persistence.existingClaim | default (include "postgresql.fullname" .) }}
      {{- else }}
        emptyDir: {}
      {{- end }}
      {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
      - name: custom-metrics
        configMap:
          name: {{ template "postgresql.fullname" . }}
          items:
            - key: custom-metrics.yaml
              path: custom-metrics.yaml
      {{- end }}
      {{- if .Values.usePasswordFile }}
      - name: password-file
        secret:
          secretName: {{ template "postgresql.secretName" . }}
          items:
            - key: postgres-password
              path: postgres-password
      {{- end }}
      {{- if .Values.pgHbaConf }}
      - name: pg-hba-conf
        configMap:
          name: {{ template "postgresql.fullname" . }}
          items:
            - key: pg_hba.conf
              path: pg_hba.conf
      {{- end }}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
        - name: {{ .Values.imagePullSecrets }}
      {{- end }}
 # engine_configmap.yaml
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ template "anchore-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  config.yaml: |
    # Anchore Service Configuration File from ConfigMap
    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    image_analyze_timeout_seconds: {{ .Values.anchoreGlobal.imageAnalyzeTimeoutSeconds }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: false

    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
    license_file: /home/anchore/license.yaml
    {{- end }}

    global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }}
    global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }}

    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}
      auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }}
    {{ if .Values.anchoreGlobal.webhooksEnabled }}
    webhooks:
      {{- toYaml .Values.anchoreGlobal.webhooks | nindent 6 }}
    {{ end }}
    # Configure what feeds to sync.
    # The sync will hit http://ancho.re/feeds, if any outbound firewall config needs to be set in your environment.
    feeds:
      sync_enabled: true
      selective_sync:
        # If enabled only sync specific feeds instead of all that are found.
        enabled: true
        feeds:
          {{- if not .Values.anchoreEnterpriseGlobal.enabled }}
          github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
          {{- end }}
          # Vulnerabilities feed is the feed for distro cve sources (redhat, debian, ubuntu, oracle, alpine....)
          vulnerabilities: {{ default "true" .Values.anchoreGlobal.syncVulnerabilites }}
          # NVD Data is used for non-distro CVEs (jars, npm, etc) that are not packaged and released by distros as rpms, debs, etc
          nvdv2: {{ default "true" .Values.anchoreGlobal.syncNvd }}
          # Warning: enabling the package sync causes the service to require much
          #   more memory to do process the significant data volume. We recommend at least 4GB available for the container
          {{- if and (and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled) (or .Values.anchoreEnterpriseFeeds.gemDriverEnabled .Values.anchoreEnterpriseFeeds.npmDriverEnabled) }}
          packages: true
          {{- else }}
          packages: {{ default "false" .Values.anchoreGlobal.syncPackages }}
          {{- end }}
          # Enabling vulndb syncs vulndb vulnerability data from an on-premise anchore enterprise feeds service. Please contact
          # anchore support for finding out more about this service
          {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
          vulndb: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
          # Enabling microsoft syncs MSRC data from an on-premise anchore enterprise feeds service. Please contact
          # anchore support for finding out more about this service
          microsoft: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }}
          {{- else }}
          vulndb: false
          microsoft: false
          {{- end }}
          # Sync github data if available for GHSA matches
          github: {{ default "true" .Values.anchoreGlobal.syncGithub }}
      {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
      {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
      url: "https://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
      {{- else }}
      url: "http://{{- template "anchore-engine.enterprise-feeds.fullname" . }}:{{- .Values.anchoreEnterpriseFeeds.service.port }}/v1/feeds"
      {{- end }}
      ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
      client_url:
      token_url:
      {{- else }}
      client_url: "https://ancho.re/v1/account/users"
      token_url: "https://ancho.re/oauth/token"
      anonymous_user_username: anon@ancho.re
      anonymous_user_password: pbiU2RYZ2XrmYQ
      {{- end }}
      connection_timeout_seconds: {{ default 3 .Values.anchoreGlobal.feedsConnectionTimeout }}
      read_timeout_seconds: {{ default 180 .Values.anchoreGlobal.feedsReadTimeout }}
    default_admin_password: ${ANCHORE_ADMIN_PASSWORD}
    default_admin_email: {{ .Values.anchoreGlobal.defaultAdminEmail }}

    # Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
    # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
    keys:
      secret: {{ .Values.anchoreGlobal.saml.secret }}
      {{- with .Values.anchoreGlobal.saml.publicKeyName }}
      public_key_path: /home/anchore/certs/{{- . }}
      {{- end }}
      {{- with .Values.anchoreGlobal.saml.privateKeyName }}
      private_key_path: /home/anchore/certs/{{- . }}
      {{- end }}

    # Configuring supported user authentication and credential management
    user_authentication:
      oauth:
        enabled: {{ .Values.anchoreGlobal.oauthEnabled }}
        default_token_expiration_seconds: {{ .Values.anchoreGlobal.oauthTokenExpirationSeconds }}

      # Set this to True to enable storing user passwords only as secure hashes in the db. This can dramatically increase CPU usage if you
      # don't also use oauth and tokens for internal communications (which requires keys/secret to be configured as well)
      # WARNING: you should not change this after a system has been initialized as it may cause a mismatch in existing passwords
      hashed_passwords: {{ .Values.anchoreGlobal.hashedPasswords }}

    credentials:
      database:
        {{- if .Values.anchoreGlobal.dbConfig.ssl }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName -}}"
        {{- else }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        {{- end }}
        db_connect_args:
          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
          ssl: false
        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolMaxOverflow }}
    services:
      apiext:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreApi.service.port }}
        {{- if .Values.anchoreApi.external }}
        {{- if .Values.anchoreApi.external.use_tls }}
        external_tls: {{ .Values.anchoreApi.external.use_tls }}
        {{- end }}
        {{- if .Values.anchoreApi.external.hostname }}
        external_hostname: {{ .Values.anchoreApi.external.hostname }}
        {{- end }}
        external_port: {{ .Values.anchoreApi.external.port | default "null" }}
        {{- end }}
        {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseRbac.enabled }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{- .Values.anchoreEnterpriseRbac.service.authPort }}"
        {{- end }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      analyzer:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.analyzer.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreAnalyzer.containerPort }}
        cycle_timer_seconds: 1
        cycle_timers:
          {{- toYaml .Values.anchoreAnalyzer.cycleTimers | nindent 10 }}
        max_threads: {{ .Values.anchoreAnalyzer.concurrentTasksPerWorker }}
        analyzer_driver: 'nodocker'
        {{- if gt .Values.anchoreAnalyzer.layerCacheMaxGigabytes 0.0 }}
        layer_cache_enable: true
        {{- else }}
        layer_cache_enable: false
        {{- end }}
        layer_cache_max_gigabytes: {{ .Values.anchoreAnalyzer.layerCacheMaxGigabytes }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      catalog:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.catalog.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreCatalog.service.port }}
        cycle_timer_seconds: 1
        cycle_timers:
          # Interval to check for an update to a tag
          image_watcher: {{ .Values.anchoreCatalog.cycleTimers.image_watcher }}
          # Interval to run a policy evaluation on images with the policy_eval subscription activated.
          policy_eval: {{ .Values.anchoreCatalog.cycleTimers.policy_eval }}
          # Interval to run a vulnerability scan on images with the vuln_update subscription activated.
          vulnerability_scan: {{ .Values.anchoreCatalog.cycleTimers.vulnerability_scan }}
          # Interval at which the catalog looks for new work to put on the image analysis queue.
          analyzer_queue: {{ .Values.anchoreCatalog.cycleTimers.analyzer_queue }}
          # Interval notifications will be processed for state changes
          {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseNotifications.enabled }}
          notifications: 0
          {{- else }}
          notifications: {{ .Values.anchoreCatalog.cycleTimers.notifications }}
          {{- end }}
          # Intervals service state updates are polled for the system status
          service_watcher: {{ .Values.anchoreCatalog.cycleTimers.service_watcher }}
          # Interval between checks to repo for new tags
          repo_watcher: {{ .Values.anchoreCatalog.cycleTimers.repo_watcher }}
        event_log:
          {{- toYaml .Values.anchoreCatalog.events | nindent 10 }}
        archive:
          {{- toYaml .Values.anchoreCatalog.archive | nindent 10 }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      simplequeue:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.simplequeue.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreSimpleQueue.service.port }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      policy_engine:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.policy-engine.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchorePolicyEngine.service.port }}
        cycle_timer_seconds: 1
        cycle_timers:
          {{- toYaml .Values.anchorePolicyEngine.cycleTimers | nindent 10 }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}

 # engine_configmap_env.yaml
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ template "anchore-engine.fullname" . }}-env
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  ANCHORE_DB_NAME: {{ index .Values "postgresql" "postgresDatabase" | quote }}
  ANCHORE_DB_USER: {{ index .Values "postgresql" "postgresUser" | quote }}
  {{- if and (index .Values "postgresql" "externalEndpoint") (not (index .Values "postgresql" "enabled")) }}
  ANCHORE_DB_HOST: {{ index .Values "postgresql" "externalEndpoint" | quote }}
  {{- else if and (index .Values "cloudsql" "enabled") (not (index .Values "postgresql" "enabled")) }}
  ANCHORE_DB_HOST: "localhost:5432"
  {{- else }}
  ANCHORE_DB_HOST: "{{ template "postgres.fullname" . }}:5432"
  {{- end }}
 # engine_upgrade_job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-engine-upgrade"
  labels:
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  annotations:
    "helm.sh/hook": post-upgrade
    "helm.sh/hook-weight": "-5"
spec:
  template:
    metadata:
      name: "{{ .Release.Name }}-engine-upgrade"
      labels:
        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
        app.kubernetes.io/instance: {{ .Release.Name | quote }}
        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
     {{- if .Values.anchoreEnterpriseGlobal.enabled }}
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
    {{- else }}
      {{- with .Values.anchoreGlobal.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ . }}
      {{- end }}
    {{- end }}
      restartPolicy: Never
      containers:
      - name: "{{ .Release.Name }}-enterprise-upgrade"
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        {{- else }}
        image: {{ .Values.anchoreGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
        {{- end }}
        {{- if .Values.anchoreGlobal.dbConfig.ssl }}
        args: ["/bin/bash", "-c", "anchore-manager db --db-use-ssl --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{ .Values.anchoreGlobal.dbConfig.sslMode }}\\&sslrootcert=/home/anchore/certs/{{ .Values.anchoreGlobal.dbConfig.sslRootCertName }} upgrade --dontask"]
        {{- else }}
        args: ["/bin/bash", "-c", "anchore-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        volumeMounts:
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
      {{- with .Values.anchoreGlobal.certStoreSecretName }}
      volumes:
      - name: certs
        secret:
          secretName: {{ . }}
      {{- end }} # enterprise_configmap.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled (or .Values.anchoreEnterpriseRbac.enabled .Values.anchoreEnterpriseReports.enabled) -}}
{{- $component := "enterprise" -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "anchore-engine.enterprise.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  config.yaml: |
    # Anchore Enterprise Service Configuration File

    # General system-wide configuration options, these should not need to
    # be altered for basic operation
    #
    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}

    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: false
    license_file: /home/anchore/license.yaml

    global_client_connect_timeout: {{ default 0 .Values.anchoreGlobal.clientConnectTimeout }}
    global_client_read_timeout: {{ default 0 .Values.anchoreGlobal.clientReadTimeout }}

    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}
      auth_disabled: {{ .Values.anchoreGlobal.metricsAuthDisabled }}

    # Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
    # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
    keys:
      secret: {{ .Values.anchoreGlobal.saml.secret }}
      {{- with .Values.anchoreGlobal.saml.publicKeyName }}
      public_key_path: /home/anchore/certs/{{- . }}
      {{- end }}
      {{- with .Values.anchoreGlobal.saml.privateKeyName }}
      private_key_path: /home/anchore/certs/{{- . }}
      {{- end }}

    # Configuring supported user authentication and credential management
    user_authentication:
      oauth:
        enabled: {{ .Values.anchoreGlobal.oauthEnabled }}
        default_token_expiration_seconds: {{ .Values.anchoreGlobal.oauthTokenExpirationSeconds }}

      # Set this to True to enable storing user passwords only as secure hashes in the db. This can dramatically increase CPU usage if you
      # don't also use oauth and tokens for internal communications (which requires keys/secret to be configured as well)
      # WARNING: you should not change this after a system has been initialized as it may cause a mismatch in existing passwords
      hashed_passwords: {{ .Values.anchoreGlobal.hashedPasswords }}

    credentials:
      database:
        {{- if .Values.anchoreGlobal.dbConfig.ssl }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreGlobal.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreGlobal.dbConfig.sslRootCertName }}"
        {{- else }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        {{- end }}
        db_connect_args:
          timeout: {{ .Values.anchoreGlobal.dbConfig.timeout }}
          ssl: false
        db_pool_size: {{ .Values.anchoreGlobal.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreGlobal.dbConfig.connectionPoolMaxOverflow }}

    services:
      {{- if .Values.anchoreEnterpriseRbac.enabled }}
      # This should never be exposed outside of linked containers/localhost. It is used only for internal service access
      rbac_authorizer:
        enabled: true
        require_auth: true
        endpoint_hostname: localhost
        listen: 127.0.0.1
        port: {{ .Values.anchoreEnterpriseRbac.service.authPort }}
      rbac_manager:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.api.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{- .Values.anchoreEnterpriseRbac.service.authPort }}"
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      {{- end }}
      {{- if .Values.anchoreEnterpriseReports.enabled }}
      reports:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.enterprise-reports.fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.anchoreEnterpriseReports.service.port }}
        enable_graphiql: "{{ .Values.anchoreEnterpriseReports.enableGraphql }}"
        enable_data_ingress: "{{ .Values.anchoreEnterpriseReports.enableDataIngress }}"
        cycle_timers:
          {{- toYaml .Values.anchoreEnterpriseReports.cycleTimers | nindent 10 }}
        {{- if .Values.anchoreEnterpriseRbac.enabled }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{- .Values.anchoreEnterpriseRbac.service.authPort }}"
        {{- end }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
      {{- end }}
      {{- if .Values.anchoreEnterpriseNotifications.enabled }}
      notifications:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.enterprise-notifications.fullname" . }}
        listen: '0.0.0.0'
        port: {{ .Values.anchoreEnterpriseNotifications.service.port }}
        authorization_handler: external
        authorization_handler_config:
          endpoint: "http://localhost:{{- .Values.anchoreEnterpriseRbac.service.authPort }}"
        cycle_timers:
          {{- toYaml .Values.anchoreEnterpriseNotifications.cycleTimers | nindent 10 }}
        ui_url: {{ include "anchore-engine.enterprise-ui.fullname" . | quote }}
      {{- end }}
{{- end -}}
 # enterprise_feeds_configmap.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled -}}
{{- $component := "enterprise-feeds" -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  config.yaml: |
    # Anchore Enterprise Service Configuration File
    # General system-wide configuration options, these should not need to
    # be altered for basic operation
    service_dir: {{ .Values.anchoreGlobal.serviceDir }}
    tmp_dir: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
    log_level: {{ .Values.anchoreGlobal.logLevel }}
    cleanup_images: {{ .Values.anchoreGlobal.cleanupImages }}
    allow_awsecr_iam_auto: {{ .Values.anchoreGlobal.allowECRUseIAMRole }}
    host_id: "${ANCHORE_POD_NAME}"
    internal_ssl_verify: {{ .Values.anchoreGlobal.internalServicesSsl.verifyCerts }}
    auto_restart_services: false
    license_file: /home/anchore/license.yaml
    metrics:
      enabled: {{ .Values.anchoreGlobal.enableMetrics }}

    # Locations for keys used for signing and encryption. Only one of 'secret' or 'public_key_path'/'private_key_path' needs to be set. If all are set then the keys take precedence over the secret value
    # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs.
    keys:
      secret: {{ .Values.anchoreGlobal.saml.secret }}
      {{- with .Values.anchoreGlobal.saml.publicKeyName }}
      public_key_path: /home/anchore/certs/{{- . }}
      {{- end }}
      {{- with .Values.anchoreGlobal.saml.privateKeyName }}
      private_key_path: /home/anchore/certs/{{- . }}
      {{- end }}

    # Configuring supported user authentication and credential management
    user_authentication:
      oauth:
        enabled: {{ .Values.anchoreGlobal.oauthEnabled }}
        default_token_expiration_seconds: {{ .Values.anchoreGlobal.oauthTokenExpirationSeconds }}

      # Set this to True to enable storing user passwords only as secure hashes in the db. This can dramatically increase CPU usage if you
      # don't also use oauth and tokens for internal communications (which requires keys/secret to be configured as well)
      # WARNING: you should not change this after a system has been initialized as it may cause a mismatch in existing passwords
      hashed_passwords: {{ .Values.anchoreGlobal.hashedPasswords }}

    credentials:
      database:
        {{- if .Values.anchoreEnterpriseFeeds.dbConfig.ssl }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{- .Values.anchoreEnterpriseFeeds.dbConfig.sslMode -}}&sslrootcert=/home/anchore/certs/{{- .Values.anchoreEnterpriseFeeds.dbConfig.sslRootCertName }}"
        {{- else }}
        db_connect: "postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}"
        {{- end }}
        db_connect_args:
          timeout: {{ .Values.anchoreEnterpriseFeeds.dbConfig.timeout }}
          ssl: false
        db_pool_size: {{ .Values.anchoreEnterpriseFeeds.dbConfig.connectionPoolSize }}
        db_pool_max_overflow: {{ .Values.anchoreEnterpriseFeeds.dbConfig.connectionPoolMaxOverflow }}
    services:
      feeds:
        enabled: true
        require_auth: true
        endpoint_hostname: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
        listen: 0.0.0.0
        port: {{ .Values.anchoreEnterpriseFeeds.service.port }}
        # Time delay in seconds between consecutive driver runs for processing data
        cycle_timers:
          {{- toYaml .Values.anchoreEnterpriseFeeds.cycleTimers | nindent 10 }}
        # Staging space for holding normalized output from drivers.
        local_workspace: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
        # Drivers process data from external sources and store normalized data in local_workspace. Processing large data sets
        # is a time consuming process for some drivers. To speed it up the container is shipped with pre-loaded data which is used
        # by default if local_workspace is empty.
        workspace_preload:
          # Do not use pre-loaded data if local_workspace is empty. Drivers will generate normalized data from scratch
          # disabled: true
          # To load the workspace from a different location, uncomment and configure workspace_preload_file property to point to the tar.gz file
          workspace_preload_file: "/workspace_preload/data.tar.gz"
        # If api_only is set to true, the service will not update feed data in the system.
        # API end points will be functional and serve feed data if any is available.
        api_only: {{ default "false" .Values.anchoreEnterpriseFeeds.apiOnly }}
        drivers:
          # Configuration section for drivers collecting and processing feed data.
          # All drivers are enabled by default unless explicitly disabled. npm and gem drivers are explicitly disabled out of the box
          npm:
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.npmDriverEnabled }}
          gem:
            # rubygem data comes packaged as a PostgreSQL dump file. gem driver loads the pg dump and normalizes the data.
            # To enable gem driver comment the enabled property and uncomment the db_connect property.
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.gemDriverEnabled }}
            db_connect: {{ default "'postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/gems'" .Values.anchoreEnterpriseFeeds.gemDbEndpoint }}
          amzn:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.amazonDriverEnabled }}
          centos:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.centosDriverEnabled }}
          debian:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.debianDriverEnabled }}
          ubuntu:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.ubuntuDriverEnabled }}
          rhel:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.rhelDriverEnabled }}
          ol:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.olDriverEnabled }}
          alpine:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.alpineDriverEnabled }}
          snyk:
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.snykDriverEnabled }}
          nvddb:
            enabled: {{ default "false" .Values.anchoreEnterpriseFeeds.nvdDriverEnabled }}
          nvdv2:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.nvdv2DriverEnabled }}
          vulndb:
            enabled: {{ default "true" .Values.anchoreEnterpriseFeeds.vulndbDriverEnabled }}
          msrc:
            enabled: {{ .Values.anchoreEnterpriseFeeds.msrcDriverEnabled }}
            api_key: {{ .Values.anchoreEnterpriseFeeds.msrcApiKey }}
            {{- with .Values.anchoreEnterpriseFeeds.msrcWhitelist }}
            whitelist:
              - {{ . }}
            {{- end }}
          github:
            enabled: {{ .Values.anchoreEnterpriseFeeds.githubDriverEnabled }}
            token: {{ .Values.anchoreEnterpriseFeeds.githubDriverToken }}
        {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_enable: {{ .Values.anchoreGlobal.internalServicesSsl.enabled }}
        ssl_cert: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretCertName }}"
        ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}"
        {{- end }}
{{- end -}}
 # enterprise_feeds_configmap_env.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled -}}
{{- $component := "enterprise-feeds" -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}-env
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
data:
  ANCHORE_DB_NAME: {{ index .Values "anchore-feeds-db" "postgresDatabase" | quote }}
  ANCHORE_DB_USER: {{ index .Values "anchore-feeds-db" "postgresUser"  | quote }}
  {{- if and (index .Values "anchore-feeds-db" "externalEndpoint") (not (index .Values "anchore-feeds-db" "enabled")) }}
  ANCHORE_DB_HOST: {{ index .Values "anchore-feeds-db" "externalEndpoint" | quote }}
  {{- else if and (index .Values "cloudsql" "enabled") (not (index .Values "anchore-feeds-db" "enabled")) }}
  ANCHORE_DB_HOST: "localhost:5432"
  {{- else }}
  ANCHORE_DB_HOST: "{{ template "postgres.anchore-feeds-db.fullname" . }}:5432"
  {{- end }}
{{- end }}
 # enterprise_feeds_deployment.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled -}}
{{- $component := "enterprise-feeds" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreEnterpriseFeeds.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: 1
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        {{- with .Values.anchoreEnterpriseFeeds.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchoreEnterpriseFeeds.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: "{{ .Chart.Name }}-{{ $component }}"
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "feeds"]
        ports:
        - containerPort: {{ .Values.anchoreEnterpriseFeeds.service.port }}
          name: feeds-api
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreEnterpriseFeeds.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "anchore-engine.fullname" . }}
              key: .feedsDbPassword
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        - name: {{ $component }}-scratch
          mountPath: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: feeds-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: feeds-api
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreEnterpriseFeeds.resources | nindent 10 }}
      volumes:
        - name: config-volume
          configMap:
            name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
        - name: {{ $component}}-scratch
          {{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          emptyDir: {}
        - name: logs
          emptyDir: {}
        - name: run
          emptyDir: {}
        {{- end }}
        - name: anchore-license
          secret:
            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - name: {{ .Values.cloudsql.serviceAccSecretName }}
          secret:
            secretName: {{ .Values.cloudsql.serviceAccSecretName }}
        {{- end }}
        {{- with .Values.anchoreGlobal.certStoreSecretName }}
        - name: certs
          secret:
            secretName: {{ . }}
        {{- end }}
      {{- with .Values.anchoreEnterpriseFeeds.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreEnterpriseFeeds.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreEnterpriseFeeds.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
      {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "anchore-engine.enterprise-feeds.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreEnterpriseFeeds.service.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.anchoreEnterpriseFeeds.service.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.anchoreEnterpriseFeeds.service.type }}
  ports:
    - name: feeds-api
      port: {{ .Values.anchoreEnterpriseFeeds.service.port }}
      targetPort: {{ .Values.anchoreEnterpriseFeeds.service.port }}
      protocol: TCP
  selector:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}

{{- end -}}
 # enterprise_ui_config_secret.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled -}}
{{- $component := "enterprise-ui" -}}

# Using a secret until UI app supports ENV vars inside the config file. Redis password is included in config.
kind: Secret
apiVersion: v1
metadata:
  name: {{ include "anchore-engine.enterprise-ui.fullname" . | quote }}
  labels:
    app: {{ include "anchore-engine.fullname" . | quote }}
    component: {{ $component }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
type: Opaque
stringData:
  config-ui.yaml: |
    {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
    engine_uri: 'https://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreApi.service.port }}/v1'
    {{- else }}
    engine_uri: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreApi.service.port }}/v1'
    {{- end }}
    {{- if and (index .Values "anchore-ui-redis" "externalEndpoint") (not (index .Values "anchore-ui-redis" "enabled")) }}
    redis_uri: '{{ index .Values "anchore-ui-redis" "externalEndpoint" }}'
    {{- else }}
    redis_uri: 'redis://:{{ index .Values "anchore-ui-redis" "password" }}@{{ template "redis.fullname" . }}-master:6379'
    {{- end }}
  {{- if .Values.anchoreEnterpriseRbac.enabled }}
    {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
    rbac_uri: 'https://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseRbac.service.apiPort }}/v1'
    {{- else }}
    rbac_uri: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseRbac.service.apiPort }}/v1'
    {{- end }}
  {{- end }}
  {{- if .Values.anchoreEnterpriseReports.enabled }}
    {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
    reports_uri: 'https://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseReports.service.port}}/v1'
    {{- else}}
    reports_uri: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseReports.service.port}}/v1'
    {{- end }}
  {{- end }}
  {{- if .Values.anchoreEnterpriseNotifications.enabled }}
    {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
    notifications_uri: 'https://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseNotifications.service.port}}/v1'
    {{- else}}
    notifications_uri: 'http://{{ template "anchore-engine.api.fullname" . }}:{{ .Values.anchoreEnterpriseNotifications.service.port}}/v1'
    {{- end }}
  {{- end }}
    {{- if and (and .Values.postgresql.externalEndpoint (not .Values.postgresql.enabled)) .Values.anchoreGlobal.dbConfig.ssl }}
    appdb_uri: 'postgresql://{{ .Values.postgresql.postgresUser }}:{{ .Values.postgresql.postgresPassword }}@{{ .Values.postgresql.externalEndpoint }}/{{ .Values.postgresql.postgresDatabase }}?ssl=verify-full'
    {{- else if and .Values.postgresql.externalEndpoint (not .Values.postgresql.enabled) }}
    appdb_uri: 'postgresql://{{ .Values.postgresql.postgresUser }}:{{ .Values.postgresql.postgresPassword }}@{{ .Values.postgresql.externalEndpoint }}/{{ .Values.postgresql.postgresDatabase }}'
    {{- else if and (index .Values "cloudsql" "enabled") (not (index .Values "postgresql" "enabled")) }}
    appdb_uri: 'postgresql://{{ .Values.postgresql.postgresUser }}:{{ .Values.postgresql.postgresPassword }}@localhost:5432/{{ .Values.postgresql.postgresDatabase }}'
    {{- else }}
    appdb_uri: 'postgresql://{{ .Values.postgresql.postgresUser }}:{{ .Values.postgresql.postgresPassword }}@{{ template "postgres.fullname" . }}:5432/{{ .Values.postgresql.postgresDatabase }}'
    {{- end }}
    license_path: '/home/anchore/'
    enable_ssl: {{ .Values.anchoreEnterpriseUi.enableSsl }}
    enable_proxy: {{ .Values.anchoreEnterpriseUi.enableProxy }}
    allow_shared_login: {{ .Values.anchoreEnterpriseUi.enableSharedLogin }}
    redis_flushdb: {{ .Values.anchoreEnterpriseUi.redisFlushdb }}
    policy_hub_uri: {{ .Values.anchoreEnterpriseUi.policyHubUri }}
    {{- with .Values.anchoreEnterpriseUi.customLinks }}
    custom_links:
      title: {{ .title }}
      links:
      {{- range .links }}
        {{- with . }}
        - title: {{ .title }}
          uri: {{ .uri }}
        {{- end }}
      {{- end }}
    {{- end }}
    {{- with .Values.anchoreEnterpriseUi.enableAddRepositories }}
    enable_add_repositories:
      admin: {{ .admin }}
      standard: {{ .standard }}
    {{- end }}
{{- end -}}
 # enterprise_ui_deployment.yaml
{{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled -}}
{{- $component := "enterprise-ui" -}}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "anchore-engine.enterprise-ui.fullname" . }}
  labels:
    app: {{ include "anchore-engine.fullname" . }}
    component: {{ $component }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreEnterpriseUi.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: 1
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
        release: {{ .Release.Name }}
        heritage: {{ .Release.Service }}
        {{- with .Values.anchoreEnterpriseUi.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchoreEnterpriseUi.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: "{{ .Chart.Name }}-{{ $component }}"
        image: {{ .Values.anchoreEnterpriseUi.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseUi.imagePullPolicy }}
        env:
        {{ if .Values.anchoreGlobal.dbConfig.ssl }}
        - name: PGSSLROOTCERT
          value: /home/anchore/certs/{{ .Values.anchoreGlobal.dbConfig.sslRootCertName }}
        {{- end }}
        {{ with .Values.anchoreEnterpriseUi.ldapsRootCaCertName }}
        - name: NODE_EXTRA_CA_CERTS
          value: /home/anchore/certs/{{- . }}
        {{- end }}
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreEnterpriseUi.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        ports:
        - containerPort: 3000
          protocol: TCP
          name: enterprise-ui
        volumeMounts:
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        - name: anchore-ui-config
          mountPath: /config/config-ui.yaml
          subPath: config-ui.yaml
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        livenessProbe:
          tcpSocket:
            port: enterprise-ui
          initialDelaySeconds: 120
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /service/health
            port: enterprise-ui
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreEnterpriseUi.resources | nindent 10 }}
      volumes:
      - name: anchore-license
        secret:
          secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
      - name: anchore-ui-config
        secret:
          secretName: {{ template "anchore-engine.enterprise-ui.fullname" . }}
      {{- with .Values.anchoreGlobal.certStoreSecretName }}
      - name: certs
        secret:
          secretName: {{ . }}
      {{- end }}
      {{- if .Values.cloudsql.useExistingServiceAcc }}
      - name: {{ .Values.cloudsql.serviceAccSecretName }}
        secret:
          secretName: {{ .Values.cloudsql.serviceAccSecretName }}
      {{- end }}
      {{- with .Values.anchoreEnterpriseUi.nodeSelector }}
      nodeSelector:
        {{ toYaml .Values.anchoreEnterpriseUi.nodeSelector | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreEnterpriseUi.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreEnterpriseUi.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
     {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ include "anchore-engine.enterprise-ui.fullname" . | quote }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreEnterpriseUi.service.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.anchoreEnterpriseUi.service.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  sessionAffinity: {{ .Values.anchoreEnterpriseUi.service.sessionAffinity }}
  type: {{ .Values.anchoreEnterpriseUi.service.type }}
  ports:
    - name: enterprise-ui
      port: {{ .Values.anchoreEnterpriseUi.service.port }}
      protocol: TCP
      targetPort: 3000
  selector:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}

{{- end -}}
 # enterprise_upgrade_job.yaml
{{- if .Values.anchoreEnterpriseGlobal.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-enterprise-upgrade"
  labels:
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  annotations:
    "helm.sh/hook": post-upgrade
    "helm.sh/hook-weight": "-3"
spec:
  template:
    metadata:
      name: "{{ .Release.Name }}-enterprise-upgrade"
      labels:
        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
        app.kubernetes.io/instance: {{ .Release.Name | quote }}
        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
      restartPolicy: Never
      containers:
      - name: "{{ .Release.Name }}-enterprise-upgrade"
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        {{- if .Values.anchoreGlobal.dbConfig.ssl }}
        args: ["/bin/bash", "-c", "anchore-enterprise-manager db --db-use-ssl --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME}?sslmode={{ .Values.anchoreGlobal.dbConfig.sslMode }}\\&sslrootcert=/home/anchore/certs/{{ .Values.anchoreGlobal.dbConfig.sslRootCertName }} upgrade --dontask"]
        {{- else }}
        args: ["/bin/bash", "-c", "anchore-enterprise-manager db --db-connect postgresql://${ANCHORE_DB_USER}:${ANCHORE_DB_PASSWORD}@${ANCHORE_DB_HOST}/${ANCHORE_DB_NAME} upgrade --dontask"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        volumeMounts:
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
    {{- with .Values.anchoreGlobal.certStoreSecretName }}
      volumes:
      - name: certs
        secret:
          secretName: {{ . }}
      {{- end }}
{{- end }} # ingress.yaml
{{- if .Values.ingress.enabled -}}
apiVersion: {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }} networking.k8s.io/v1beta1 {{- else }} extensions/v1beta1 {{- end }}
kind: Ingress
metadata:
  name: {{ template "anchore-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.ingress.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.ingress.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  {{- if .Values.ingress.tls }}
  tls:
    {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
    {{- end }}
  {{- end }}
  rules:
  {{- if or .Values.ingress.apiHosts .Values.ingress.uiHosts .Values.ingress.feedsHosts }}
    {{- range .Values.ingress.apiHosts }}
    - host: {{ . | quote }}
      http:
        paths:
        - path: {{ $.Values.ingress.apiPath }}
          backend:
            serviceName: {{ template "anchore-engine.api.fullname" $ }}
            servicePort: {{ $.Values.anchoreApi.service.port }}
    {{- end }}
    {{- range .Values.ingress.uiHosts }}
    - host: {{ . | quote }}
      http:
        paths:
        - path: {{ $.Values.ingress.uiPath }}
          backend:
            serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }}
            servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
    {{- end }}
    {{- range .Values.ingress.feedsHosts }}
    - host: {{ . | quote }}
      http:
        paths:
        - path: {{ $.Values.ingress.feedsPath }}
          backend:
            serviceName: {{ template "anchore-engine.enterprise-feeds.fullname" $ }}
            servicePort: {{ $.Values.anchoreEnterpriseFeeds.service.port }}
    {{- end }}
  {{- else }}
    - http:
        paths:
        {{- with .Values.ingress.apiPath }}
        - path: {{ . }}
          backend:
            serviceName: {{ template "anchore-engine.api.fullname" $ }}
            servicePort: {{ $.Values.anchoreApi.service.port }}
        {{- end }}
        {{- with .Values.ingress.uiPath }}
        - path: {{ . }}
          backend:
            serviceName: {{ template "anchore-engine.enterprise-ui.fullname" $ }}
            servicePort: {{ $.Values.anchoreEnterpriseUi.service.port }}
        {{- end }}
        {{- with .Values.ingress.feedsPath }}
        - path: {{ . }}
          backend:
            serviceName: {{ template "anchore-engine.enterprise-feeds.fullname" $ }}
            servicePort: {{ $.Values.anchoreEnterpriseFeeds.service.port }}
        {{- end }}
  {{- end }}
{{- end -}}
 # networkpolicy.yaml
{{- if .Values.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ template "postgresql.networkPolicy.apiVersion" . }}
metadata:
  name: "{{ template "postgresql.fullname" . }}"
  labels:
    app: {{ template "postgresql.name" . }}
    chart: {{ template "postgresql.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  podSelector:
    matchLabels:
      app: {{ template "postgresql.name" . }}
      release: {{ .Release.Name }}
  ingress:
    # Allow inbound connections
    - ports:
      - port: 5432
    {{- if not .Values.networkPolicy.allowExternal }}
      from:
      - podSelector:
          matchLabels:
            {{ template "postgresql.fullname" . }}-client: "true"
    {{- end }}
    # Allow prometheus scrapes
    - ports:
      - port: 9187
{{- end }}
 # policy_engine_deployment.yaml
{{- $component := "policy" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "anchore-engine.policy-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchorePolicyEngine.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: {{ .Values.anchorePolicyEngine.replicaCount }}
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        {{- with .Values.anchorePolicyEngine.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchorePolicyEngine.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
    {{- else }}
      {{- with .Values.anchoreGlobal.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ . }}
      {{- end }}
    {{- end }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: {{ .Chart.Name }}-{{ $component }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        {{- else }}
        image: {{ .Values.anchoreGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
        {{- end }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "policy_engine"]
        {{- else }}
        args: ["anchore-manager", "service", "start", "--no-auto-upgrade", "policy_engine"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchorePolicyEngine.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - name: policy
          containerPort: {{ .Values.anchorePolicyEngine.service.port }}
        volumeMounts:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- end }}
        - name: config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        - name: {{ $component }}-scratch
          mountPath: {{ .Values.anchoreGlobal.scratchVolume.mountPath }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: policy
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: policy
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchorePolicyEngine.resources | nindent 10 }}
      volumes:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          secret:
            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
        {{- end }}
        - name: config-volume
          configMap:
            name: {{ template "anchore-engine.fullname" . }}
        - name: {{ $component }}-scratch
          {{ toYaml .Values.anchoreGlobal.scratchVolume.details | nindent 10 }}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          emptyDir: {}
        - name: logs
          emptyDir: {}
        - name: run
          emptyDir: {}
        {{- end }}
        {{- with .Values.anchoreGlobal.certStoreSecretName }}
        - name: certs
          secret:
            secretName: {{ . }}
        {{- end }}
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - name: {{ .Values.cloudsql.serviceAccSecretName }}
          secret:
            secretName: {{ .Values.cloudsql.serviceAccSecretName }}
        {{- end }}
      {{- with .Values.anchorePolicyEngine.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchorePolicyEngine.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchorePolicyEngine.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
      {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "anchore-engine.policy-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchorePolicyEngine.service.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.anchorePolicyEngine.service.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.anchorePolicyEngine.service.type }}
  ports:
    - name: anchore-policy-api
      port: {{ .Values.anchorePolicyEngine.service.port }}
      targetPort: {{ .Values.anchorePolicyEngine.service.port }}
      protocol: TCP
  selector:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }} # pvc.yaml
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: {{ template "postgresql.fullname" . }}
  labels:
    app: {{ template "postgresql.name" . }}
    chart: {{ template "postgresql.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    "helm.sh/resource-policy": {{ default "" .Values.persistence.resourcePolicy }}
{{- if .Values.persistence.annotations }}
{{ toYaml .Values.persistence.annotations | indent 4 }}
{{- end }}
spec:
  accessModes:
    - {{ .Values.persistence.accessMode | quote }}
  resources:
    requests:
      storage: {{ .Values.persistence.size | quote }}
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
  storageClassName: ""
{{- else }}
  storageClassName: "{{ .Values.persistence.storageClass }}"
{{- end }}
{{- end }}
{{- end -}}
 # secrets.yaml
{{- if not .Values.anchoreGlobal.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "anchore-engine.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
type: Opaque
stringData:
  ANCHORE_ADMIN_PASSWORD: {{ include "anchore-engine.defaultAdminPassword" . | quote }}
  ANCHORE_DB_PASSWORD: {{ index .Values "postgresql" "postgresPassword" | quote }}
  {{- if and .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseFeeds.enabled }}
  .feedsDbPassword: {{ index .Values "anchore-feeds-db" "postgresPassword" | quote }}
  {{- end }}
{{- end }}
 # simplequeue_deployment.yaml
{{- $component := "simplequeue" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "anchore-engine.simplequeue.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreSimpleQueue.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "anchore-engine.fullname" . }}
      component: {{ $component }}
  replicas: {{ .Values.anchoreSimpleQueue.replicaCount }}
  strategy:
    type: Recreate
    rollingUpdate: null
  template:
    metadata:
      labels:
        app: {{ template "anchore-engine.fullname" . }}
        component: {{ $component }}
        {{- with .Values.anchoreSimpleQueue.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreGlobal.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.anchoreSimpleQueue.annotations }}
      annotations:
        {{ toYaml . | nindent 8 }}
      {{- end }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
    {{- if .Values.anchoreEnterpriseGlobal.enabled }}
      imagePullSecrets:
      - name: {{ .Values.anchoreEnterpriseGlobal.imagePullSecretName }}
    {{- else }}
      {{- with .Values.anchoreGlobal.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ . }}
      {{- end }}
    {{- end }}
      containers:
      {{- if .Values.cloudsql.enabled  }}
      - name: cloudsql-proxy
        image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
        imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
        command: ["/cloud_sql_proxy"]
        args:
        - "-instances={{ .Values.cloudsql.instance }}=tcp:5432"
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - "-credential_file=/var/{{ .Values.cloudsql.serviceAccSecretName }}/{{ .Values.cloudsql.serviceAccJsonName }}"
        volumeMounts:
        - mountPath: /var/{{ .Values.cloudsql.serviceAccSecretName }}
          name: {{ .Values.cloudsql.serviceAccSecretName }}
          readOnly: true
        {{- end }}
      {{- end }}
      - name: "{{ .Chart.Name }}-{{ $component }}"
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        image: {{ .Values.anchoreEnterpriseGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreEnterpriseGlobal.imagePullPolicy }}
        {{- else }}
        image: {{ .Values.anchoreGlobal.image }}
        imagePullPolicy: {{ .Values.anchoreGlobal.imagePullPolicy }}
        {{- end }}
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        args: ["anchore-enterprise-manager", "service", "start", "--no-auto-upgrade", "simplequeue"]
        {{- else }}
        args: ["anchore-manager", "service", "start", "--no-auto-upgrade", "simplequeue"]
        {{- end }}
        envFrom:
        - secretRef:
            name: {{ default (include "anchore-engine.fullname" .) .Values.anchoreGlobal.existingSecret }}
        - configMapRef:
            name: {{ template "anchore-engine.fullname" . }}-env
        env:
        {{- with .Values.anchoreGlobal.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.anchoreSimpleQueue.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - name: simplequeue
          containerPort: {{ .Values.anchoreSimpleQueue.service.port }}
        volumeMounts:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          mountPath: /home/anchore/license.yaml
          subPath: license.yaml
        {{- end }}
        - name: config-volume
          mountPath: /config/config.yaml
          subPath: config.yaml
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          mountPath: /anchore_service_config
        - name: logs
          mountPath: /var/log/anchore
        - name: run
          mountPath: /var/run/anchore
        {{- end }}
        {{- if (.Values.anchoreGlobal.certStoreSecretName) }}
        - name: certs
          mountPath: /home/anchore/certs/
          readOnly: true
        {{- end }}
        livenessProbe:
          httpGet:
            path: /health
            port: simplequeue
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          initialDelaySeconds: 120
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 6
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /health
            port: simplequeue
            {{- if .Values.anchoreGlobal.internalServicesSsl.enabled }}
            scheme: HTTPS
            {{- end }}
          timeoutSeconds: 10
          periodSeconds: 10
          failureThreshold: 3
          successThreshold: 1
        resources:
          {{ toYaml .Values.anchoreSimpleQueue.resources | nindent 10 }}
      volumes:
        {{- if .Values.anchoreEnterpriseGlobal.enabled }}
        - name: anchore-license
          secret:
            secretName: {{ .Values.anchoreEnterpriseGlobal.licenseSecretName }}
        {{- end }}
        - name: config-volume
          configMap:
            name: {{ template "anchore-engine.fullname" .}}
        {{- if .Values.anchoreGlobal.openShiftDeployment }}
        - name: service-config-volume
          emptyDir: {}
        - name: logs
          emptyDir: {}
        - name: run
          emptyDir: {}
        {{- end }}
        {{- with .Values.anchoreGlobal.certStoreSecretName }}
        - name: certs
          secret:
            secretName: {{ . }}
        {{- end }}
        {{- if .Values.cloudsql.useExistingServiceAcc }}
        - name: {{ .Values.cloudsql.serviceAccSecretName }}
          secret:
            secretName: {{ .Values.cloudsql.serviceAccSecretName }}
        {{- end }}
      {{- with .Values.anchoreSimpleQueue.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreSimpleQueue.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.anchoreSimpleQueue.tolerations }}
      tolerations:
        {{ toYaml . | nindent 8 }}
      {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "anchore-engine.simplequeue.fullname" . }}
  labels:
    app: {{ template "anchore-engine.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    component: {{ $component }}
    {{- with .Values.anchoreSimpleQueue.service.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
    {{- with .Values.anchoreGlobal.labels }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.anchoreSimpleQueue.service.annotations }}
  annotations:
    {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.anchoreSimpleQueue.service.type }}
  ports:
    - name: anchore-simplequeue-api
      port: {{ .Values.anchoreSimpleQueue.service.port }}
      targetPort: {{ .Values.anchoreSimpleQueue.service.port }}
      protocol: TCP
  selector:
    app: {{ template "anchore-engine.fullname" . }}
    component: {{ $component }}
 # svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "postgresql.fullname" . }}
  labels:
    app: {{ template "postgresql.name" . }}
    chart: {{ template "postgresql.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- if .Values.metrics.enabled }}
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "9187"
{{- end }}
spec:
  type: {{ .Values.service.type }}
  ports:
  {{- if .Values.metrics.enabled }}
  - name: metrics
    port: 9187
    targetPort: metrics
  {{- end }}
  - name: postgresql
    port: {{ .Values.service.port }}
    targetPort: postgresql
  {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
    nodePort: {{ .Values.service.nodePort }}
  {{- end }}
{{- if .Values.service.externalIPs }}
  externalIPs:
{{ toYaml .Values.service.externalIPs | indent 4 }}
{{- end }}
  selector:
    app: {{ template "postgresql.name" . }}
    release: {{ .Release.Name }}

## postgres image
image: postgres:9.6.18

## Specify a imagePullPolicy
## 'Always' if imageTag is 'latest', else set to 'IfNotPresent'
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
# imagePullPolicy:

## Specify imagePullSecrets
## ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
##
# imagePullSecrets: myregistrykey

## Create a database user
## Default: postgres
# postgresUser:
## Default: random 10 character string
# postgresPassword:

## Inject postgresPassword via a volume mount instead of environment variable
usePasswordFile: false

## Use Existing secret instead of creating one
## It must have a postgres-password key containing the desired password
# existingSecret: 'secret'

## Create a database
## Default: the postgres user
# postgresDatabase:

## Specify initdb arguments, e.g. --data-checksums
## ref: https://github.com/docker-library/docs/blob/master/postgres/content.md#postgres_initdb_args
## ref: https://www.postgresql.org/docs/current/static/app-initdb.html
# postgresInitdbArgs:

## Use an alternate scheduler, e.g. "stork".
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
# schedulerName:

## Optional duration in seconds the pod needs to terminate gracefully.
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
##
# terminationGracePeriodSeconds: 30

## Specify runtime config parameters as a dict, using camelCase, e.g.
## {"sharedBuffers": "500MB"}
## ref: https://www.postgresql.org/docs/current/static/runtime-config.html
# postgresConfig:

## Specify content for pg_hba.conf
## Default: do not create pg_hba.conf
# pgHbaConf: |-
#   local all all trust
#   host all all localhost trust
#   host mydatabase mysuser 192.168.0.0/24 md5

## Persist data to a persistent volume
persistence:
  enabled: true
  resourcePolicy:  # set resource-policy Helm annotation on PVC. Can be nil or "keep"

  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  # existingClaim:

  ## database data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  # storageClass: "-"
  accessMode: ReadWriteOnce
  size: 8Gi
  subPath: "postgresql-db"
  mountPath: /var/lib/postgresql/data/pgdata

  # annotations: {}

metrics:
  enabled: false
  image: wrouesnel/postgres_exporter
  imageTag: v0.4.6
  imagePullPolicy: IfNotPresent
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    ## Define additional custom metrics
    ## ref: https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file
    # customMetrics:
    #   pg_database:
    #     query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')"
    #     metrics:
    #       - name:
    #           usage: "LABEL"
    #           description: "Name of the database"
    #       - size_bytes:
    #           usage: "GAUGE"
    #           description: "Size of the database in bytes"

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    memory: 256Mi
    cpu: 100m

service:
  type: ClusterIP
  port: 5432
  externalIPs: []
  ## Manually set NodePort value
  ## Requires service.type: NodePort
  # nodePort:

networkPolicy:
  ## Enable creation of NetworkPolicy resources.
  ##
  enabled: false

  ## The Policy model to apply. When set to false, only pods with the correct
  ## client label will have network access to the port PostgreSQL is listening
  ## on. When true, PostgreSQL will accept connections from any source
  ## (with the correct destination port).
  ##
  allowExternal: true

## Node labels and tolerations for pod assignment
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
nodeSelector: {}
tolerations: []
affinity: {}

# Override default liveness & readiness probes
probes:
  liveness:
    initialDelay: 60
    timeoutSeconds: 5
    failureThreshold: 6
  readiness:
    initialDelay: 5
    timeoutSeconds: 3
    periodSeconds: 5
## Annotations for the deployment and nodes.
deploymentAnnotations: {}
podAnnotations: {}

## Deployment pods replace strategy
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
# strategy: {}

# Define custom environment variables to pass to the image here
extraEnv: {}
