moving analyzer configs into defualt_config.yaml

stable/enterprise/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: enterprise
-version: "3.21.5"
+version: "3.21.3"  # will be 4.0.0
 appVersion: "6.0.0"
 kubeVersion: 1.23.x - 1.34.x || 1.23.x-x - 1.34.x-x
 description: |

stable/enterprise/files/base_config.yaml

@@ -4,7 +4,7 @@
 host_id: ${ANCHORE_HOST_ID}
 
 # Internal SSL verification
-internal_ssl_verify: ${ANCHORE_INTERNAL_SSL_VERIFY}
+internal_ssl_verify: {{ .Values.anchoreConfig.internal_ssl_verify }}
 
 # Global client timeouts
 global_client_connect_timeout: {{ include "enterprise.anchoreConfig.get" (merge (dict "configComponent" .configComponent "configKey" "global_client_connect_timeout") .) }}

stable/enterprise/templates/_common.tpl

@@ -563,6 +563,31 @@ Deployment Strategy Definition. For preupgrade hooks, use RollingUpdate. For pos
 type: Recreate
 {{- end -}}
 
+{{/*
+External access configuration for a service.
+Renders external_hostname, external_port, and external_tls from the service's anchoreConfig.
+{{- include "enterprise.anchoreConfig.anchoreService.external" (merge (dict "anchoreService" "apiext") .) }}
+*/}}
+{{- define "enterprise.anchoreConfig.anchoreService.external" -}}
+{{- $anchoreService := .anchoreService -}}
+{{- $serviceConfig := index .Values.anchoreConfig (print $anchoreService) -}}
+external_hostname: {{ $serviceConfig.external_hostname | toYaml }}
+external_port: {{ $serviceConfig.external_port | toYaml }}
+external_tls: {{ $serviceConfig.external_tls }}
+{{- end }}
+
+{{/*
+Cycle timers configuration for a service.
+Renders cycle_timer_seconds and cycle_timers from the service's anchoreConfig.
+{{- include "enterprise.anchoreConfig.anchoreService.cycleTimers" (merge (dict "anchoreService" "analyzer") .) }}
+*/}}
+{{- define "enterprise.anchoreConfig.anchoreService.cycleTimers" -}}
+{{- $anchoreService := .anchoreService -}}
+{{- $serviceConfig := index .Values.anchoreConfig (print $anchoreService) -}}
+cycle_timer_seconds: {{ $serviceConfig.cycle_timer_seconds }}
+cycle_timers: {{- toYaml $serviceConfig.cycle_timers | nindent 2 }}
+{{- end }}
+
 {{/*
 Common server blocks
 When calling this template, .anchoreService can be included in the context for anchoreService specific server blocks
@@ -592,6 +617,21 @@ When calling this template, .component can be included in the context for compon
 {{- end }}
 {{- end -}}
 
+{{/*
+Return the logging config for a service, with service-level override support.
+Checks anchoreConfig.<service>.logging first, falls back to anchoreConfig.logging.
+Usage: {{ include "enterprise.common.logging" (merge (dict "service" "apiext") .) }}
+*/}}
+{{- define "enterprise.common.logging" -}}
+{{- $service := .service -}}
+{{- $serviceCfg := index .Values.anchoreConfig $service -}}
+{{- if and $serviceCfg (kindIs "map" $serviceCfg) (hasKey $serviceCfg "logging") -}}
+  {{- toYaml $serviceCfg.logging -}}
+{{- else -}}
+  {{- toYaml .Values.anchoreConfig.logging -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "enterprise.common.listenAddress" -}}
 {{- $component := .component -}}
 {{- $componentCtx := index .Values (print $component) }}

stable/enterprise/templates/_helpers.tpl

@@ -40,13 +40,29 @@ data:
 {{- end -}}
 
 {{/*
-Fail if the removed postgresql.chartEnabled value is still set. This was removed when the Bitnami PostgreSQL
-dependency was dropped — users must now provide their own external PostgreSQL database.
+Consolidated deprecation and validation checks for breaking changes.
 */}}
-{{- define "enterprise.validateNoChartEnabled" -}}
+{{- define "enterprise.deprecationChecks" -}}
+{{/* postgresql.chartEnabled was removed when the Bitnami PostgreSQL dependency was dropped */}}
 {{- if hasKey .Values.postgresql "chartEnabled" }}
   {{- fail "postgresql.chartEnabled is no longer supported. The Bitnami PostgreSQL dependency has been removed. Please remove postgresql.chartEnabled from your values and configure postgresql.externalEndpoint, postgresql.auth.username, postgresql.auth.password, and postgresql.auth.database (or use existing secrets) to connect to your own PostgreSQL database." }}
 {{- end }}
+{{/* retrieve_files was renamed to file_contents */}}
+{{- if hasKey .Values.anchoreConfig.analyzer.configFile "retrieve_files" }}
+  {{- fail "anchoreConfig.analyzer.configFile.retrieve_files is no longer supported. This key has been renamed to `file_contents`. Please update your values file to use `anchoreConfig.analyzer.configFile.file_contents` instead." }}
+{{- end }}
+{{/* image_ttl_days=-1 is no longer valid */}}
+{{- if eq (toString .Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days) "-1" }}
+  {{- fail "The value `-1` is no longer valid for `anchoreConfig.catalog.runtime_inventory.image_ttl_days`. Please use `anchoreConfig.catalog.runtime_inventory.inventory_ingest_overwrite=true` to force runtime inventory to be overwritten upon every update for that reported context. `anchoreConfig.catalog.runtime_inventory.inventory_ttl_days` must be set to a value >1." }}
+{{- end }}
+{{/* internalServicesSSL has been removed — SSL is now configured via the server block at the root or per-service level */}}
+{{- if hasKey .Values.anchoreConfig "internalServicesSSL" }}
+  {{- fail "anchoreConfig.internalServicesSSL is no longer supported. SSL is now configured via `anchoreConfig.server` (root level) or per-service `anchoreConfig.<service>.server` blocks using `ssl_enable`, `ssl_cert`, `ssl_chain`, and `ssl_key`." }}
+{{- end }}
+{{/* apiext.external has been replaced by per-service external_hostname, external_port, external_tls */}}
+{{- if hasKey .Values.anchoreConfig.apiext "external" }}
+  {{- fail "anchoreConfig.apiext.external is no longer supported. Use `anchoreConfig.apiext.external_hostname`, `anchoreConfig.apiext.external_port`, and `anchoreConfig.apiext.external_tls` instead." }}
+{{- end }}
 {{- end -}}
 
 {{/*
@@ -149,10 +165,10 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 
 
 {{/*
-Return the proper protocol when Anchore internal SSL is enabled
+Return the proper protocol when Anchore SSL is enabled via the root server block
 */}}
 {{- define "enterprise.setProtocol" -}}
-  {{- if .Values.anchoreConfig.internalServicesSSL.enabled }}
+  {{- if .Values.anchoreConfig.server.ssl_enable }}
 {{- print "https" -}}
   {{- else -}}
 {{- print "http" -}}
@@ -252,7 +268,7 @@ Takes in a map of drivers and checks if the driver is enabled. If not, update th
 Checks if the feeds chart was previously disabled or if any of the drivers were disabled. If so and required values aren't set, fail the upgrade.
 */}}
 {{- define "enterprise.exclusionCheck" -}}
-{{- include "enterprise.validateNoChartEnabled" . }}
+{{- include "enterprise.deprecationChecks" . }}
 
 {{ $notify := false }}
 
@@ -334,7 +350,9 @@ Ensuring use_proxy cannot be enabled without enable_ssl
 
 {{/*
 Adds extendedConfig for a given service. Appends arbitrary user-supplied YAML to the service config block. Should only be used by recommendation of Anchore Support.
-Usage: {{ include "enterprise.serviceExtendedConfig" (merge (dict "serviceName" "catalog") .) }}
+NOTE: nindent is intentionally inside the helper (not at the call site) because piping an empty result through nindent
+produces trailing whitespace, which causes YAML to render config.yaml as a quoted string instead of a block scalar.
+Usage: {{- include "enterprise.serviceExtendedConfig" (merge (dict "serviceName" "catalog") .) }}
 */}}
 {{- define "enterprise.serviceExtendedConfig" -}}
 {{- $extendedConfig := (index .Values.anchoreConfig (print .serviceName)).extendedConfig -}}

stable/enterprise/templates/analyzer_deployment.yaml

@@ -20,17 +20,13 @@ spec:
         checksum/secrets: {{ include (print $.Template.BasePath "/anchore_secret.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
-        checksum/analyzer-config: {{ include (print $.Template.BasePath "/analyzer_configmap.yaml") . | sha256sum }}
         checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       {{- include "enterprise.common.hostAliases" (merge (dict "component" $component) .) | nindent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}
         - name: anchore-scratch
           {{- include "enterprise.common.scratchVolume.details" (merge (dict "component" $component) .) | nindent 10 }}
-        - name: analyzer-config-volume
-          configMap:
-            name: {{ template "enterprise.analyzer.fullname" . }}
       {{- if or
             (and .Values.scratchVolume.fixGroupPermissions .Values.securityContext.fsGroup)
             (and (.Values.cloudsql.enabled) (.Values.cloudsql.useSideCar))
@@ -62,9 +58,6 @@ spec:
             - name: {{ $component | lower }}
               containerPort: {{ .Values.analyzer.service.port }}
           volumeMounts: {{- include "enterprise.common.volumeMounts" (merge (dict "component" $component) .) | nindent 12 }}
-            - name: analyzer-config-volume
-              mountPath: "{{ .Values.anchoreConfig.service_dir }}/analyzer_config.yaml"
-              subPath: analyzer_config.yaml
             - name: "anchore-scratch"
               mountPath: {{ .Values.scratchVolume.mountPath }}
           livenessProbe: {{- include "enterprise.common.livenessProbe" (merge (dict "component" $component) .) | nindent 12 }}

stable/enterprise/templates/envvars_configmap.yaml

@@ -56,15 +56,8 @@ data:
   ANCHORE_ENTERPRISE_REPORTS_DATA_LOAD_MAX_WORKERS: "{{ .Values.anchoreConfig.reports_worker.data_load_max_workers }}"
   ANCHORE_ENTERPRISE_REPORTS_ENABLE_GRAPHIQL: "{{ .Values.anchoreConfig.reports.enable_graphiql }}"
   ANCHORE_ENTERPRISE_REPORTS_MAX_ASYNC_EXECUTION_THREADS: "1"
-  ANCHORE_ENTERPRISE_REPORTS_VULNERABILITIES_BY_ECS_CONTAINER: "true"
-  ANCHORE_ENTERPRISE_REPORTS_VULNERABILITIES_BY_K8S_CONTAINER: "true"
-  ANCHORE_ENTERPRISE_REPORTS_VULNERABILITIES_BY_K8S_NAMESPACE: "true"
-{{- if eq (toString .Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days) "-1" }}
-  {{- fail "The Value `-1` is no longer valid for `.Values.anchoreConfig.catalog.runtime_inventory.image_ttl_days`. Please use `.Values.anchoreConfig.catalog.runtime_inventory.inventory_ingest_overwrite=true` to force runtime inventory to be overwritten upon every update for that reported context. `.Values.anchoreConfig.catalog.runtime_inventory.inventory_ttl_days` must be set to a value >1." -}}
-{{- else }}
   ANCHORE_ENTERPRISE_RUNTIME_INVENTORY_TTL_DAYS: "{{ .Values.anchoreConfig.catalog.runtime_inventory.inventory_ttl_days }}"
   ANCHORE_ENTERPRISE_RUNTIME_INVENTORY_INGEST_OVERWRITE: "{{ .Values.anchoreConfig.catalog.runtime_inventory.inventory_ingest_overwrite }}"
-{{- end }}
   ANCHORE_ENTERPRISE_INTEGRATION_HEALTH_REPORTS_TTL_DAYS: "{{ .Values.anchoreConfig.catalog.integrations.integration_health_report_ttl_days }}"
 {{- with .Values.anchoreConfig.notifications.ui_url }}
   ANCHORE_ENTERPRISE_UI_URL: "{{ . }}"
@@ -77,7 +70,6 @@ data:
   ANCHORE_HINTS_ENABLED: "{{ .Values.anchoreConfig.analyzer.enable_hints }}"
   ANCHORE_IMAGE_ANALYZE_TIMEOUT_SECONDS: "36000"
   ANCHORE_IMPORT_OPERATION_EXPIRATION_DAYS: "7"
-  ANCHORE_INTERNAL_SSL_VERIFY: "{{ .Values.anchoreConfig.internalServicesSSL.verifyCerts }}"
   ANCHORE_KEEP_IMAGE_ANALYSIS_TMPFILES: "false"
   ANCHORE_LAYER_CACHE_ENABLED: {{ ternary "true" "false" (gt .Values.anchoreConfig.analyzer.layer_cache_max_gigabytes 0.0) | quote }}
   ANCHORE_LAYER_CACHE_SIZE_GB: "{{ .Values.anchoreConfig.analyzer.layer_cache_max_gigabytes }}"
@@ -86,7 +78,6 @@ data:
   ANCHORE_MAX_COMPRESSED_IMAGE_SIZE_MB: "-1"
   ANCHORE_MAX_IMPORT_CONTENT_SIZE_MB: "100"
   ANCHORE_MAX_IMPORT_SOURCE_SIZE_MB: "100"
-  ANCHORE_MAX_REQUEST_THREADS: "50"
   ANCHORE_OAUTH_ENABLED: "{{ .Values.anchoreConfig.user_authentication.oauth.enabled }}"
   ANCHORE_OAUTH_TOKEN_EXPIRATION: "{{ .Values.anchoreConfig.user_authentication.oauth.default_token_expiration_seconds }}"
   ANCHORE_OAUTH_REFRESH_TOKEN_EXPIRATION: "{{ .Values.anchoreConfig.user_authentication.oauth.refresh_token_expiration_seconds }}"
@@ -95,26 +86,5 @@ data:
   ANCHORE_POLICY_EVAL_CACHE_TTL_SECONDS: "3600"
   ANCHORE_SAML_SECRET: "null"
   ANCHORE_SERVICE_DIR: "{{ .Values.anchoreConfig.service_dir }}"
-  ANCHORE_SSL_ENABLED: "{{ .Values.anchoreConfig.internalServicesSSL.enabled }}"
-{{- with .Values.anchoreConfig.internalServicesSSL.certSecretCertFileName }}
-  ANCHORE_SSL_CERT: "/home/anchore/certs/{{- . }}"
-{{- else }}
-  ANCHORE_SSL_CERT: "null"
-{{- end }}
-{{- with .Values.anchoreConfig.internalServicesSSL.certSecretKeyFileName }}
-  ANCHORE_SSL_KEY: "/home/anchore/certs/{{- . }}"
-{{- else }}
-  ANCHORE_SSL_KEY: "null"
-{{- end }}
   ANCHORE_SSO_REQUIRES_EXISTING_USERS: "{{ .Values.anchoreConfig.user_authentication.sso_require_existing_users }}"
   ANCHORE_TMP_DIR: "{{ .Values.scratchVolume.mountPath }}"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_DOTNET_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_GOLANG_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_JAVA_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_JAVASCRIPT_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_PYTHON_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_RUBY_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_STOCK_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_DEFAULT_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_RUST_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"
-  ANCHORE_VULN_MATCHING_ECOSYSTEM_SPECIFIC_JVM_SEARCH_BY_CPE_ENABLED: "<ALLOW_API_CONFIGURATION>"