Skip to content

Anchore Enterprise

This package deploys the Big Bang integration of Anchore Enterprise. It wraps the upstream Enterprise chart with Big Bang routes, Istio and network-policy resources, monitoring, SAML configuration automation, and maintained image references.

For product architecture, image analysis workflows, policy authoring, and CI/CD integrations, use the Anchore Enterprise documentation.

Enablement and configuration

In Big Bang, configure the package through the addons.anchoreEnterprise parent. The umbrella deploys the release as anchore-enterprise in the anchore namespace. It maps the Big Bang license, administrator-password, PostgreSQL, Redis, SSO, monitoring, ingress, image-pull, and test settings to this package.

Use the package’s upstream values only for upstream Enterprise chart configuration. Big Bang documents the parent entry point rather than duplicating that upstream configuration surface.

Provide licenses, administrator, database, and Redis credentials, and SAML material through your Big Bang deployment’s protected configuration mechanism. Do not commit those values or license content to source control.

Data services and state

The current package requires a consumer-provided PostgreSQL service. Anchore Enterprise 6.x requires PostgreSQL 17 or later with pg_cron configured. The package does not create or manage that service. Review Big Bang changes before provisioning the database or upgrading from a release with the bundled database.

The package includes a maintained Redis deployment for the UI by default. Big Bang can instead map the package to an external Redis service. Production operators own sizing, availability, backup, restore, and connectivity for external data services.

Access, SSO, and network integration

When enabled, the package creates Big Bang-managed routes for the UI and API. Configure the selected gateway through the umbrella ingress entry point. The API route blocks access to its metrics path; monitoring reaches metrics through in-cluster services.

Big Bang can configure Anchore SAML SSO from its global identity-provider settings. SSO requires Anchore Enterprise and a valid license. The post-install and post-upgrade Job applies the SAML provider configuration. Preserve certificate verification and ensure the IdP metadata endpoint is reachable. For identity-provider and role-mapping requirements, see Anchore’s SSO documentation.

The package uses bb-common to render Istio, mTLS, authorization-policy, route, and NetworkPolicy resources. When policies are enabled, allow traffic for Anchore services, the configured database and Redis services, the Anchore data service, the selected registry sources, and monitoring. Analyzer workloads pull and inspect untrusted image content, so scope their registry egress and credentials appropriately.

Monitoring and operations

With Big Bang monitoring enabled, the package renders a ServiceMonitor for enabled Anchore service metrics and configures mTLS scraping when required by the mesh. Use the Prometheus monitoring guide for metric semantics and dashboards.

For operations, use the upstream system-health and troubleshooting. See the release notes for upgrade behavior. Rendered-chart and package CI checks do not validate a license, external PostgreSQL or Redis availability, SAML trust, feed freshness, registry access, or image analysis. Verify those integrations in an approved environment before production use.