enterprise: v5.8.0, slo improvements, openshift testing, anchorectl s…

…moketests (#393) * enterprise: adding anchorectl_smoketests, openshift testing Signed-off-by: Hung Nguyen <[email protected]> * enterprise: v5.8.0, slo improvements Signed-off-by: Hung Nguyen <[email protected]> * enterprise: update Chart.lock for feeds v2.8.0 Signed-off-by: Hung Nguyen <[email protected]> * enterprise: recreate strategy for deployments Signed-off-by: Hung Nguyen <[email protected]> * remove upgrade option from chart testing to prevent out of disk errors in ci Signed-off-by: Brady Todhunter <[email protected]> --------- Signed-off-by: Hung Nguyen <[email protected]> Signed-off-by: Brady Todhunter <[email protected]> Co-authored-by: Brady Todhunter <[email protected]>
anchore · Jul 30, 2024 · f8c5981 · f8c5981
1 parent 1f03899
commit f8c5981
Show file tree

Hide file tree

Showing 39 changed files with 759 additions and 202 deletions.
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -99,4 +99,4 @@ jobs:
 
     - name: Run chart-testing
       if: steps.list-changed.outputs.CHANGED == 'true'
-      run: ct install --config ct-config.yaml --helm-extra-args "--timeout 600s" --upgrade
+      run: ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
diff --git a/stable/enterprise/.helmignore b/stable/enterprise/.helmignore
@@ -1,2 +1 @@
 .git
-tests/
diff --git a/stable/enterprise/Chart.lock b/stable/enterprise/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
   version: 17.11.8
 - name: feeds
   repository: https://charts.anchore.io/stable
-  version: 2.7.0
-digest: sha256:824b735ba784dca70b5e01b55b4955519381a930e16010ade22727eab5f9da88
-generated: "2024-06-28T16:21:14.882771-04:00"
+  version: 2.8.0
+digest: sha256:e18505c97fed5b83f4165e48141da0a80e955fd31aeff6ab1e32ddb350d6d250
+generated: "2024-07-30T16:08:35.816554-04:00"
diff --git a/stable/enterprise/Chart.yaml b/stable/enterprise/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: enterprise
-version: "2.8.0"
-appVersion: "5.7.0"
+version: "2.9.0"
+appVersion: "5.8.0"
 kubeVersion: 1.23.x - 1.30.x || 1.23.x-x - 1.30.x-x
 description: |
   Anchore Enterprise is a complete container security workflow solution for professional teams. Easily integrating with CI/CD systems,

diff --git a/stable/enterprise/README.md b/stable/enterprise/README.md
diff --git a/stable/enterprise/ci/openshift-test.yaml b/stable/enterprise/ci/openshift-test.yaml
@@ -0,0 +1,19 @@
+securityContext:
+  fsGroup: null
+  runAsGroup: null
+  runAsUser: null
+feeds:
+  chartEnabled: false
+  url: "my-release-feeds"
+postgresql:
+  primary:
+    containerSecurityContext:
+      enabled: false
+    podSecurityContext:
+      enabled: false
+ui-redis:
+  master:
+    podSecurityContext:
+      enabled: false
+    containerSecurityContext:
+      enabled: false
diff --git a/stable/enterprise/files/default_config.yaml b/stable/enterprise/files/default_config.yaml
@@ -203,6 +203,9 @@ services:
           packages:
             enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
             url: {{ template "enterprise.feedsURL" . }}
+          vulnerability_annotations:
+            enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
+            url: {{ template "enterprise.feedsURL" . }}
       matching:
         default:
           search:

diff --git a/stable/enterprise/files/osaa_config.yaml b/stable/enterprise/files/osaa_config.yaml
@@ -175,6 +175,9 @@ services:
           packages:
             enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
             url: {{ template "enterprise.feedsURL" . }}
+          vulnerability_annotations:
+            enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
+            url: {{ template "enterprise.feedsURL" . }}
       matching:
         default:
           search:

diff --git a/stable/enterprise/templates/_common.tpl b/stable/enterprise/templates/_common.tpl
@@ -108,8 +108,20 @@ When calling this template, .component can be included in the context for compon
   {{- with (index .Values (print $component)).extraEnv }}
 {{ toYaml . }}
   {{- end }}
+
+# check if the domainSuffix is set on the service level of the component, if it is, use that, else use the global domainSuffix
+{{- $serviceName := include (printf "enterprise.%s.fullname" $component) . }}
+{{- $domainSuffix := .Values.domainSuffix }}
+
+{{- with (index .Values (print $component)).service }}
+{{- if .domainSuffix }}
+{{- $domainSuffix = .domainSuffix }}
+{{- end }}
+{{- end }}
+
 - name: ANCHORE_ENDPOINT_HOSTNAME
-  value: {{ include (printf "enterprise.%s.fullname" $component) . }}.{{ .Release.Namespace }}.svc.cluster.local
+  value: {{ $serviceName }}.{{- if $domainSuffix -}}{{ $domainSuffix }}{{- else -}}{{ .Release.Namespace }}.svc.cluster.local{{- end }}
+
   {{- with (index .Values (print $component)).service }}
 - name: ANCHORE_PORT
   value: {{ .port | quote }}
@@ -348,3 +360,10 @@ Setup the common anchore volumes
     secretName: {{ .Values.cloudsql.serviceAccSecretName }}
 {{- end }}
 {{- end -}}
+
+{{/*
+Deployment Strategy Definition. For preupgrade hooks, use RollingUpdate. For postupgrade hooks, use Recreate.
+*/}}
+{{- define "enterprise.common.deploymentStrategy" -}}
+type: Recreate
+{{- end -}}
diff --git a/stable/enterprise/templates/_helpers.tpl b/stable/enterprise/templates/_helpers.tpl
@@ -164,3 +164,29 @@ Set the nodePort for services if its defined
 nodePort: {{ (index .Values (print $component)).service.nodePort }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Checks if the appVersion.minor has increased, which is indicitive of requiring a db upgrade/service scaling down
+*/}}
+{{- define "enterprise.appVersionChanged" -}}
+
+{{- $configMapName := include "enterprise.fullname" . -}}
+{{- $configMap := (lookup "v1" "ConfigMap" .Release.Namespace $configMapName) -}}
+{{- if $configMap -}}
+  {{- $currentAppVersion := .Chart.AppVersion -}}
+  {{- $currentAppVersionSplit := splitList "." $currentAppVersion -}}
+  {{- $currentAppVersionMajorMinor := ($currentAppVersionSplit | initial | join ".") -}}
+  {{- $labelVersionKey := "app.kubernetes.io/version" -}}
+  {{- $configMapAppVersion := index $configMap.metadata.labels $labelVersionKey -}}
+  {{- $configMapAppVersionSplit := splitList "." $configMapAppVersion -}}
+  {{- $configMapAppVersionMajorMinor := ($configMapAppVersionSplit | initial | join ".") -}}
+  {{- if ne $currentAppVersionMajorMinor $configMapAppVersionMajorMinor -}}
+    {{- print "true" -}}
+  {{- else -}}
+    {{- print "false" -}}
+  {{- end -}}
+{{- else -}}
+  {{- print "true" -}}
+{{- end -}}
+
+{{- end -}}
diff --git a/stable/enterprise/templates/_names.tpl b/stable/enterprise/templates/_names.tpl
@@ -71,6 +71,11 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- printf "%s-%s-%s-%s" .Release.Name $name (.Chart.AppVersion | replace "." "") "osaa-migration-job" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{- define "enterprise.smokeTest.fullname" -}}
+{{- $name := default .Chart.Name .Values.global.nameOverride -}}
+{{- printf "%s-%s-%s-%s" .Release.Name $name (.Chart.AppVersion | replace "." "") "smoke-test" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
 {{- define "enterprise.feeds.fullname" -}}
 {{- if .Values.feeds.fullnameOverride }}
   {{- .Values.feeds.fullnameOverride | trunc 63 | trimSuffix "-" }}

diff --git a/stable/enterprise/templates/analyzer_deployment.yaml b/stable/enterprise/templates/analyzer_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.analyzer.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -22,6 +21,7 @@ spec:
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
         checksum/analyzer-config: {{ include (print $.Template.BasePath "/analyzer_configmap.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/api_deployment.yaml b/stable/enterprise/templates/api_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.api.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -24,6 +23,7 @@ spec:
         checksum/policy-config: {{ include (print $.Template.BasePath "/policybundle_configmap.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/catalog_deployment.yaml b/stable/enterprise/templates/catalog_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.catalog.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -24,6 +23,7 @@ spec:
       {{- if .Values.anchoreConfig.policyBundles }}
         checksum/policy-config: {{ include (print $.Template.BasePath "/policybundle_configmap.yaml") . | sha256sum }}
       {{- end }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/envvars_configmap.yaml b/stable/enterprise/templates/envvars_configmap.yaml
@@ -64,6 +64,7 @@ data:
   ANCHORE_FEEDS_DRIVER_MSRC_ENABLED: {{ dig "anchoreConfig" "feeds" "drivers" "msrc" "enabled" "false" .Values.feeds | quote }}
   ANCHORE_FEEDS_DRIVER_NVDV2_ENABLED: "true"
   ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED: "false"
+  ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED: "true"
   ANCHORE_FEEDS_SSL_VERIFY: "{{ .Values.anchoreConfig.internalServicesSSL.verifyCerts }}"
   ANCHORE_FEEDS_VULNERABILITIES_ENABLED: "true"
   ANCHORE_GLOBAL_CLIENT_CONNECT_TIMEOUT: "0"

diff --git a/stable/enterprise/templates/hooks/pre-upgrade/upgrade_job.yaml b/stable/enterprise/templates/hooks/pre-upgrade/upgrade_job.yaml
@@ -39,6 +39,7 @@ spec:
           secret:
             secretName: {{ .Values.cloudsql.serviceAccSecretName }}
       {{- end }}
+      {{- if eq (include "enterprise.appVersionChanged" .) "true" }}
       initContainers:
         - name: scale-down-anchore
           image: {{ .Values.upgradeJob.kubectlImage }}
@@ -84,6 +85,7 @@ spec:
           {{- with .Values.upgradeJob.resources }}
           resources: {{- toYaml . | nindent 12 }}
           {{- end }}
+      {{- end }}
       containers:
       {{- if .Values.cloudsql.enabled  }}
         {{- include "enterprise.common.cloudsqlContainer" . | nindent 8 }}

diff --git a/stable/enterprise/templates/notifications_deployment.yaml b/stable/enterprise/templates/notifications_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.notifications.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -21,6 +20,7 @@ spec:
         checksum/secrets: {{ include (print $.Template.BasePath "/anchore_secret.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/policyengine_deployment.yaml b/stable/enterprise/templates/policyengine_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.policyEngine.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -21,6 +20,7 @@ spec:
         checksum/secrets: {{ include (print $.Template.BasePath "/anchore_secret.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/reports_deployment.yaml b/stable/enterprise/templates/reports_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.reports.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -21,6 +20,7 @@ spec:
         checksum/secrets: {{ include (print $.Template.BasePath "/anchore_secret.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/reportsworker_deployment.yaml b/stable/enterprise/templates/reportsworker_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.reportsWorker.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -21,6 +20,7 @@ spec:
         checksum/secrets: {{ include (print $.Template.BasePath "/anchore_secret.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ tpl (print $.Files.BasePath "/default_config.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/simplequeue_deployment.yaml b/stable/enterprise/templates/simplequeue_deployment.yaml
@@ -10,8 +10,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: {{ .Values.simpleQueue.replicaCount }}
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}
@@ -20,6 +19,7 @@ spec:
         checksum/secrets: {{ include (print $.Template.BasePath "/anchore_secret.yaml") . | sha256sum }}
       {{- end }}
         checksum/enterprise-config: {{ include (print $.Template.BasePath "/anchore_configmap.yaml") . | sha256sum }}
+        checksum/enterprise-envvar: {{ include (print $.Template.BasePath "/envvars_configmap.yaml") . | sha256sum }}
     spec:
       {{- include "enterprise.common.podSpec" (merge (dict "component" $component) .) | indent 6 }}
       volumes: {{- include "enterprise.common.volumes" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/templates/tests/anchorectl_smoketest.yaml b/stable/enterprise/templates/tests/anchorectl_smoketest.yaml
@@ -0,0 +1,30 @@
+{{- $component := "smokeTest" -}}
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ template "enterprise.smokeTest.fullname" . }}"
+  namespace: "{{ .Release.Namespace }}"
+  labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 4 }}
+  annotations: {{- include "enterprise.common.annotations" (merge (dict "component" $component "nil" true) .) | nindent 4 }}
+    "helm.sh/hook": test
+spec:
+  volumes: {{- include "enterprise.common.volumes" . | nindent 2 }}
+  containers:
+    - name: "anchorectl-smoketest"
+      image: {{ .Values.image }}
+      imagePullPolicy: {{ .Values.imagePullPolicy }}
+    {{- with .Values.containerSecurityContext }}
+      securityContext:
+        {{ toYaml . | nindent 12 }}
+    {{- end }}
+      envFrom: {{- include "enterprise.common.envFrom" . | nindent 6 }}
+      env: {{- include "enterprise.common.environment" (merge (dict "component" $component) .) | nindent 6 }}
+
+      command: ["/bin/bash", "-c"]
+      args:
+        - |
+          anchorectl system smoke-tests run
+
+      volumeMounts: {{- include "enterprise.common.volumeMounts" . | nindent 6 }}
+  restartPolicy: Never
diff --git a/stable/enterprise/templates/ui_deployment.yaml b/stable/enterprise/templates/ui_deployment.yaml
@@ -11,8 +11,7 @@ spec:
   selector:
     matchLabels: {{- include "enterprise.common.matchLabels" (merge (dict "component" $component) .) | nindent 6 }}
   replicas: 1
-  strategy:
-    type: Recreate
+  strategy: {{- include "enterprise.common.deploymentStrategy" . | nindent 4 }}
   template:
     metadata:
       labels: {{- include "enterprise.common.labels" (merge (dict "component" $component) .) | nindent 8 }}

diff --git a/stable/enterprise/tests/__snapshot__/configmap_test.yaml.snap b/stable/enterprise/tests/__snapshot__/configmap_test.yaml.snap
@@ -281,6 +281,9 @@ should render the configmaps:
                   packages:
                     enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
                     url: http://test-release-feeds:8448/v2/feeds
+                  vulnerability_annotations:
+                    enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
+                    url: http://test-release-feeds:8448/v2/feeds
               matching:
                 default:
                   search:
@@ -435,6 +438,7 @@ should render the configmaps:
       ANCHORE_FEEDS_DRIVER_MSRC_ENABLED: "false"
       ANCHORE_FEEDS_DRIVER_NVDV2_ENABLED: "true"
       ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED: "false"
+      ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED: "true"
       ANCHORE_FEEDS_SSL_VERIFY: "false"
       ANCHORE_FEEDS_VULNERABILITIES_ENABLED: "true"
       ANCHORE_GLOBAL_CLIENT_CONNECT_TIMEOUT: "0"

diff --git a/stable/enterprise/tests/__snapshot__/osaa_configmap_test.yaml.snap b/stable/enterprise/tests/__snapshot__/osaa_configmap_test.yaml.snap
@@ -242,6 +242,9 @@ should render the configmaps for osaa migration if enabled:
                   packages:
                     enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
                     url: http://test-release-feeds:8448/v2/feeds
+                  vulnerability_annotations:
+                    enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
+                    url: http://test-release-feeds:8448/v2/feeds
               matching:
                 default:
                   search:
@@ -563,6 +566,9 @@ should render the configmaps for osaa migration if enabled:
                   packages:
                     enabled: ${ANCHORE_FEEDS_DRIVER_PACKAGES_ENABLED}
                     url: http://test-release-feeds:8448/v2/feeds
+                  vulnerability_annotations:
+                    enabled: ${ANCHORE_FEEDS_DRIVER_VULN_ANNOTATIONS_ENABLED}
+                    url: http://test-release-feeds:8448/v2/feeds
               matching:
                 default:
                   search: