Deploying Anchore Enterprise on Google Kubernetes Engine (GKE)

Get an understanding of deploying Anchore Enterprise on a Google Kubernetes Engine (GKE) cluster and exposing it on the public internet.

When using Google Cloud, use Cloud SQL for PostgreSQL as a managed database service. Anchore Enterprise 6.x requires an external PostgreSQL 17 database with the pg_cron extension.

Prerequisites

A running GKE cluster with worker nodes launched. See GKE Documentation for more information on this setup.
Helm client installed on your local host.
AnchoreCTL installed on your local host.
An external PostgreSQL 17 database with the pg_cron extension. See Cloud SQL for PostgreSQL below.

Once you have a GKE cluster up and running with worker nodes launched, you can verify it by using the following command:

$ kubectl get nodes
NAME                                                STATUS   ROLES    AGE   VERSION
gke-standard-cluster-1-default-pool-c04de8f1-hpk4   Ready    <none>   78s   v1.30.3-gke.1639000
gke-standard-cluster-1-default-pool-c04de8f1-m03k   Ready    <none>   79s   v1.30.3-gke.1639000
gke-standard-cluster-1-default-pool-c04de8f1-mz3q   Ready    <none>   78s   v1.30.3-gke.1639000

Anchore Enterprise Helm Chart

Anchore maintains a Helm chart to simplify the software deployment process. An Anchore Enterprise deployment of the chart includes the following:

Anchore Enterprise software
Redis (7 or higher)

As of Anchore Enterprise 6.0, the chart no longer includes a bundled PostgreSQL database. You must provision an external PostgreSQL 17 database with the pg_cron extension. See Cloud SQL for PostgreSQL below.

To make the necessary configurations to the Helm chart, create a custom anchore_values.yaml file and reference it during deployment. There are many options for configuration with Anchore Enterprise. The following is intended to cover the minimum required changes to successfully deploy Anchore Enterprise on Google Kubernetes Engine.

For this deployment, a GKE ingress controller will be used. You can read more about Kubernetes Ingress with a GKE Ingress Controller.

Cloud SQL for PostgreSQL

For production deployments, Anchore recommends a cloud-provider managed database over running PostgreSQL in-cluster. On Google Cloud, use Cloud SQL for PostgreSQL. We suggest selecting a storage option that allows for automatic size increase and setting max_connections to at least 2,000.

Refer to the chart External Database documentation for the values-file settings needed to connect Anchore Enterprise to Cloud SQL.

Cloud SQL is a recommendation, not a requirement. You can instead run PostgreSQL in-cluster with CloudNativePG, or use any PostgreSQL 17+ instance you manage yourself — provided it has the pg_cron extension enabled and configured as described below.

Enable pg_cron

Anchore Enterprise 6.x requires the pg_cron extension. On Cloud SQL for PostgreSQL, enable it as follows:

Set the cloudsql.enable_pg_cron database flag to on. This requires an instance restart.
```
gcloud sql instances patch <INSTANCE_NAME> --database-flags=cloudsql.enable_pg_cron=on
```
If your instance already sets other database flags, include them in the same --database-flags list — the flag is replaced, not merged.
Set the cron.database_name flag to your Anchore database name (for example, anchore).
After the instance restarts, connect to the Anchore database and create the extension, then grant the Anchore user access to the cron schema:
```
CREATE EXTENSION IF NOT EXISTS pg_cron;
GRANT USAGE ON SCHEMA cron TO <ANCHORE_DB_USER>;
```

See the Google guidance on configuring PostgreSQL extensions in Cloud SQL for current details.

Configurations

Make the following changes to your anchore_values.yaml.

Ingress

ingress:
  enabled: true
  apiPaths:
    - /v2/*
  uiPath: /*

Configuring ingress is optional. It is used throughout this guide to expose the Anchore Enterprise deployment on the public internet.

If your load balancer or reverse proxy terminates TLS on behalf of Anchore Enterprise, you should set enable_ssl and enable_proxy to True in the Enterprise UI configuration. Without these settings, the UI may not correctly detect the HTTPS connection, which could result in unexpected behavior with session cookies and authentication. For more details, see Enterprise UI Configuration.

Anchore Enterprise API Service

api:
  replicaCount: 1
  # kubernetes service configuration for anchore external API
  service:
    type: NodePort
    port: 8228
    annotations: {}

Changed the service type to NodePort.

Anchore Enterprise UI

ui:
  # kubernetes service configuration for anchore UI
  service:
    type: NodePort
    port: 80
    annotations: {}
    sessionAffinity: ClientIP

Changed the service type to NodePort.

Anchore Enterprise Deployment

Create Secrets

Enterprise services require an Anchore Enterprise license, as well as credentials with permission to access the private Docker Hub repository containing the enterprise software.

Create a Kubernetes secret containing your license file:

kubectl create secret generic anchore-enterprise-license --from-file=license.yaml=<PATH/TO/LICENSE.YAML>

Create a Kubernetes secret containing Docker Hub credentials with access to the private Anchore Enterprise software:

kubectl create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username=<DOCKERHUB_USER> --docker-password=<DOCKERHUB_PASSWORD> --docker-email=<EMAIL_ADDRESS>

Deploy Anchore Enterprise:

helm repo add anchore https://charts.anchore.io
helm install anchore anchore/enterprise -f anchore_values.yaml

It will take the system several minutes to bootstrap. You can check the status of the pods by running kubectl get pods:

$ kubectl get pods
NAME                                                              READY   STATUS    RESTARTS   AGE
anchore-enterprise-analyzer-7f9c7c65c8-tp8cs                      1/1     Running   0          13m
anchore-enterprise-api-754cdb48bc-x8kxt                           1/1     Running   0          13m
anchore-enterprise-catalog-64d4b9bb8-x8vmb                        1/1     Running   0          13m
anchore-enterprise-componentcatalog-568b59b87c-zbb8f             1/1     Running   0          13m
anchore-enterprise-datasyncer-558959869f-qp9nx                    1/1     Running   0          13m
anchore-enterprise-notifications-65bd45459f-q28h2                 1/1     Running   0          13m
anchore-enterprise-policy-657fdfd7f6-gzkmh                        1/1     Running   0          13m
anchore-enterprise-reports-596cb47894-q8g49                       1/1     Running   0          13m
anchore-enterprise-reportsworker-6bc7f7b4dd-7fnrn                 1/1     Running   0          13m
anchore-enterprise-simplequeue-98b95f985-5xqcv                    1/1     Running   0          13m
anchore-enterprise-ui-6794bbd47-vxljt                             1/1     Running   0          13m
anchore-ui-redis-master-0                                         1/1     Running   0          13m

PostgreSQL is not listed because it runs externally on Cloud SQL. Run the following command for details on the deployed ingress resource:

$ kubectl describe ingress
Name:             anchore-enterprise
Namespace:        default
Address:          34.96.64.148
Default backend:  default-http-backend:80 (10.8.2.6:8080)
Rules:
  Host  Path  Backends
  ----  ----  --------
  *
        /v2/*   anchore-enterprise-api:8228 (<none>)
        /*      anchore-enterprise-ui:80 (<none>)
Annotations:
  kubernetes.io/ingress.class:            gce
  ingress.kubernetes.io/backends:         {"k8s-be-31175--55c0399dc5755377":"HEALTHY","k8s-be-31274--55c0399dc5755377":"HEALTHY","k8s-be-32037--55c0399dc5755377":"HEALTHY"}
  ingress.kubernetes.io/forwarding-rule:  k8s-fw-default-anchore-enterprise--55c0399dc5750
  ingress.kubernetes.io/target-proxy:     k8s-tp-default-anchore-enterprise--55c0399dc5750
  ingress.kubernetes.io/url-map:          k8s-um-default-anchore-enterprise--55c0399dc5750
Events:
  Type    Reason  Age   From                     Message
  ----    ------  ----  ----                     -------
  Normal  ADD     15m   loadbalancer-controller  default/anchore-enterprise
  Normal  CREATE  14m   loadbalancer-controller  ip: 34.96.64.148

The output above shows that a load balancer has been created. Navigate to the specified URL in a browser:

Anchore Enterprise System

Check the status of the system with AnchoreCTL to verify all of the Anchore Enterprise services are up:

Anchore Enterprise Feeds

It can take some time to fetch all of the vulnerability feeds from the upstream data sources. Check on the status of feeds with AnchoreCTL:

ANCHORECTL_URL=http://34.96.64.148 ANCHORECTL_USERNAME=admin ANCHORECTL_PASSWORD=<ADMIN_PASSWORD> anchorectl feed list

It is not uncommon for the above command to return [] while the initial feed sync occurs.

Once the vulnerability feed sync is complete, Anchore Enterprise can begin to return vulnerability results on analyzed images. Please continue to the Vulnerability Management section of our documentation for more information.

Last modified August 13, 2026