added repo
This commit is contained in:
Your Name
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
# OWNERS file for Kubernetes
|
||||
OWNERS
|
||||
@@ -0,0 +1,413 @@
|
||||
# SonarQube Chart Changelog
|
||||
All changes to this chart will be documented in this file.
|
||||
|
||||
## [10.5.0]
|
||||
* Update Chart's version to 10.5.0
|
||||
|
||||
## [10.4.0]
|
||||
* Upgrade SonarQube to 10.4.0
|
||||
* Update Chart's version to 10.4.0
|
||||
* Improve the description of deprecated `jvmOpts` and `jvmCeOpts` values
|
||||
* Run the initSysctl init-container as root to prevent 'permission denied' issues
|
||||
* Add revisionHistoryLimit configuration for SonarQube application Deployment ReplicaSets & StatefulSets
|
||||
* Update the security contexts to use root as group ID
|
||||
* Fix empty ingress annotations in values
|
||||
|
||||
## [10.3.0]
|
||||
* Upgrade SonarQube to 10.3.0
|
||||
* Update Chart's version to 10.3.0
|
||||
* Update default images to the latest versions
|
||||
* Remove the nginx-proxy-body annotation when nginx is disabled
|
||||
* Enable post-upgrade in the change-admin-password hook
|
||||
* Update default ContainerSecurityContext, InitContainerSecurityContext and postgresql.securityContext to match restricted podSecurityStandard
|
||||
* Update initFs defaut securityContext to match baseline podSecurityStandard
|
||||
* Update Elasticsearch.configureNode to false by default after 3 year deprecation
|
||||
* Fix wrong condition on initSysctl feature
|
||||
* Update default image of initContainers to sonarqube image, allowing for faster loading time and less external images needed
|
||||
* Support Kubernetes v1.28
|
||||
* Avoid duplicate SONAR_WEB_SYSTEMPASSCODE secrets
|
||||
* Deprecate embedded PostgreSQL
|
||||
* Update nginx-ingress-controller dependency to version 4.8.3, please carefully read the changelog of this new major version.
|
||||
|
||||
## [10.2.0]
|
||||
* Update SonarQube to 10.2.0
|
||||
* Update Chart's version to 10.2.0
|
||||
* Update curl image to 8.2.0
|
||||
* `readinessProbe.sonarWebContext`, `startupProbe.sonarWebContext`, `livenessProbe.sonarWebContext`, and `account.sonarWebContext` are deprecated, please use `sonarWebContext` at the value top level.
|
||||
* Updates ingress-nginx dependency to 4.7.1
|
||||
* Fixes broken table on README
|
||||
|
||||
## [10.1.0]
|
||||
* Update SonarQube to 10.1.0
|
||||
* Support Kubernetes v1.27 while dropping v1.23
|
||||
* Changed default test process to wget, using sonarqube image as default
|
||||
* Update Chart's version to 10.1.0
|
||||
* Fix liveness probe to detect when a failure occurs.
|
||||
|
||||
## [10.0.0]
|
||||
* Update SonarQube to 10.0.0
|
||||
* Helm chart versioning will now follow the SonarQube product versioning
|
||||
|
||||
## [9.5.1]
|
||||
* Make `jvmOpts` and `jvmCeOpts` not override env vars and sonar properties
|
||||
|
||||
## [9.5.0]
|
||||
* Add helm-chart-sonarqube as chart source
|
||||
|
||||
## [9.4.2]
|
||||
* Fixed unsupported wget parameter `--proxy off` with `--no-proxy`
|
||||
|
||||
## [9.4.1]
|
||||
* Fix install_plugins.sh not deleting previously installed plugins
|
||||
|
||||
## [9.4.0]
|
||||
* Added support for `extraVolumes` and `extraVolumeMounts` in sonar pod.
|
||||
|
||||
## [9.3.1]
|
||||
* Clarify doc for custom cacert secret
|
||||
|
||||
## [9.3.0]
|
||||
* Refactor Deployment manifest to match the Statefulset manifest
|
||||
|
||||
## [9.2.0]
|
||||
* Add a configurable Prometheus PodMonitor resource
|
||||
* Refactor Prometheus exporter's documentation and bump to version 0.17.2
|
||||
|
||||
## [9.1.0]
|
||||
* Allow setting priorityClassName for StatefulSets
|
||||
|
||||
## [9.0.1]
|
||||
* Adds timeoutSeconds parameter to probes
|
||||
|
||||
## [9.0.0]
|
||||
* Update SonarQube logo
|
||||
* Bootstrap chart version 9.x.x dedicated to the future SonarQube 10.0
|
||||
## [8.0.0]
|
||||
* Update SonarQube to 9.9.0
|
||||
* Bootstrap chart version 8.x.x dedicated to SonarQube 9.9 LTS
|
||||
|
||||
## [7.0.2]
|
||||
* Update the list of supported kubernetes versions
|
||||
|
||||
## [7.0.1]
|
||||
* Set a new default (maximum) allowed size of the client request body on the ingress
|
||||
|
||||
## [7.0.0]
|
||||
* Update SonarQube to 9.8.0
|
||||
|
||||
## [6.2.1]
|
||||
* Update the postgresql chart's repository
|
||||
|
||||
|
||||
## [6.2.0]
|
||||
* Refactor Ingress to be compatible with static compatibitly test and 1.19 minimum requirement
|
||||
|
||||
## [6.1.2]
|
||||
* Updated SonarQube to 9.7.1
|
||||
|
||||
## [6.1.1]
|
||||
* Refactor templating of ConfigMap for sonar.properties
|
||||
* Fix the bug where sonarSecretKey was not applied without sonar.properties set
|
||||
|
||||
## [6.1.0]
|
||||
* Fix the installation of plugins using the standard folder `extensions/plugins` instead of `extensions/downloads` and `lib/common`
|
||||
* Remove `plugins.lib` and other small edits in the documentation
|
||||
|
||||
## [6.0.0]
|
||||
* Updated SonarQube to 9.7.0
|
||||
|
||||
## [5.4.1]
|
||||
* Fix the right-dash curly brace issue with the additional network policy parameter
|
||||
|
||||
## [5.4.0]
|
||||
* Allow `tests.image` to be configured and update README accordingly.
|
||||
* Allow `tests.initContainers.image` to be configured and update README accordingly.
|
||||
|
||||
## [5.3.0]
|
||||
* Use the networkPolicy.prometheusNamespace value for the network policy namespace selector
|
||||
* Uncomment default value in values.yaml for backwards compatibility
|
||||
|
||||
## [5.2.0]
|
||||
* Add support for monitoringPasscode passed as a secret and removal of livenessprobe httpheader defined in clear text
|
||||
|
||||
## [5.1.0]
|
||||
* Bump apiVersion to v2
|
||||
* Set the number of allowed replicas to 0 and 1
|
||||
* Add documentation for ingress tls
|
||||
* Add documentation for sonarProperties and sonarSecretProperties
|
||||
* Add the possibility of using a secret for customizing the admin password
|
||||
|
||||
## [5.0.6]
|
||||
* Updated SonarQube to 9.6.1
|
||||
|
||||
## [5.0.0]
|
||||
* Updated SonarQube to 9.6.0
|
||||
|
||||
## [4.0.3]
|
||||
* Add support for Openshift Route labels and annotations
|
||||
|
||||
## [4.0.2]
|
||||
* Fix issue with Openshift route name to use use fullname instead of name
|
||||
|
||||
## [4.0.1]
|
||||
* Add documentation for ingress annotations
|
||||
|
||||
## [4.0.0]
|
||||
* updated SonarQube to 9.5.0
|
||||
|
||||
## [3.0.4]
|
||||
* Fix issue with additional network policy
|
||||
|
||||
## [3.0.3]
|
||||
* Add automount service account token flag
|
||||
|
||||
## [3.0.2]
|
||||
* Add documentation to setup web context via environment variable
|
||||
|
||||
## [3.0.1]
|
||||
* Fix for issue (#215)[https://github.com/SonarSource/helm-chart-sonarqube/issues/215], adding tolerations and affinity to change password hooks
|
||||
|
||||
## [3.0.0]
|
||||
* updated SonarQube to 9.4.0
|
||||
|
||||
## [2.0.7]
|
||||
* Specify location of .netrc file when downloading plugins that require auth
|
||||
|
||||
## [2.0.6]
|
||||
* Specify service account name in change admin password hook
|
||||
|
||||
## [2.0.5]
|
||||
* secure admin password in k8s secret
|
||||
|
||||
## [2.0.4]
|
||||
* no longer automount service account token
|
||||
|
||||
## [2.0.3]
|
||||
* changed description of dependency postgresql chart
|
||||
|
||||
## [2.0.2]
|
||||
* changed links to get a better overview of sources
|
||||
|
||||
## [2.0.1]
|
||||
* Updated all instances of the caCerts enabled check
|
||||
|
||||
## [2.0.0]
|
||||
* updated SonarQube to 9.3.0
|
||||
|
||||
## [1.6.5]
|
||||
* add securitycontext to wait-for-db and change-password hook
|
||||
|
||||
## [1.6.4]
|
||||
* properties are now correctly set
|
||||
|
||||
## [1.6.3]
|
||||
* `livenessProbe.failureThreshold` was never rendered
|
||||
|
||||
## [1.6.2]
|
||||
* added missing logic for `caCerts.enabled`
|
||||
|
||||
## [1.6.1]
|
||||
* fix missing `SONAR_WEB_SYSTEMPASSCODE` environment variable causing failed liveness checks
|
||||
|
||||
## [1.5.1]
|
||||
* added possibility to define host of a route
|
||||
|
||||
## [1.5.0]
|
||||
* detached sonarqube edition from version
|
||||
|
||||
## [1.4.0]
|
||||
* added possibility to define the ingress pathType
|
||||
* added network policies
|
||||
* added possibility to define ressources for the change admin password hook
|
||||
* default permissions for prometheus injector now align with pod fs permissions
|
||||
* updated dependencies
|
||||
* admin hook now honors web context
|
||||
|
||||
## [1.3.0]
|
||||
* added support for multiple image pull secrets
|
||||
* added `image.pullSecrets`
|
||||
* deprecated support for singular image pull secret
|
||||
* deprecated `image.pullSecret`
|
||||
* fixed missing image pull secret in admin hook job
|
||||
|
||||
## [1.2.5]
|
||||
* updated SonarQube to 9.2.4
|
||||
|
||||
## [1.2.4]
|
||||
* updated SonarQube to 9.2.3
|
||||
|
||||
## [1.2.3]
|
||||
* updated SonarQube to 9.2.2
|
||||
|
||||
## [1.2.2]
|
||||
* fix hardcoded reference to port 9000
|
||||
|
||||
## [1.2.1]
|
||||
* updated SonarQube to 9.2.1
|
||||
|
||||
## [1.2.0]
|
||||
* updated SonarQube to 9.2.0
|
||||
|
||||
## [1.1.11]
|
||||
* fixed missing POD level security context for statefulset deployment
|
||||
|
||||
## [1.1.10]
|
||||
* added link to community support forum
|
||||
* Use liveness endpoint instead of helth endpoint for liveness probe
|
||||
|
||||
## [1.1.9]
|
||||
* fixed wrong scc user reference if name was explicitly set
|
||||
|
||||
## [1.1.8]
|
||||
* fixed serviceaccount logic
|
||||
|
||||
## [1.1.7]
|
||||
* fixed wrong artifact hub images annotation
|
||||
|
||||
## [1.1.6]
|
||||
* updated sonarqube to 9.1.0
|
||||
|
||||
## [1.1.5]
|
||||
* added resources to ui-test pod template
|
||||
|
||||
## [1.1.4]
|
||||
* fixed artifacthub annotations
|
||||
|
||||
## [1.1.3]
|
||||
* fixed `invalid: metadata.labels: Invalid value` error on the `chart` label of the pvc
|
||||
|
||||
## [1.1.2]
|
||||
* fixed condition check to add new certificates
|
||||
|
||||
## [1.1.1]
|
||||
* updated default application version to 9.0.1
|
||||
* release to helm repository
|
||||
|
||||
## [1.1.0]
|
||||
* update jdbc overwrite values
|
||||
* replace `jdbcUrlOverride` with `jdbcOverwrite.jdbcUrl`
|
||||
* remove useless `jdbcDatabaseType` (was always postgres)
|
||||
* deprecate `postgresql.postgresqlServer`, `postgresql.existingSecret` and `postgresql.existingSecretPasswordKey` in favor of new `jdbcOverwrite` values
|
||||
* update dependency Charts
|
||||
* `bitnami/postgresql` from 8.6.4 to 10.4.8
|
||||
* `ingress-nginx/ingress-nginx` from 3.29.0 to 3.31.0
|
||||
|
||||
## [1.0.19]
|
||||
* Add optional ingress parameter `ingressClassName`
|
||||
|
||||
## [1.0.18]
|
||||
* added route support for OpenShift deployments
|
||||
|
||||
## [1.0.17]
|
||||
* Add an additional configuration parameter `extraContainers` to allow an array of containers to run alongside the sonarqube container
|
||||
|
||||
## [1.0.16]
|
||||
* fixed usage of `sonarSecretProperties`
|
||||
|
||||
## [1.0.15]
|
||||
* bump jmx_exporter to 0.16.0
|
||||
|
||||
## [1.0.14]
|
||||
* added hostAliases to deploymentType statefulset
|
||||
|
||||
## [1.0.13]
|
||||
* made prometheus exporter port configurable and support prometheus PodMonitor
|
||||
|
||||
## [1.0.12]
|
||||
* make sure SQ is restarted when the JMX Prometheus exporter agents configuration changes
|
||||
|
||||
## [1.0.11]
|
||||
* JMX Prometheus exporter agent is now also enabled on the CE process
|
||||
* `prometheusExporter.ceConfig` allows specific config of the JMX Prometheus exporter agent for the CE process
|
||||
|
||||
## [1.0.10]
|
||||
* added prometheusExporter.noCheckCertificate option
|
||||
|
||||
## [1.0.9]
|
||||
* add missing imagePullSecrets in sts install type
|
||||
|
||||
## [1.0.8]
|
||||
* fix typo in initfs
|
||||
* fix plugin installation init container permissions
|
||||
* fix duplicated mount point for conf when sonar.properties are defined
|
||||
|
||||
## [1.0.7]
|
||||
* fix invalid yaml render in `secret.yaml` when using external postgresql
|
||||
|
||||
## [1.0.6]
|
||||
* added `prometheusExporter.downloadURL` (custom download URL for the agent jar)
|
||||
|
||||
## [1.0.5]
|
||||
* replace `rjkernick/alpine-wget` with `curlimages/curl`
|
||||
* update `install-plugins` script
|
||||
* fix possible issue with prometheus init container and `env` set in the `values.yaml`
|
||||
|
||||
## [1.0.4]
|
||||
* fix for missing `serviceAccountName` in STS deployment kind
|
||||
|
||||
## [1.0.3]
|
||||
* fixed prometheus config volume mount if disabled
|
||||
* switched from wget to curl image per default for downloading agent
|
||||
* added support for proxy envs
|
||||
|
||||
## [1.0.2]
|
||||
* added option to configure CE java opts separately
|
||||
|
||||
## [1.0.1]
|
||||
* fixed missing conditional that was introduced in 0.9.2.2 to sonarqube-sts.yaml
|
||||
* updated default application version to 8.9
|
||||
|
||||
## [1.0.0]
|
||||
* changed default deployment from replica set to statefull set
|
||||
* added default support for prometheus jmx exporter
|
||||
* added init filesystem container
|
||||
* added nginx-ingress as optional dependency
|
||||
* updated application version to 8.8-community
|
||||
* improved readiness/startup and liveness probes
|
||||
* improved documentation
|
||||
|
||||
## [0.9.6.2]
|
||||
* Change order of env variables to better support 7.9-lts
|
||||
|
||||
## [0.9.6.1]
|
||||
* Add support for setting custom annotations in admin hook job.
|
||||
|
||||
## [0.9.6.0]
|
||||
* Add the possibility of definining the secret key name of the postgres password.
|
||||
|
||||
## [0.9.5.0]
|
||||
* Add Ingress default backend for GCE class
|
||||
|
||||
## [0.9.2.3]
|
||||
* Added namespace to port-foward command in notes.
|
||||
|
||||
## [0.9.2.2]
|
||||
* Added a condition to deployment.yaml so that `wait-for-db` initContainer is only created if `postgresql.enabled=true`
|
||||
|
||||
## [0.9.2.1]
|
||||
* Updated the configuration table to include the additional keys added in release 9.2.0.
|
||||
|
||||
## [0.9.2.0]
|
||||
* Added functionality for deployments to OpenShift clusters.
|
||||
* .Values.OpenShift flag to signify if deploying to OpenShift.
|
||||
* Ability to have chart generate an SCC allowing the init-sysctl container to run as privileged.
|
||||
* Setting of a seperate securityContext section for the main SonarQube container to avoid running as root.
|
||||
* Exposing additional `postreSQL` keys in values.yaml to support configuring postgres to run under standard "restricted" or "anyuid"/"nonroot" SCCs on OpenShift.
|
||||
* Added initContainer `wait-for-db` to await postgreSQL successful startup before starting SonarQube, to avoid race conditions.
|
||||
|
||||
## [0.9.1.1]
|
||||
* Update SonarQube to 8.5.1.
|
||||
* **Fix:** Purge plugins directory before download.
|
||||
|
||||
## [0.9.0.0]
|
||||
* Update SonarQube to 8.5.
|
||||
* **Breaking change:** Rework init containers.
|
||||
* Move global defaults from `plugins` section to `initContainers`.
|
||||
* Update container images.
|
||||
* **Deprecation:** `elasticsearch.configureNode` in favor of `initSysctl.enabled`.
|
||||
* Rework sysctl with support for custom values.
|
||||
* Rework plugins installation via `opt/sonarqube/extensions/downloads` folder that is handled by SonarQube itself.
|
||||
* **Breaking change:** remove `plugins.deleteDefaultPlugins` as SonarQube stores bundled plugins out of `opt/sonarqube/extensions`.
|
||||
* Rename deprecated `SONARQUBE_` environment variables to `SONAR_` ones.
|
||||
* **Breaking change:** Rename `enabledTests` to `tests.enabled`.
|
||||
* Add `terminationGracePeriodSeconds`.
|
||||
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami
|
||||
version: 10.15.0
|
||||
- name: ingress-nginx
|
||||
repository: https://kubernetes.github.io/ingress-nginx
|
||||
version: 4.8.3
|
||||
digest: sha256:b7e97eebfb9bef175c1ee936a6963a52f126213d736957f8bc8aea572736cfcd
|
||||
generated: "2023-11-09T16:31:37.771827026+01:00"
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: v2
|
||||
name: sonarqube
|
||||
description: SonarQube is a self-managed, automatic code review tool that systematically helps you deliver clean code. As a core element of our Sonar solution, SonarQube integrates into your existing workflow and detects issues in your code to help you perform continuous code inspections of your projects. The tool analyses 30+ different programming languages and integrates into your CI pipeline and DevOps platform to ensure that your code meets high-quality standards.
|
||||
type: application
|
||||
version: 10.5.0
|
||||
appVersion: 10.4.0
|
||||
keywords:
|
||||
- coverage
|
||||
- security
|
||||
- code
|
||||
- quality
|
||||
home: https://www.sonarqube.org/
|
||||
icon: https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/helm/SonarQubeLogo.svg
|
||||
sources:
|
||||
- https://github.com/SonarSource/helm-chart-sonarqube
|
||||
- https://github.com/SonarSource/docker-sonarqube
|
||||
- https://github.com/SonarSource/sonarqube
|
||||
kubeVersion: '>= 1.24.0-0'
|
||||
maintainers:
|
||||
- name: leo-geoffroy-sonarsource
|
||||
email: leo.geoffroy+helm@sonarsource.com
|
||||
- name: carminevassallo
|
||||
email: carmine.vassallo@sonarsource.com
|
||||
- name: jCOTINEAU
|
||||
email: jeremy.cotineau@sonarsource.com
|
||||
- name: davividal
|
||||
email: davi.koscianski-vidal@sonarsource.com
|
||||
annotations:
|
||||
artifacthub.io/links: |
|
||||
- name: support
|
||||
url: https://community.sonarsource.com/
|
||||
- name: Chart Source
|
||||
url: https://github.com/SonarSource/helm-chart-sonarqube/tree/master/charts/sonarqube
|
||||
artifacthub.io/changes: |
|
||||
- kind: changed
|
||||
description: "Update Chart's version to 10.5.0"
|
||||
artifacthub.io/containsSecurityUpdates: "false"
|
||||
artifacthub.io/images: |
|
||||
- name: sonarqube
|
||||
image: sonarqube:10.4.0-community
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
version: 10.15.0
|
||||
repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami
|
||||
condition: postgresql.enabled
|
||||
- name: ingress-nginx
|
||||
version: 4.8.3
|
||||
repository: https://kubernetes.github.io/ingress-nginx
|
||||
condition: nginx.enabled
|
||||
@@ -0,0 +1,10 @@
|
||||
approvers:
|
||||
- leo-geoffroy-sonarsource
|
||||
- pierre-guillot-sonarsource
|
||||
- carminevassallo
|
||||
- jCOTINEAU
|
||||
reviewers:
|
||||
- leo-geoffroy-sonarsource
|
||||
- pierre-guillot-sonarsource
|
||||
- carminevassallo
|
||||
- jCOTINEAU
|
||||
@@ -0,0 +1,551 @@
|
||||
# SonarQube
|
||||
|
||||
Code better in up to 27 languages. Improve Code Quality and Code Security throughout your workflow. [SonarQube](https://www.sonarqube.org/) can detect Bugs, Vulnerabilities, Security Hotspots and Code Smells and give you the guidance to fix them.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps an instance of the latest SonarQube version with a PostgreSQL database.
|
||||
|
||||
The latest version of the chart installs the latest SonarQube version.
|
||||
|
||||
To install the version of the chart for SonarQube 9.9 LTS, please read the section [below](#installing-the-sonarqube-99-lts-chart). Deciding between LTS and Latest? [This may help](https://www.sonarsource.com/products/sonarqube/downloads/lts/)
|
||||
|
||||
Please note that this chart only supports SonarQube Community, Developer, and Enterprise editions.
|
||||
|
||||
## Compatibility
|
||||
|
||||
Compatible SonarQube Version: `10.4.0`
|
||||
|
||||
Supported Kubernetes Versions: From `1.24` to `1.28`
|
||||
|
||||
## Installing the chart
|
||||
|
||||
To install the chart:
|
||||
|
||||
```bash
|
||||
helm repo add sonarqube https://SonarSource.github.io/helm-chart-sonarqube
|
||||
helm repo update
|
||||
kubectl create namespace sonarqube
|
||||
helm upgrade --install -n sonarqube sonarqube sonarqube/sonarqube
|
||||
```
|
||||
|
||||
The above command deploys SonarQube on the Kubernetes cluster in the default configuration in the sonarqube namespace. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
The default login is admin/admin.
|
||||
|
||||
## Installing the SonarQube 9.9 LTS chart
|
||||
|
||||
The version of the chart for the SonarQube 9.9 LTS is being distributed as the `8.x.x` version of this chart.
|
||||
|
||||
In order to use it, please set the version constraint `~8`, which is equivalent to `>=8.0.0 && <= 9.0.0`. That version parameter **must** be used in every helm related command including `install`, `upgrade`, `template`, and `diff` (don't treat this as an exhaustive list).
|
||||
|
||||
Example:
|
||||
```
|
||||
helm upgrade --install -n sonarqube --version ~8 sonarqube sonarqube/sonarqube
|
||||
```
|
||||
|
||||
To upgrade from the old and unmaintained [sonarqube-lts chart](https://artifacthub.io/packages/helm/sonarqube/sonarqube-lts), please follow the steps described [in this section](#upgrade-from-the-old-sonarqube-lts-to-this-chart).
|
||||
|
||||
## How to use it
|
||||
|
||||
Take some time to read the Deploy on [SonarQube on Kubernetes](https://docs.sonarqube.org/latest/setup/sonarqube-on-kubernetes/) page.
|
||||
SonarQube deployment on Kubernetes has been tested with the recommendations and constraints documented there, and deployment has some limitations.
|
||||
|
||||
## Uninstalling the chart
|
||||
|
||||
To uninstall/delete the deployment:
|
||||
|
||||
```bash
|
||||
$ helm list
|
||||
NAME REVISION UPDATED STATUS CHART NAMESPACE
|
||||
kindly-newt 1 Mon Oct 2 15:05:44 2017 DEPLOYED sonarqube-0.1.0 sonarqube
|
||||
$ helm delete kindly-newt
|
||||
```
|
||||
|
||||
## Prerequisites and suggested settings for production
|
||||
|
||||
Please read the official documentation prerequisites [here](https://docs.sonarqube.org/latest/requirements/prerequisites-and-overview/).
|
||||
|
||||
### Kubernetes - Pod Security Standards
|
||||
|
||||
Here is the list of containers that are compatible with the [Pod Security levels](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-levels):
|
||||
|
||||
* privileged:
|
||||
* `init-sysctl`
|
||||
* baseline:
|
||||
* `init-fs`
|
||||
* restricted:
|
||||
* SQ application containers
|
||||
* SQ init containers.
|
||||
* postgresql containers.
|
||||
|
||||
This is achieved by setting this SecurityContext as default on **most** containers:
|
||||
```
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 0
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
```
|
||||
|
||||
Based on that, one can run the SQ helm chart in a full restricted namespace, by deactivating the `initSysctl.enabled` and `initFs.enabled` parameters, which require root access.
|
||||
|
||||
Please take a look at [production-use-case](#production-use-case) for more information or directly at the values.yaml file.
|
||||
|
||||
### Elasticsearch prerequisites
|
||||
|
||||
SonarQube runs Elasticsearch under the hood.
|
||||
|
||||
Elasticsearch is rolling out (strict) prerequisites that cannot be disabled when running in production context (see [this](https://www.elastic.co/blog/bootstrap_checks_annoying_instead_of_devastating) blog post regarding bootstrap checks, and the [official guide](https://www.elastic.co/guide/en/elasticsearch/reference/5.0/bootstrap-checks.html)).
|
||||
|
||||
Because of such constraints, even when running in Docker containers, SonarQube requires some settings at the host/kernel level.
|
||||
|
||||
Please carefully read the following and make sure these configurations are set up at the host level:
|
||||
|
||||
- [vm.max_map_count](https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html#vm-max-map-count)
|
||||
- [seccomp filter should be available](https://github.com/SonarSource/docker-sonarqube/issues/614)
|
||||
|
||||
In general, please carefully read the Elasticsearch's [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/system-config.html).
|
||||
|
||||
### Production use case
|
||||
|
||||
The SonarQube helm chart is packed with multiple features enabling users to install and test SonarQube on Kubernetes easily.
|
||||
|
||||
Nonetheless, if you intend to run a production-grade SonarQube please follow these recommendations.
|
||||
|
||||
- Set `nginx.enabled` to **false**. This parameter would run the nginx chart. This is useful for testing purposes only. Ingress controllers are critical Kubernetes components, we advise users to install their own.
|
||||
- Set `postgresql.enabled` to **false**. This parameter would run the postgresql pre-2022 bitnami chart. That is useful for testing purposes, however, given that the database is at the hearth of SonarQube, we advise users to be careful with it and use a well-maintained database as a service or deploy their own database on top of Kubernetes.
|
||||
- Set `initSysctl.enabled` to **false**. This parameter would run **root** `sysctl` commands, while those sysctl-related values should be set by the Kubernetes administrator at the node level (see [here](#elasticsearch-prerequisites))
|
||||
- Set `initFs.enabled` to **false**. This parameter would run **root** `chown` commands. The parameter exists to fix non-posix, CSI, or deprecated drivers.
|
||||
|
||||
## Upgrade
|
||||
|
||||
1. Read through the [SonarQube Upgrade Guide](https://docs.sonarqube.org/latest/setup/upgrading/) to familiarize yourself with the general upgrade process (most importantly, back up your database)
|
||||
2. Change the SonarQube version on `values.yaml`
|
||||
3. Redeploy SonarQube with the same helm chart (see [Install instructions](#installing-the-chart))
|
||||
4. Browse to http://yourSonarQubeServerURL/setup and follow the setup instructions
|
||||
5. Reanalyze your projects to get fresh data
|
||||
|
||||
### Upgrade from the old sonarqube-lts to this chart
|
||||
|
||||
Please refer to the Helm upgrade section accessible [here](https://docs.sonarqube.org/latest/setup-and-upgrade/upgrade-the-server/upgrade-guide/)
|
||||
|
||||
## Ingress
|
||||
|
||||
### Path
|
||||
|
||||
Some cloud may need the path to be `/*` instead of `/.` Try this first if you are having issues getting traffic through the ingress.
|
||||
|
||||
### Default Backend
|
||||
|
||||
if you use GCP as a cloud provider you need to set a default backend to avoid useless default backend created by the gce controller. To add this default backend you must set "ingress.class" annotation with "gce" or "gce-internal" value.
|
||||
|
||||
Example:
|
||||
|
||||
```yaml
|
||||
---
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- name: sonarqube.example.com
|
||||
path: "/*"
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "gce-internal"
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
```
|
||||
|
||||
## Monitoring
|
||||
|
||||
This Helm chart offers the possibility to monitor SonarQube with Prometheus.
|
||||
|
||||
### Export JMX metrics
|
||||
|
||||
The prometheus exporter (`prometheusExporter.enabled=true`) converts the JMX metrics into a format that Prometheus can understand. After the metrics are exported, you can connect your Prometheus instance and scrape them.
|
||||
|
||||
Per default the JMX metrics for the Web Bean and the CE Bean are exposed on port 8000 and 8001. These values can be configured with `prometheusExporter.webBeanPort` and `prometheusExporter.ceBeanPort`.
|
||||
|
||||
### PodMonitor
|
||||
|
||||
If a Prometheus Operator is deployed in your cluster, you can enable a PodMonitor resource with `prometheusMonitoring.podMonitor.enabled`. It scrapes the Prometheus endpoint `/api/monitoring/metrics` exposed by the SonarQube application.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the SonarQube chart and their default values.
|
||||
|
||||
### Global
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| -------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------- |
|
||||
| `deploymentType` | Deployment Type (supported values are `StatefulSet` or `Deployment`) | `StatefulSet` |
|
||||
| `replicaCount` | Number of replicas deployed (supported values are 0 and 1) | `1` |
|
||||
| `deploymentStrategy` | Deployment strategy | `{}` |
|
||||
| `priorityClassName` | Schedule pods on priority (e.g. `high-priority`) | `None` |
|
||||
| `schedulerName` | Kubernetes scheduler name | `None` |
|
||||
| `affinity` | Node / Pod affinities | `{}` |
|
||||
| `tolerations` | List of node taints to tolerate | `[]` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `hostAliases` | Aliases for IPs in /etc/hosts | `[]` |
|
||||
| `podLabels` | Map of labels to add to the pods | `{}` |
|
||||
| `env` | Environment variables to attach to the pods | `{}` |
|
||||
| `annotations` | SonarQube Pod annotations | `{}` |
|
||||
| `edition` | SonarQube Edition to use (e.g. `community`, `developer` or `enterprise`) | `community` |
|
||||
| `sonarWebContext` | SonarQube web context, also serve as default value for `ingress.path`, `account.sonarWebContext` and probes path. | `` |
|
||||
|
||||
### NetworkPolicies
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ---------------------------------------- | -------------------------------------------------------------- | ------- |
|
||||
| `networkPolicy.enabled` | Create NetworkPolicies | `false` |
|
||||
| `networkPolicy.prometheusNamespace` | Allow incoming traffic to monitoring ports from this namespace | `nil` |
|
||||
| `networkPolicy.additionalNetworkPolicys` | User defined NetworkPolicies (usefull for external database) | `nil` |
|
||||
|
||||
### OpenShift
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------------- | -------------------------------------------------------------------------------------- | ------- |
|
||||
| `OpenShift.enabled` | Define if this deployment is for OpenShift | `false` |
|
||||
| `OpenShift.createSCC` | If this deployment is for OpenShift, define if SCC should be created for sonarqube pod | `true` |
|
||||
|
||||
### Image
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------- | ---------------------------------------------------------- | ------------------------------ |
|
||||
| `image.repository` | image repository | `sonarqube` |
|
||||
| `image.tag` | `sonarqube` image tag. | `10.4.0-{{ .Values.edition }}` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecret` | (DEPRECATED) imagePullSecret to use for private repository | `None` |
|
||||
| `image.pullSecrets` | imagePullSecrets to use for private repository | `None` |
|
||||
|
||||
### Security
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| -------------------------- | ---------------------------------------------- | ---------------------------------------------------------------------- |
|
||||
| `securityContext.fsGroup` | Group applied to mounted directories/files | `0` |
|
||||
| `containerSecurityContext` | SecurityContext for container in sonarqube pod | [Restricted podSecurityStandard](#kubernetes---pod-security-standards) |
|
||||
|
||||
### Elasticsearch
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------- | ----------------------------------------------- | ------- |
|
||||
| `elasticsearch.configureNode` | [DEPRECATED] Use initSysctl.enabled instead. | `false` |
|
||||
| `elasticsearch.bootstrapChecks` | Enables/disables Elasticsearch bootstrap checks | `true` |
|
||||
|
||||
### Service
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ---------------------------------- | -------------------------------------------------- | ----------- |
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.externalPort` | Kubernetes service port | `9000` |
|
||||
| `service.internalPort` | Kubernetes container port | `9000` |
|
||||
| `service.labels` | Kubernetes service labels | `None` |
|
||||
| `service.annotations` | Kubernetes service annotations | `None` |
|
||||
| `service.loadBalancerSourceRanges` | Kubernetes service LB Allowed inbound IP addresses | `None` |
|
||||
| `service.loadBalancerIP` | Kubernetes service LB Optional fixed external IP | `None` |
|
||||
|
||||
### Ingress
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------ | ------------------------------------------------------------ | ------------------------------------------------------------------------------ |
|
||||
| `nginx.enabled` | Also install Nginx Ingress Helm | `false` |
|
||||
| `ingress.enabled` | Flag to enable Ingress | `false` |
|
||||
| `ingress.labels` | Ingress additional labels | `{}` |
|
||||
| `ingress.hosts[0].name` | Hostname to your SonarQube installation | `sonarqube.your-org.com` |
|
||||
| `ingress.hosts[0].path` | Path within the URL structure | `/` |
|
||||
| `ingress.hosts[0].serviceName` | Optional field to override the default serviceName of a path | `None` |
|
||||
| `ingress.hosts[0].servicePort` | Optional field to override the default servicePort of a path | `None` |
|
||||
| `ingress.tls` | Ingress secrets for TLS certificates | `[]` |
|
||||
| `ingress.ingressClassName` | Optional field to configure ingress class name | `None` |
|
||||
| `ingress.annotations` | Field to add extra annotations to the ingress | {`nginx.ingress.kubernetes.io/proxy-body-size: "64m"`} if `nginx.enabled=true` |
|
||||
|
||||
### Route
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ----------------------- | ----------------------------------------------------------------------------- | ------- |
|
||||
| `route.enabled` | Flag to enable OpenShift Route | `false` |
|
||||
| `route.host` | Host of the route | `""` |
|
||||
| `route.tls.termination` | TLS termination type. Currently supported values are `edge` and `passthrough` | `edge` |
|
||||
| `route.annotations` | Optional field to add extra annotations to the route | `None` |
|
||||
| `route.labels` | Route additional labels | `{}` |
|
||||
|
||||
### Probes
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `readinessProbe.initialDelaySeconds` | ReadinessProbe initial delay for SonarQube checking | `60` |
|
||||
| `readinessProbe.periodSeconds` | ReadinessProbe period between checking SonarQube | `30` |
|
||||
| `readinessProbe.failureThreshold` | ReadinessProbe threshold for marking as failed | `6` |
|
||||
| `readinessProbe.timeoutSeconds` | ReadinessProbe timeout delay | `1` |
|
||||
| `readinessProbe.sonarWebContext` | (DEPRECATED) SonarQube web context for readinessProbe, please use sonarWebContext at the value top level instead | `/` |
|
||||
| `livenessProbe.initialDelaySeconds` | LivenessProbe initial delay for SonarQube checking | `60` |
|
||||
| `livenessProbe.periodSeconds` | LivenessProbe period between checking SonarQube | `30` |
|
||||
| `livenessProbe.sonarWebContext` | (DEPRECATED) SonarQube web context for LivenessProbe, please use sonarWebContext at the value top level instead | `/` |
|
||||
| `livenessProbe.failureThreshold` | LivenessProbe threshold for marking as dead | `6` |
|
||||
| `livenessProbe.timeoutSeconds` | LivenessProbe timeout delay | `1` |
|
||||
| `startupProbe.initialDelaySeconds` | StartupProbe initial delay for SonarQube checking | `30` |
|
||||
| `startupProbe.periodSeconds` | StartupProbe period between checking SonarQube | `10` |
|
||||
| `startupProbe.sonarWebContext` | (DEPRECATED) SonarQube web context for StartupProbe, please use sonarWebContext at the value top level instead | `/` |
|
||||
| `startupProbe.failureThreshold` | StartupProbe threshold for marking as failed | `24` |
|
||||
| `startupProbe.timeoutSeconds` | StartupProbe timeout delay | `1` |
|
||||
|
||||
### InitContainers
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ----------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------------- |
|
||||
| `initContainers.image` | Change init container image | `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |
|
||||
| `initContainers.securityContext` | SecurityContext for init containers | [Restricted podSecurityStandard](#kubernetes---pod-security-standards) |
|
||||
| `initContainers.resources` | Resources for init containers | `{}` |
|
||||
| `extraInitContainers` | Extra init containers to e.g. download required artifacts | `{}` |
|
||||
| `caCerts.enabled` | Flag for enabling additional CA certificates | `false` |
|
||||
| `caCerts.image` | Change init CA certificates container image | `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |
|
||||
| `caCerts.secret` | Name of the secret containing additional CA certificates | `None` |
|
||||
| `initSysctl.enabled` | Modify k8s worker to conform to system requirements | `true` |
|
||||
| `initSysctl.vmMaxMapCount` | Set init sysctl container vm.max_map_count | `524288` |
|
||||
| `initSysctl.fsFileMax` | Set init sysctl container fs.file-max | `131072` |
|
||||
| `initSysctl.nofile` | Set init sysctl container open file descriptors limit | `131072` |
|
||||
| `initSysctl.nproc` | Set init sysctl container open threads limit | `8192 ` |
|
||||
| `initSysctl.image` | Change init sysctl container image | `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |
|
||||
| `initSysctl.securityContext` | InitSysctl container security context | `{privileged: true}` |
|
||||
| `initSysctl.resources` | InitSysctl container resource requests & limits | `{}` |
|
||||
| `initFs.enabled` | Enable file permission change with init container | `true` |
|
||||
| `initFs.image` | InitFS container image | `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |
|
||||
| `initFs.securityContext.privileged` | InitFS container needs to run privileged | `true` |
|
||||
|
||||
### Monitoring (Prometheus Exporter)
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
|
||||
| `prometheusExporter.enabled` | Use the Prometheus JMX exporter | `false` |
|
||||
| `prometheusExporter.version` | jmx_prometheus_javaagent version to download from Maven Central | `0.17.2` |
|
||||
| `prometheusExporter.noCheckCertificate` | Flag to not check server's certificate when downloading jmx_prometheus_javaagent | `false` |
|
||||
| `prometheusExporter.webBeanPort` | Port where the jmx_prometheus_javaagent exposes the metrics for the webBean | `8000` |
|
||||
| `prometheusExporter.ceBeanPort` | Port where the jmx_prometheus_javaagent exposes the metrics for the ceBean | `8001` |
|
||||
| `prometheusExporter.downloadURL` | Alternative full download URL for the jmx_prometheus_javaagent.jar (overrides `prometheusExporter.version`) | `""` |
|
||||
| `prometheusExporter.config` | Prometheus JMX exporter config yaml for the web process, and the CE process if `prometheusExporter.ceConfig` is not set | see `values.yaml` |
|
||||
| `prometheusExporter.ceConfig` | Prometheus JMX exporter config yaml for the CE process (by default, `prometheusExporter.config` is used) | `None` |
|
||||
| `prometheusExporter.httpProxy` | HTTP proxy for downloading JMX agent | `""` |
|
||||
| `prometheusExporter.httpsProxy` | HTTPS proxy for downloading JMX agent | `""` |
|
||||
| `prometheusExporter.noProxy` | No proxy for downloading JMX agent | `""` |
|
||||
| `prometheusExporter.securityContext` | Security context for downloading the jmx agent | [Restricted podSecurityStandard](#kubernetes---pod-security-standards) |
|
||||
|
||||
### Monitoring (Prometheus PodMonitor)
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ----------------------------------------------- | --------------------------------------------------------------------- | --------- |
|
||||
| `prometheusMonitoring.podMonitor.enabled` | Enable Prometheus PodMonitor | `false` |
|
||||
| `prometheusMonitoring.podMonitor.namespace` | Specify a custom namespace where the PodMonitor will be created | `default` |
|
||||
| `prometheusMonitoring.podMonitor.interval` | Specify the interval how often metrics should be scraped | `30s` |
|
||||
| `prometheusMonitoring.podMonitor.scrapeTimeout` | Specify the timeout after a scrape is ended | `None` |
|
||||
| `prometheusMonitoring.podMonitor.jobLabel` | Name of the label on target services that prometheus uses as job name | `None` |
|
||||
|
||||
|
||||
### Plugins
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ---------------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
|
||||
| `plugins.install` | Link(s) to the plugin JARs to download and install | `[]` |
|
||||
| `plugins.resources` | Plugin Pod resource requests & limits | `{}` |
|
||||
| `plugins.httpProxy` | For use behind a corporate proxy when downloading plugins | `""` |
|
||||
| `plugins.httpsProxy` | For use behind a corporate proxy when downloading plugins | `""` |
|
||||
| `plugins.noProxy` | For use behind a corporate proxy when downloading plugins | `""` |
|
||||
| `plugins.image` | Image for plugins container | `""` |
|
||||
| `plugins.resources` | Resources for plugins container | `{}` |
|
||||
| `plugins.netrcCreds` | Name of the secret containing .netrc file to use creds when downloading plugins | `""` |
|
||||
| `plugins.noCheckCertificate` | Flag to not check server's certificate when downloading plugins | `false` |
|
||||
| `plugins.securityContext` | Security context for the container to download plugins | [Restricted podSecurityStandard](#kubernetes---pod-security-standards) |
|
||||
|
||||
### SonarQube Specific
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------- | ---------------- |
|
||||
| `jvmOpts` | (DEPRECATED) Values to add to `SONAR_WEB_JAVAOPTS`. Please set directly `SONAR_WEB_JAVAOPTS` or `sonar.web.javaOpts` | `""` |
|
||||
| `jvmCeOpts` | (DEPRECATED) Values to add to `SONAR_CE_JAVAOPTS`. Please set directly `SONAR_CE_JAVAOPTS` or `sonar.ce.javaOpts` | `""` |
|
||||
| `sonarqubeFolder` | Directory name of SonarQube | `/opt/sonarqube` |
|
||||
| `sonarProperties` | Custom `sonar.properties` key-value pairs (e.g., "sonarProperties.sonar.forceAuthentication=true") | `None` |
|
||||
| `sonarSecretProperties` | Additional `sonar.properties` key-value pairs to load from a secret | `None` |
|
||||
| `sonarSecretKey` | Name of existing secret used for settings encryption | `None` |
|
||||
| `monitoringPasscode` | Value for sonar.web.systemPasscode needed for LivenessProbes (encoded to Base64 format) | `define_it` |
|
||||
| `monitoringPasscodeSecretName` | Name of the secret where to load `monitoringPasscode` | `None` |
|
||||
| `monitoringPasscodeSecretKey` | Key of an existing secret containing `monitoringPasscode` | `None` |
|
||||
| `extraContainers` | Array of extra containers to run alongside the `sonarqube` container (aka. Sidecars) | `[]` |
|
||||
| `extraVolumes` | Array of extra volumes to add to the SonarQube deployment | `[]` |
|
||||
| `extraVolumeMounts` | Array of extra volume mounts to add to the SonarQube deployment | `[]` |
|
||||
|
||||
### Resources
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------------------- | ------------------------ | ------- |
|
||||
| `resources.requests.memory` | SonarQube memory request | `2Gi` |
|
||||
| `resources.requests.cpu` | SonarQube cpu request | `400m` |
|
||||
| `resources.limits.memory` | SonarQube memory limit | `4Gi` |
|
||||
| `resources.limits.cpu` | SonarQube cpu limit | `800m` |
|
||||
|
||||
### Persistence
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------------------- | ---------------------------------------------------------------------------- | --------------- |
|
||||
| `persistence.enabled` | Flag for enabling persistent storage | `false` |
|
||||
| `persistence.annotations` | Kubernetes pvc annotations | `{}` |
|
||||
| `persistence.existingClaim` | Do not create a new PVC but use this one | `None` |
|
||||
| `persistence.storageClass` | Storage class to be used | `""` |
|
||||
| `persistence.accessMode` | Volumes access mode to be set | `ReadWriteOnce` |
|
||||
| `persistence.size` | Size of the volume | `5Gi` |
|
||||
| `persistence.volumes` | Specify extra volumes. Refer to ".spec.volumes" specification | `[]` |
|
||||
| `persistence.mounts` | Specify extra mounts. Refer to ".spec.containers.volumeMounts" specification | `[]` |
|
||||
| `persistence.uid` | UID used for init-fs container | `1000` |
|
||||
| `persistence.guid` | GUID used for init-fs container | `0` |
|
||||
| `emptyDir` | Configuration of resources for `emptyDir` | `{}` |
|
||||
|
||||
### JDBC Overwrite
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------- |
|
||||
| `jdbcOverwrite.enable` | Enable JDBC overwrites for external Databases (disables `postgresql.enabled`) | `false` |
|
||||
| `jdbcOverwrite.jdbcUrl` | The JDBC url to connect the external DB | `jdbc:postgresql://myPostgress/myDatabase?socketTimeout=1500` |
|
||||
| `jdbcOverwrite.jdbcUsername` | The DB user that should be used for the JDBC connection | `sonarUser` |
|
||||
| `jdbcOverwrite.jdbcPassword` | The DB password that should be used for the JDBC connection (Use this if you don't mind the DB password getting stored in plain text within the values file) | `sonarPass` |
|
||||
| `jdbcOverwrite.jdbcSecretName` | Alternatively, use a pre-existing k8s secret containing the DB password | `None` |
|
||||
| `jdbcOverwrite.jdbcSecretPasswordKey` | If the pre-existing k8s secret is used this allows the user to overwrite the 'key' of the password property in the secret | `None` |
|
||||
|
||||
### Bundled PostgreSQL Chart (DEPRECATED)
|
||||
|
||||
The bundled PostgreSQL Chart is deprecated. Please see https://artifacthub.io/packages/helm/sonarqube/sonarqube#production-use-case for more information.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| -------------------------------------------------------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------------- |
|
||||
| `postgresql.enabled` | Set to `false` to use external server | `true` |
|
||||
| `postgresql.existingSecret` | existingSecret Name of existing secret to use for PostgreSQL passwords | `nil` |
|
||||
| `postgresql.postgresqlServer` | (DEPRECATED) Hostname of the external PostgreSQL server | `nil` |
|
||||
| `postgresql.postgresqlUsername` | PostgreSQL database user | `sonarUser` |
|
||||
| `postgresql.postgresqlPassword` | PostgreSQL database password | `sonarPass` |
|
||||
| `postgresql.postgresqlDatabase` | PostgreSQL database name | `sonarDB` |
|
||||
| `postgresql.service.port` | PostgreSQL port | `5432` |
|
||||
| `postgresql.resources.requests.memory` | PostgreSQL memory request | `256Mi` |
|
||||
| `postgresql.resources.requests.cpu` | PostgreSQL cpu request | `250m` |
|
||||
| `postgresql.resources.limits.memory` | PostgreSQL memory limit | `2Gi` |
|
||||
| `postgresql.resources.limits.cpu` | PostgreSQL cpu limit | `2` |
|
||||
| `postgresql.persistence.enabled` | PostgreSQL persistence en/disabled | `true` |
|
||||
| `postgresql.persistence.accessMode` | PostgreSQL persistence accessMode | `ReadWriteOnce` |
|
||||
| `postgresql.persistence.size` | PostgreSQL persistence size | `20Gi` |
|
||||
| `postgresql.persistence.storageClass` | PostgreSQL persistence storageClass | `""` |
|
||||
| `postgresql.securityContext.enabled` | PostgreSQL securityContext en/disabled | `true` |
|
||||
| `postgresql.securityContext` | PostgreSQL securityContext | [Restricted podSecurityStandard](#kubernetes---pod-security-standards) |
|
||||
| `postgresql.volumePermissions.enabled` | PostgreSQL vol permissions en/disabled | `false` |
|
||||
| `postgresql.volumePermissions.securityContext.runAsUser` | PostgreSQL vol permissions secContext runAsUser | `0` |
|
||||
| `postgresql.shmVolume.chmod.enabled` | PostgreSQL shared memory vol en/disabled | `false` |
|
||||
| `postgresql.serivceAccount.enabled` | PostgreSQL service Account creation en/disabled | `false` |
|
||||
| `postgresql.serivceAccount.name` | PostgreSQL service Account name | `""` |
|
||||
|
||||
### Tests
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------- | ------------------------------------------------------------- | ------- |
|
||||
| `tests.enabled` | Flag that allows tests to be excluded from the generated yaml | `true` |
|
||||
| `tests.image` | Change test container image | `` |
|
||||
|
||||
### ServiceAccount
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------- | ------------------------------------------------------------------------------------ | --------------------- |
|
||||
| `serviceAccount.create` | If set to true, create a serviceAccount | `false` |
|
||||
| `serviceAccount.name` | Name of the serviceAccount to create/use | `sonarqube-sonarqube` |
|
||||
| `serviceAccount.automountToken` | Manage `automountServiceAccountToken` field for mounting service account credentials | `false` |
|
||||
| `serviceAccount.annotations` | Additional serviceAccount annotations | `{}` |
|
||||
|
||||
### ExtraConfig
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `extraConfig.secrets` | A list of `Secret`s (which must contain key/value pairs) which may be loaded into the Scanner as environment variables | `[]` |
|
||||
| `extraConfig.configmaps` | A list of `ConfigMap`s (which must contain key/value pairs) which may be loaded into the Scanner as environment variables | `[]` |
|
||||
|
||||
### Advanced Options
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
|
||||
| `account.adminPassword` | Custom admin password | `admin` |
|
||||
| `account.currentAdminPassword` | Current admin password | `admin` |
|
||||
| `account.adminPasswordSecretName` | Secret containing `password` (custom password) and `currentPassword` (current password) keys for admin | `None` |
|
||||
| `account.resources.requests.memory` | Memory request for Admin hook | `128Mi` |
|
||||
| `account.resources.requests.cpu` | CPU request for Admin hook | `100m` |
|
||||
| `account.resources.limits.memory` | Memory limit for Admin hook | `128Mi` |
|
||||
| `account.resources.limits.cpu` | CPU limit for Admin hook | `100m` |
|
||||
| `account.sonarWebContext` | (DEPRECATED) SonarQube web context for Admin hook. please use sonarWebContext at the value top level instead | `nil` |
|
||||
| `account.securityContext` | SecurityContext for change-password-hook | [Restricted podSecurityStandard](#kubernetes---pod-security-standards) |
|
||||
| `curlContainerImage` | Curl container image | `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |
|
||||
| `adminJobAnnotations` | Custom annotations for admin hook Job | `{}` |
|
||||
| `terminationGracePeriodSeconds` | Configuration of `terminationGracePeriodSeconds` | `60` |
|
||||
|
||||
You can also configure values for the PostgreSQL database via the PostgreSQL [Chart](https://hub.helm.sh/charts/bitnami/postgresql)
|
||||
|
||||
For overriding variables see: [Customizing the chart](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing)
|
||||
|
||||
### Use custom `cacerts`
|
||||
|
||||
In environments with air-gapped setup, especially with internal tooling (repos) and self-signed certificates it is required to provide an adequate `cacerts` which overrides the default one:
|
||||
|
||||
1. Create a yaml file `cacerts.yaml` with a secret that contains one or more keys to represent the certificates that you want including
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: my-cacerts
|
||||
stringData:
|
||||
cert-1.crt: |
|
||||
xxxxxxxxxxxxxxxxxxxxxxx
|
||||
```
|
||||
|
||||
2. Upload your `cacerts.yaml` to a secret in the cluster you are installing SonarQube to.
|
||||
|
||||
```shell
|
||||
kubectl apply -f cacerts.yaml
|
||||
```
|
||||
|
||||
3. Set the following values of the chart:
|
||||
|
||||
```yaml
|
||||
caCerts:
|
||||
enabled: true
|
||||
secret: my-cacerts
|
||||
```
|
||||
|
||||
### Elasticsearch Settings
|
||||
|
||||
Since SonarQube comes bundled with an Elasticsearch instance, some [bootstrap checks](https://www.elastic.co/guide/en/elasticsearch/reference/master/bootstrap-checks.html) of the host settings are done at start.
|
||||
|
||||
This chart offers the option to use an initContainer in privilaged mode to automatically set certain kernel settings on the kube worker. While this can ensure proper functionality of Elasticsearch, modifying the underlying kernel settings on the Kubernetes node can impact other users. It may be best to work with your cluster administrator to either provide specific nodes with the proper kernel settings, or ensure they are set cluster wide.
|
||||
|
||||
To enable auto-configuration of the kube worker node, set `elasticsearch.configureNode` to `true`. This is the default behavior, so you do not need to explicitly set this.
|
||||
|
||||
This will run `sysctl -w vm.max_map_count=262144` on the worker where the sonarqube pod(s) get scheduled. This needs to be set to `262144` but normally defaults to `65530`. Other kernel settings are recommended by the [docker image](https://hub.docker.com/_/sonarqube/#requirements), but the defaults work fine in most cases.
|
||||
|
||||
To disable worker node configuration, set `elasticsearch.configureNode` to `false`. Note that if node configuration is not enabled, then you will likely need to also disable the Elasticsearch bootstrap checks. These can be explicitly disabled by setting `elasticsearch.bootstrapChecks` to `false`.
|
||||
|
||||
### Extra Config
|
||||
|
||||
For environments where another tool, such as terraform or ansible, is used to provision infrastructure or passwords then setting databases addresses and credentials via helm becomes less than ideal. Ditto for environments where this config may be visible.
|
||||
|
||||
In such environments, configuration may be read, via environment variables, from Secrets and ConfigMaps.
|
||||
|
||||
1. Create a `ConfigMap` (or `Secret`) containing key/value pairs, as expected by SonarQube.
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: external-sonarqube-opts
|
||||
data:
|
||||
SONARQUBE_JDBC_USERNAME: foo
|
||||
SONARQUBE_JDBC_URL: jdbc:postgresql://db.example.com:5432/sonar
|
||||
```
|
||||
|
||||
2. Set the following in your `values.yaml` (using the key `extraConfig.secrets` to reference `Secret`s)
|
||||
|
||||
```yaml
|
||||
extraConfig:
|
||||
configmaps:
|
||||
- external-sonarqube-opts
|
||||
```
|
||||
@@ -0,0 +1,5 @@
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: pullsecret
|
||||
repository: "sonarsource/sonarqube"
|
||||
tag: "10.4.0-community"
|
||||
@@ -0,0 +1,33 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
http://{{ .name }}
|
||||
{{- end }}
|
||||
{{- else if .Values.route.enabled }}
|
||||
export ROUTE_HOST=$(kubectl get route {{ template "sonarqube.name" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.host}")
|
||||
echo https://$ROUTE_HOST
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "sonarqube.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get svc -w {{ template "sonarqube.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "sonarqube.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
|
||||
echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "sonarqube.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl port-forward $POD_NAME 8080:{{ .Values.service.externalPort }} -n {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
WARNING:
|
||||
Please note that the SonarQube image runs with a non-root user (uid=1000) belonging to the root group (guid=0). In this way, the chart can support arbitrary user ids as recommended in OpenShift.
|
||||
Please visit https://docs.openshift.com/container-platform/4.14/openshift_images/create-images.html#use-uid_create-images for more information.
|
||||
{{ if .Values.postgresql.enabled }}
|
||||
WARNING: The embedded PostgreSQL is intended for evaluation only, it is DEPRECATED, and it will be REMOVED in a future release.
|
||||
Please visit https://artifacthub.io/packages/helm/sonarqube/sonarqube#production-use-case for more information.
|
||||
{{- end }}
|
||||
{{ if .Values.nginx.enabled }}
|
||||
WARNING: The ingress nginx controller dependency has been upgraded to a major version (4.x), please carefully read the changelogs at https://github.com/kubernetes/ingress-nginx/releases and refer to the documentation at https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/.
|
||||
Please also visit https://artifacthub.io/packages/helm/sonarqube/sonarqube#production-use-case for more information.
|
||||
{{- end }}
|
||||
@@ -0,0 +1,206 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "sonarqube.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "sonarqube.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name (include "sonarqube.name" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Expand the Application Image name.
|
||||
*/}}
|
||||
{{- define "sonarqube.image" -}}
|
||||
{{- printf "%s:%s" .Values.image.repository (tpl .Values.image.tag .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified mysql/postgresql name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "postgresql.fullname" -}}
|
||||
{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the hostname to use for PostgreSQL/mySQL.
|
||||
*/}}
|
||||
{{- define "postgresql.hostname" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" .Values.postgresql.postgresqlServer -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the k8s secret containing the JDBC credentials
|
||||
*/}}
|
||||
{{- define "jdbc.secret" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- if .Values.postgresql.existingSecret -}}
|
||||
{{- .Values.postgresql.existingSecret -}}
|
||||
{{- else -}}
|
||||
{{- template "postgresql.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.jdbcOverwrite.enable -}}
|
||||
{{- if .Values.jdbcOverwrite.jdbcSecretName -}}
|
||||
{{- .Values.jdbcOverwrite.jdbcSecretName -}}
|
||||
{{- else -}}
|
||||
{{- template "sonarqube.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- template "sonarqube.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine JDBC username
|
||||
*/}}
|
||||
{{- define "jdbc.username" -}}
|
||||
{{- if and .Values.postgresql.enabled .Values.postgresql.postgresqlUsername -}}
|
||||
{{- .Values.postgresql.postgresqlUsername | quote -}}
|
||||
{{- else if and .Values.jdbcOverwrite.enable .Values.jdbcOverwrite.jdbcUsername -}}
|
||||
{{- .Values.jdbcOverwrite.jdbcUsername | quote -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.postgresqlUsername -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the k8s secretKey contrining the JDBC password
|
||||
*/}}
|
||||
{{- define "jdbc.secretPasswordKey" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- if and .Values.postgresql.existingSecret .Values.postgresql.existingSecretPasswordKey -}}
|
||||
{{- .Values.postgresql.existingSecretPasswordKey -}}
|
||||
{{- else -}}
|
||||
{{- "postgresql-password" -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.jdbcOverwrite.enable -}}
|
||||
{{- if and .Values.jdbcOverwrite.jdbcSecretName .Values.jdbcOverwrite.jdbcSecretPasswordKey -}}
|
||||
{{- .Values.jdbcOverwrite.jdbcSecretPasswordKey -}}
|
||||
{{- else -}}
|
||||
{{- "jdbc-password" -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- "jdbc-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine JDBC password if internal secret is used
|
||||
*/}}
|
||||
{{- define "jdbc.internalSecretPasswd" -}}
|
||||
{{- if .Values.jdbcOverwrite.enable -}}
|
||||
{{- .Values.jdbcOverwrite.jdbcPassword | b64enc | quote -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.postgresqlPassword | b64enc | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set sonarqube.jvmOpts
|
||||
*/}}
|
||||
{{- define "sonarqube.jvmOpts" -}}
|
||||
{{- $tempJvm := .Values.jvmOpts -}}
|
||||
{{- if and .Values.sonarProperties (hasKey (.Values.sonarProperties) "sonar.web.javaOpts")}}
|
||||
{{- $tempJvm = (get .Values.sonarProperties "sonar.web.javaOpts") -}}
|
||||
{{- else if .Values.env -}}
|
||||
{{- range $index, $val := .Values.env -}}
|
||||
{{- if eq $val.name "SONAR_WEB_JAVAOPTS" -}}
|
||||
{{- $tempJvm = $val.value -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if and .Values.caCerts.enabled .Values.prometheusExporter.enabled -}}
|
||||
{{ printf "-javaagent:%s/data/jmx_prometheus_javaagent.jar=%d:%s/conf/prometheus-config.yaml -Djavax.net.ssl.trustStore=%s/certs/cacerts %s" .Values.sonarqubeFolder (int .Values.prometheusExporter.webBeanPort) .Values.sonarqubeFolder .Values.sonarqubeFolder $tempJvm | trim | quote }}
|
||||
{{- else if .Values.caCerts.enabled -}}
|
||||
{{ printf "-Djavax.net.ssl.trustStore=%s/certs/cacerts %s" .Values.sonarqubeFolder $tempJvm | trim | quote }}
|
||||
{{- else if .Values.prometheusExporter.enabled -}}
|
||||
{{ printf "-javaagent:%s/data/jmx_prometheus_javaagent.jar=%d:%s/conf/prometheus-config.yaml %s" .Values.sonarqubeFolder (int .Values.prometheusExporter.webBeanPort) .Values.sonarqubeFolder $tempJvm | trim | quote }}
|
||||
{{- else -}}
|
||||
{{ printf "%s" $tempJvm }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set sonarqube.jvmCEOpts
|
||||
*/}}
|
||||
{{- define "sonarqube.jvmCEOpts" -}}
|
||||
{{- $tempJvm := .Values.jvmCeOpts -}}
|
||||
{{- if and .Values.sonarProperties (hasKey (.Values.sonarProperties) "sonar.ce.javaOpts")}}
|
||||
{{- $tempJvm = (get .Values.sonarProperties "sonar.ce.javaOpts") -}}
|
||||
{{- else if .Values.env -}}
|
||||
{{- range $index, $val := .Values.env -}}
|
||||
{{- if eq $val.name "SONAR_CE_JAVAOPTS" -}}
|
||||
{{- $tempJvm = $val.value -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if and .Values.caCerts.enabled .Values.prometheusExporter.enabled -}}
|
||||
{{ printf "-javaagent:%s/data/jmx_prometheus_javaagent.jar=%d:%s/conf/prometheus-ce-config.yaml -Djavax.net.ssl.trustStore=%s/certs/cacerts %s" .Values.sonarqubeFolder (int .Values.prometheusExporter.ceBeanPort) .Values.sonarqubeFolder .Values.sonarqubeFolder $tempJvm | trim | quote }}
|
||||
{{- else if .Values.caCerts.enabled -}}
|
||||
{{ printf "-Djavax.net.ssl.trustStore=%s/certs/cacerts %s" .Values.sonarqubeFolder $tempJvm | trim | quote }}
|
||||
{{- else if .Values.prometheusExporter.enabled -}}
|
||||
{{ printf "-javaagent:%s/data/jmx_prometheus_javaagent.jar=%d:%s/conf/prometheus-ce-config.yaml %s" .Values.sonarqubeFolder (int .Values.prometheusExporter.ceBeanPort) .Values.sonarqubeFolder $tempJvm | trim | quote }}
|
||||
{{- else -}}
|
||||
{{ printf "%s" $tempJvm }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set prometheusExporter.downloadURL
|
||||
*/}}
|
||||
{{- define "prometheusExporter.downloadURL" -}}
|
||||
{{- if .Values.prometheusExporter.downloadURL -}}
|
||||
{{ printf "%s" .Values.prometheusExporter.downloadURL }}
|
||||
{{- else -}}
|
||||
{{ printf "https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/%s/jmx_prometheus_javaagent-%s.jar" .Values.prometheusExporter.version .Values.prometheusExporter.version }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "sonarqube.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "sonarqube.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set sonarqube.webcontext, ensuring it starts and ends with a slash, in order to ease probes url template
|
||||
*/}}
|
||||
{{- define "sonarqube.webcontext" -}}
|
||||
{{- $tempWebcontext := .Values.sonarWebContext -}}
|
||||
{{- if and .Values.sonarProperties (hasKey (.Values.sonarProperties) "sonar.web.context") -}}
|
||||
{{- $tempWebcontext = (get .Values.sonarProperties "sonar.web.context") -}}
|
||||
{{- end -}}
|
||||
{{- range $index, $val := .Values.env -}}
|
||||
{{- if eq $val.name "SONAR_WEB_CONTEXT" -}}
|
||||
{{- $tempWebcontext = $val.value -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasPrefix "/" $tempWebcontext) -}}
|
||||
{{- $tempWebcontext = print "/" $tempWebcontext -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasSuffix "/" $tempWebcontext) -}}
|
||||
{{- $tempWebcontext = print $tempWebcontext "/" -}}
|
||||
{{- end -}}
|
||||
{{ printf "%s" $tempWebcontext }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,82 @@
|
||||
{{- if .Values.account }}
|
||||
{{- if or .Values.account.adminPassword .Values.account.adminPasswordSecretName}}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-change-admin-password-hook
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
|
||||
{{- range $key, $value := .Values.service.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
"helm.sh/hook": post-install, post-upgrade
|
||||
"helm.sh/hook-delete-policy": hook-succeeded
|
||||
{{- range $key, $value := .Values.adminJobAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-change-admin-password-hook
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- range $key, $value := .Values.service.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
{{- if or .Values.image.pullSecrets .Values.image.pullSecret }}
|
||||
imagePullSecrets:
|
||||
{{- if .Values.image.pullSecret }}
|
||||
- name: {{ .Values.image.pullSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.image.pullSecrets }}
|
||||
{{ toYaml .Values.image.pullSecrets | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "sonarqube.serviceAccountName" . }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ template "sonarqube.fullname" . }}-change-default-admin-password
|
||||
image: {{ default "curlimages/curl:8.2.1" .Values.curlContainerImage }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.account.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
command: ["sh", "-c", 'until curl -v --connect-timeout 100 {{ template "sonarqube.fullname" . }}:{{ default 9000 .Values.service.internalPort }}{{ .Values.account.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/status | grep -w UP; do sleep 10; done; curl -v --connect-timeout 100 -u admin:$CURRENT_ADMIN_PASSWORD -X POST "{{ template "sonarqube.fullname" . }}:{{ default 9000 .Values.service.internalPort }}{{ .Values.account.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/users/change_password?login=admin&previousPassword=$CURRENT_ADMIN_PASSWORD&password=$ADMIN_PASSWORD"']
|
||||
env:
|
||||
- name: ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.account.adminPassword }}
|
||||
name: {{ template "sonarqube.fullname" . }}-admin-password
|
||||
{{- else }}
|
||||
name: {{ .Values.account.adminPasswordSecretName }}
|
||||
{{- end }}
|
||||
key: password
|
||||
- name: CURRENT_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.account.adminPassword }}
|
||||
name: {{ template "sonarqube.fullname" . }}-admin-password
|
||||
{{- else }}
|
||||
name: {{ .Values.account.adminPasswordSecretName }}
|
||||
{{- end }}
|
||||
key: currentPassword
|
||||
resources:
|
||||
{{ toYaml (default .Values.resources .Values.account.resources) | indent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-config
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
sonar.properties: |
|
||||
{{- range $key, $val := .Values.sonarProperties }}
|
||||
{{ $key }}={{ $val }}
|
||||
{{- end }}
|
||||
{{- if not .Values.elasticsearch.bootstrapChecks }}
|
||||
sonar.es.bootstrap.checks.disable=true
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretKey }}
|
||||
sonar.secretKeyPath={{ .Values.sonarqubeFolder }}/secret/sonar-secret.txt
|
||||
{{- end }}
|
||||
@@ -0,0 +1,490 @@
|
||||
{{- if eq .Values.deploymentType "Deployment"}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
app.kubernetes.io/name: {{ template "sonarqube.name" . }}-{{ template "sonarqube.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: sonarqube
|
||||
app.kubernetes.io/component: {{ template "sonarqube.fullname" . }}
|
||||
app.kubernetes.io/version: {{ tpl .Values.image.tag . | quote }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- if .Values.deploymentStrategy }}
|
||||
strategy:
|
||||
{{ toYaml .Values.deploymentStrategy | indent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/init-sysctl: {{ include (print $.Template.BasePath "/init-sysctl.yaml") . | sha256sum }}
|
||||
checksum/plugins: {{ include (print $.Template.BasePath "/install-plugins.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
checksum/prometheus-config: {{ include (print $.Template.BasePath "/prometheus-config.yaml") . | sha256sum }}
|
||||
checksum/prometheus-ce-config: {{ include (print $.Template.BasePath "/prometheus-ce-config.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.annotations}}
|
||||
{{- range $key, $value := .Values.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | indent 8 }}
|
||||
{{- if or .Values.image.pullSecrets .Values.image.pullSecret }}
|
||||
imagePullSecrets:
|
||||
{{- if .Values.image.pullSecret }}
|
||||
- name: {{ .Values.image.pullSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.image.pullSecrets}}
|
||||
{{ toYaml .Values.image.pullSecrets | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.extraInitContainers }}
|
||||
{{ toYaml .Values.extraInitContainers | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
- name: "wait-for-db"
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initContainers.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := .Values.initContainers.securityContext }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.initContainers.resources | indent 12 }}
|
||||
command: ["/bin/bash", "-c"]
|
||||
args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/{{.Release.Name}}-postgresql/5432) && exit 0; sleep 2;done; exit 1']
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- name: ca-certs
|
||||
image: {{ default (include "sonarqube.image" $) .Values.caCerts.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["sh"]
|
||||
args: ["-c", "cp -f \"${JAVA_HOME}/lib/security/cacerts\" /tmp/certs/cacerts; if [ \"$(ls /tmp/secrets/ca-certs)\" ]; then for f in /tmp/secrets/ca-certs/*; do keytool -importcert -file \"${f}\" -alias \"$(basename \"${f}\")\" -keystore /tmp/certs/cacerts -storepass changeit -trustcacerts -noprompt; done; fi;"]
|
||||
{{- if $securityContext := .Values.initContainers.securityContext }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.initContainers.resources | indent 12 }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/certs
|
||||
name: sonarqube
|
||||
subPath: certs
|
||||
- mountPath: /tmp/secrets/ca-certs
|
||||
name: ca-certs
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.initSysctl.enabled .Values.elasticsearch.configureNode }}
|
||||
- name: init-sysctl
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initSysctl.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.initSysctl.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.initSysctl.resources) | indent 12 }}
|
||||
command: ["/bin/bash",
|
||||
"-e",
|
||||
"/tmp/scripts/init_sysctl.sh"]
|
||||
volumeMounts:
|
||||
- name: init-sysctl
|
||||
mountPath: /tmp/scripts/
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretProperties .Values.sonarSecretKey (not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- name: concat-properties
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initContainers.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/bin/sh
|
||||
if [ -f /tmp/props/sonar.properties ]; then
|
||||
cat /tmp/props/sonar.properties > /tmp/result/sonar.properties
|
||||
fi
|
||||
if [ -f /tmp/props/secret.properties ]; then
|
||||
cat /tmp/props/secret.properties > /tmp/result/sonar.properties
|
||||
fi
|
||||
if [ -f /tmp/props/sonar.properties -a -f /tmp/props/secret.properties ]; then
|
||||
awk 1 /tmp/props/sonar.properties /tmp/props/secret.properties > /tmp/result/sonar.properties
|
||||
fi
|
||||
volumeMounts:
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretKey (not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- mountPath: /tmp/props/sonar.properties
|
||||
name: config
|
||||
subPath: sonar.properties
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretProperties }}
|
||||
- mountPath: /tmp/props/secret.properties
|
||||
name: secret-config
|
||||
subPath: secret.properties
|
||||
{{- end }}
|
||||
- mountPath: /tmp/result
|
||||
name: concat-dir
|
||||
{{- if $securityContext := .Values.initContainers.securityContext }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.initContainers.resources | indent 12 }}
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- name: inject-prometheus-exporter
|
||||
image: {{ default (include "sonarqube.image" $) .Values.prometheusExporter.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.prometheusExporter.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.prometheusExporter.resources) | indent 12 }}
|
||||
command: ["/bin/sh","-c"]
|
||||
args: ["curl -s '{{ template "prometheusExporter.downloadURL" . }}' {{ if $.Values.prometheusExporter.noCheckCertificate }}--insecure{{ end }} --output /data/jmx_prometheus_javaagent.jar -v"]
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: sonarqube
|
||||
subPath: data
|
||||
env:
|
||||
- name: http_proxy
|
||||
value: {{ default "" .Values.prometheusExporter.httpProxy }}
|
||||
- name: https_proxy
|
||||
value: {{ default "" .Values.prometheusExporter.httpsProxy }}
|
||||
- name: no_proxy
|
||||
value: {{ default "" .Values.prometheusExporter.noProxy }}
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.plugins.install }}
|
||||
- name: install-plugins
|
||||
image: {{ default (include "sonarqube.image" $) .Values.plugins.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["sh",
|
||||
"-e",
|
||||
"/tmp/scripts/install_plugins.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions/plugins
|
||||
name: sonarqube
|
||||
subPath: extensions/plugins
|
||||
- name: install-plugins
|
||||
mountPath: /tmp/scripts/
|
||||
{{- if .Values.plugins.netrcCreds }}
|
||||
- name: plugins-netrc-file
|
||||
mountPath: /root
|
||||
{{- end }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.plugins.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.plugins.resource) | indent 12 }}
|
||||
env:
|
||||
- name: http_proxy
|
||||
value: {{ default "" .Values.plugins.httpProxy }}
|
||||
- name: https_proxy
|
||||
value: {{ default "" .Values.plugins.httpsProxy }}
|
||||
- name: no_proxy
|
||||
value: {{ default "" .Values.plugins.noProxy }}
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.extraContainers }}
|
||||
{{- toYaml .Values.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ include "sonarqube.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.internalPort }}
|
||||
protocol: TCP
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- name: monitoring-web
|
||||
containerPort: {{ .Values.prometheusExporter.webBeanPort }}
|
||||
protocol: TCP
|
||||
- name: monitoring-ce
|
||||
containerPort: {{ .Values.prometheusExporter.ceBeanPort }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.resources .Values.resource) | indent 12 }}
|
||||
env:
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: SONAR_HELM_CHART_VERSION
|
||||
value: {{ .Chart.Version | replace "+" "_" }}
|
||||
- name: SONAR_WEB_JAVAOPTS
|
||||
value: {{ template "sonarqube.jvmOpts" . }}
|
||||
- name: SONAR_CE_JAVAOPTS
|
||||
value: {{ template "sonarqube.jvmCEOpts" . }}
|
||||
- name: SONAR_WEB_CONTEXT
|
||||
value: {{ include "sonarqube.webcontext" . }}
|
||||
- name: SONAR_JDBC_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "jdbc.secret" . }}
|
||||
key: {{ template "jdbc.secretPasswordKey" . }}
|
||||
- name: SONAR_WEB_SYSTEMPASSCODE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if and .Values.monitoringPasscodeSecretName .Values.monitoringPasscodeSecretKey }}
|
||||
name: {{ .Values.monitoringPasscodeSecretName }}
|
||||
key: {{ .Values.monitoringPasscodeSecretKey }}
|
||||
{{- else }}
|
||||
name: {{ template "sonarqube.fullname" . }}-monitoring-passcode
|
||||
key: SONAR_WEB_SYSTEMPASSCODE
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ template "sonarqube.fullname" . }}-jdbc-config
|
||||
{{- range .Values.extraConfig.secrets }}
|
||||
- secretRef:
|
||||
name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.extraConfig.configmaps }}
|
||||
- configMapRef:
|
||||
name: {{ . }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
host="$(hostname -i || echo '127.0.0.1')"
|
||||
wget --no-proxy --quiet -O /dev/null --timeout={{ .Values.livenessProbe.timeoutSeconds }} --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://${host}:{{ .Values.service.internalPort }}{{ .Values.livenessProbe.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/liveness"
|
||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/bin/bash
|
||||
# A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
|
||||
# status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
|
||||
host="$(hostname -i || echo '127.0.0.1')"
|
||||
if wget --no-proxy -qO- http://${host}:{{ .Values.service.internalPort }}{{ .Values.readinessProbe.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
|
||||
exit 0
|
||||
fi
|
||||
exit 1
|
||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
scheme: HTTP
|
||||
path: {{ .Values.startupProbe.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/status
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
|
||||
{{- if .Values.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.persistence.mounts }}
|
||||
{{ toYaml .Values.persistence.mounts | indent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- .Values.extraVolumeMounts | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretProperties .Values.sonarSecretKey (not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/conf/
|
||||
name: concat-dir
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretKey }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/secret/
|
||||
name: secret
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/certs
|
||||
name: sonarqube
|
||||
subPath: certs
|
||||
{{- end }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/data
|
||||
name: sonarqube
|
||||
subPath: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions
|
||||
name: sonarqube
|
||||
subPath: extensions
|
||||
{{- else if .Values.plugins.install }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions/plugins
|
||||
name: sonarqube
|
||||
subPath: extensions/plugins
|
||||
{{- end }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/temp
|
||||
name: sonarqube
|
||||
subPath: temp
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/logs
|
||||
name: sonarqube
|
||||
subPath: logs
|
||||
- mountPath: /tmp
|
||||
name: tmp-dir
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/conf/prometheus-config.yaml
|
||||
subPath: prometheus-config.yaml
|
||||
name: prometheus-config
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/conf/prometheus-ce-config.yaml
|
||||
subPath: prometheus-ce-config.yaml
|
||||
name: prometheus-ce-config
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases:
|
||||
{{ toYaml .Values.hostAliases | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "sonarqube.serviceAccountName" . }}
|
||||
volumes:
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- .Values.extraVolumes | toYaml | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.volumes }}
|
||||
{{ tpl (toYaml .Values.persistence.volumes | indent 6) . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretKey ( not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-config
|
||||
items:
|
||||
- key: sonar.properties
|
||||
path: sonar.properties
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretProperties }}
|
||||
- name: secret-config
|
||||
secret:
|
||||
secretName: {{ .Values.sonarSecretProperties }}
|
||||
items:
|
||||
- key: secret.properties
|
||||
path: secret.properties
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretKey }}
|
||||
- name: secret
|
||||
secret:
|
||||
secretName: {{ .Values.sonarSecretKey }}
|
||||
items:
|
||||
- key: sonar-secret.txt
|
||||
path: sonar-secret.txt
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- name: ca-certs
|
||||
secret:
|
||||
secretName: {{ .Values.caCerts.secret }}
|
||||
{{- end }}
|
||||
{{- if .Values.plugins.netrcCreds }}
|
||||
- name: plugins-netrc-file
|
||||
secret:
|
||||
secretName: {{ .Values.plugins.netrcCreds }}
|
||||
items:
|
||||
- key: netrc
|
||||
path: .netrc
|
||||
{{- end }}
|
||||
- name: init-sysctl
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-init-sysctl
|
||||
items:
|
||||
- key: init_sysctl.sh
|
||||
path: init_sysctl.sh
|
||||
- name: install-plugins
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-install-plugins
|
||||
items:
|
||||
- key: install_plugins.sh
|
||||
path: install_plugins.sh
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- name: prometheus-config
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-prometheus-config
|
||||
items:
|
||||
- key: prometheus-config.yaml
|
||||
path: prometheus-config.yaml
|
||||
- name: prometheus-ce-config
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-prometheus-ce-config
|
||||
items:
|
||||
- key: prometheus-ce-config.yaml
|
||||
path: prometheus-ce-config.yaml
|
||||
{{- end }}
|
||||
- name: sonarqube
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "sonarqube.fullname" . }}{{- end }}
|
||||
{{- else }}
|
||||
emptyDir: {{- toYaml .Values.emptyDir | nindent 10 }}
|
||||
{{- end }}
|
||||
- name : tmp-dir
|
||||
emptyDir: {{- toYaml .Values.emptyDir | nindent 10 }}
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretProperties .Values.sonarSecretKey ( not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- name : concat-dir
|
||||
emptyDir: {{- toYaml .Values.emptyDir | nindent 10 -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $serviceName := include "sonarqube.fullname" . -}}
|
||||
{{- $servicePort := .Values.service.externalPort -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.ingress.labels }}
|
||||
{{ .Values.ingress.labels | toYaml | trimSuffix "\n"| indent 4 -}}
|
||||
{{- end}}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.ingress.annotations .Values.nginx.enabled}}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if and .Values.nginx.enabled (not (hasKey (.Values.ingress.annotations) "nginx.ingress.kubernetes.io/proxy-body-size")) }}
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "64m"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.ingressClassName }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ printf "%s" .name }}
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: {{ default $serviceName .serviceName }}
|
||||
port:
|
||||
number: {{ default $servicePort .servicePort }}
|
||||
path: {{ .path | default (include "sonarqube.webcontext" $) }}
|
||||
pathType: {{ default "ImplementationSpecific" .pathType }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{ toYaml .Values.ingress.tls | indent 4 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-init-fs
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
init_fs.sh: |-
|
||||
{{- if .Values.persistence.enabled }}
|
||||
chown -R {{ .Values.persistence.uid }}:{{ .Values.persistence.guid }} {{ .Values.sonarqubeFolder }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,37 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-init-sysctl
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
init_sysctl.sh: |-
|
||||
{{- if .Values.initSysctl.vmMaxMapCount }}
|
||||
if [[ "$(sysctl -n vm.max_map_count)" -lt {{ .Values.initSysctl.vmMaxMapCount }} ]]; then
|
||||
sysctl -w vm.max_map_count={{ .Values.initSysctl.vmMaxMapCount }}
|
||||
fi
|
||||
{{- end }}
|
||||
{{- if .Values.initSysctl.fsFileMax }}
|
||||
if [[ "$(sysctl -n fs.file-max)" -lt {{ .Values.initSysctl.fsFileMax }} ]]; then
|
||||
sysctl -w fs.file-max={{ .Values.initSysctl.fsFileMax }}
|
||||
fi
|
||||
{{- end }}
|
||||
{{- if .Values.initSysctl.nofile }}
|
||||
if [[ "$(ulimit -n)" != "unlimited" ]]; then
|
||||
if [[ "$(ulimit -n)" -lt {{ .Values.initSysctl.nofile }} ]]; then
|
||||
echo "ulimit -n {{ .Values.initSysctl.nofile }}"
|
||||
ulimit -n {{ .Values.initSysctl.nofile }}
|
||||
fi
|
||||
fi
|
||||
{{- end }}
|
||||
{{- if .Values.initSysctl.nproc }}
|
||||
if [[ "$(ulimit -u)" != "unlimited" ]]; then
|
||||
if [[ "$(ulimit -u)" -lt {{ .Values.initSysctl.nproc }} ]]; then
|
||||
echo "ulimit -u {{ .Values.initSysctl.nproc }}"
|
||||
ulimit -u {{ .Values.initSysctl.nproc }}
|
||||
fi
|
||||
fi
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-install-plugins
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
install_plugins.sh: |-
|
||||
{{- if .Values.plugins.install }}
|
||||
# rm -f {{ .Values.sonarqubeFolder }}/extensions/plugins/*
|
||||
cd {{ .Values.sonarqubeFolder }}/extensions/plugins
|
||||
{{- range $index, $val := .Values.plugins.install }}
|
||||
curl {{ if $.Values.plugins.noCheckCertificate }}--insecure{{ end }} {{ if $.Values.plugins.netrcCreds }}--netrc-file /root/.netrc{{ end }} -fsSLO {{ $val | quote }}
|
||||
if [ $(find . -type f | grep -c zip) == 1 ]
|
||||
then
|
||||
ls -al
|
||||
unzip *.zip
|
||||
files_to_remove=$(find . -mindepth 1 -type f ! -name "*.jar" -o -type d)
|
||||
rm -rf $files_to_remove
|
||||
ls -al
|
||||
# elif [ $(find . -type f | grep -c sh) == 1 ]
|
||||
# then
|
||||
# ls -al
|
||||
# chmod +x *.sh
|
||||
# sh *.sh
|
||||
# rm -rf *.sh
|
||||
# ls -al
|
||||
fi
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-jdbc-config
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
SONAR_JDBC_USERNAME: {{ template "jdbc.username" . }}
|
||||
{{- if .Values.jdbcOverwrite.enable }}
|
||||
SONAR_JDBC_URL: {{ .Values.jdbcOverwrite.jdbcUrl | trim | quote }}
|
||||
{{- else if and .Values.postgresql.service.port .Values.postgresql.postgresqlDatabase }}
|
||||
SONAR_JDBC_URL: "jdbc:postgresql://{{ template "postgresql.hostname" . }}:{{- .Values.postgresql.service.port -}}/{{- .Values.postgresql.postgresqlDatabase -}}"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,114 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-network-policy
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
ports:
|
||||
- port: {{ .Values.service.internalPort }}
|
||||
{{ if .Values.prometheusExporter.enabled }}
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
networking/namespace: {{ .Values.networkPolicy.prometheusNamespace }}
|
||||
ports:
|
||||
- port: {{ .Values.prometheusExporter.ceBeanPort }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.prometheusExporter.webBeanPort }}
|
||||
protocol: TCP
|
||||
{{ end }}
|
||||
egress:
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
networking/namespace: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: postgresql
|
||||
ports:
|
||||
- port: 5432
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
{{- end -}}
|
||||
|
||||
{{ if and .Values.postgresql.enabled .Values.networkPolicy.enabled }}
|
||||
---
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-database
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: postgresql
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
ports:
|
||||
- port: 5432
|
||||
egress:
|
||||
- to:
|
||||
- namespaceSelector: {}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.networkPolicy.enabled .Values.networkPolicy.additionalNetworkPolicys }}
|
||||
---
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-additional-network-policy
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
{{- with .Values.networkPolicy.additionalNetworkPolicys -}}
|
||||
{{ toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-prometheus-ce-config
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
prometheus-ce-config.yaml: |-
|
||||
{{ .Values.prometheusExporter.ceConfig | default .Values.prometheusExporter.config | toYaml | indent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-prometheus-config
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
prometheus-config.yaml: |-
|
||||
{{ toYaml .Values.prometheusExporter.config | indent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,37 @@
|
||||
{{- if .Values.prometheusMonitoring.podMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ template "sonarqube.name" . }}
|
||||
namespace: {{ .Values.prometheusMonitoring.podMonitor.namespace | quote }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
spec:
|
||||
{{- if .Values.prometheusMonitoring.podMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.prometheusMonitoring.podMonitor.jobLabel | quote }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
podMetricsEndpoints:
|
||||
- port: http
|
||||
path: /api/monitoring/metrics
|
||||
scheme: http
|
||||
{{- if .Values.prometheusMonitoring.podMonitor.interval }}
|
||||
interval: {{ .Values.prometheusMonitoring.podMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheusMonitoring.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.prometheusMonitoring.podMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
bearerTokenSecret:
|
||||
{{- if and .Values.monitoringPasscodeSecretName .Values.monitoringPasscodeSecretKey }}
|
||||
name: {{ .Values.monitoringPasscodeSecretName }}
|
||||
key: {{ .Values.monitoringPasscodeSecretKey }}
|
||||
{{- else }}
|
||||
name: {{ template "sonarqube.fullname" . }}-monitoring-passcode
|
||||
key: SONAR_WEB_SYSTEMPASSCODE
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
|
||||
release: "{{ .Release.Name }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{ if .Values.persistence.annotations}}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.persistence.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.persistence.storageClass }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,34 @@
|
||||
{{- if .Values.route.enabled -}}
|
||||
{{- $serviceName := include "sonarqube.fullname" . -}}
|
||||
kind: Route
|
||||
apiVersion: route.openshift.io/v1
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.route.labels }}
|
||||
{{ .Values.route.labels | toYaml | trimSuffix "\n"| indent 4 -}}
|
||||
{{- end}}
|
||||
{{- if .Values.route.annotations}}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.route.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.route.host }}
|
||||
host: {{ .Values.route.host }}
|
||||
{{- end }}
|
||||
to:
|
||||
kind: Service
|
||||
name: {{ default $serviceName .serviceName }}
|
||||
port:
|
||||
targetPort: http
|
||||
{{- if .Values.route.tls }}
|
||||
tls:
|
||||
{{ toYaml .Values.route.tls | indent 4 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,48 @@
|
||||
---
|
||||
{{- if not (or .Values.postgresql.enabled .Values.postgresql.existingSecret .Values.jdbcOverwrite.jdbcSecretName)}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{ template "jdbc.secretPasswordKey" . }}: {{ template "jdbc.internalSecretPasswd" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if and .Values.monitoringPasscode (not .Values.monitoringPasscodeSecretName) (not .Values.monitoringPasscodeSecretKey)}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-monitoring-passcode
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
type: Opaque
|
||||
data:
|
||||
SONAR_WEB_SYSTEMPASSCODE: {{ .Values.monitoringPasscode | b64enc | quote }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.account }}
|
||||
{{- if .Values.account.adminPassword }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}-admin-password
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
password: {{ .Values.account.adminPassword | urlquery | quote }}
|
||||
currentPassword: {{ default "admin" .Values.account.currentAdminPassword | urlquery | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.service.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{ if .Values.service.annotations}}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.service.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.externalPort }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
{{- if .Values.service.nodePort }}
|
||||
nodePort: {{ .Values.service.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- if eq .Values.service.type "LoadBalancer"}}
|
||||
{{- if .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- range .Values.service.loadBalancerSourceRanges }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- if .Values.service.loadBalancerIP}}
|
||||
loadBalancerIP: {{.Values.service.loadBalancerIP}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
{{- if .Values.serviceAccount.name }}
|
||||
name: {{ .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
name: {{ include "sonarqube.fullname" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.serviceAccount.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountToken | default "false" }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,63 @@
|
||||
{{- if and (.Values.OpenShift.enabled) (.Values.OpenShift.createSCC) }}
|
||||
|
||||
# This SCC allows any user ID but restricts capabilties and host access
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/description: "allows pod to run as root, privileged and run sysctl"
|
||||
"helm.sh/hook": pre-install
|
||||
name: {{ .Release.Name }}-privileged-scc
|
||||
allowHostDirVolumePlugin: false
|
||||
allowHostIPC: false
|
||||
allowHostNetwork: false
|
||||
allowHostPID: false
|
||||
allowHostPorts: false
|
||||
allowPrivilegedContainer: true
|
||||
allowPrivilegeEscalation: true
|
||||
allowedCapabilities: []
|
||||
allowedFlexVolumes: []
|
||||
allowedUnsafeSysctls: []
|
||||
defaultAddCapabilities: []
|
||||
defaultAllowPrivilegeEscalation: true
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
readOnlyRootFilesystem: false
|
||||
requiredDropCapabilities:
|
||||
- KILL
|
||||
- MKNOD
|
||||
- SETUID
|
||||
- SETGID
|
||||
runAsUser:
|
||||
type: RunAsAny
|
||||
# This can be customized for your host machine
|
||||
seLinuxContext:
|
||||
type: MustRunAs
|
||||
# seLinuxOptions:
|
||||
# level:
|
||||
# user:
|
||||
# role:
|
||||
# type:
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
# This can be customized for your host machine
|
||||
volumes:
|
||||
- configMap
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- persistentVolumeClaim
|
||||
- projected
|
||||
- secret
|
||||
# If you want a priority on your SCC -- set for a value more than 0
|
||||
priority: 11
|
||||
users:
|
||||
{{- if .Values.serviceAccount.name }}
|
||||
- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
- system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-sonarqube
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.securityContext.enabled }}
|
||||
- system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-postgresql
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@@ -0,0 +1,541 @@
|
||||
{{- if eq .Values.deploymentType "StatefulSet"}}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "sonarqube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
app.kubernetes.io/name: {{ template "sonarqube.name" . }}-{{ template "sonarqube.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: sonarqube
|
||||
app.kubernetes.io/component: {{ template "sonarqube.fullname" . }}
|
||||
app.kubernetes.io/version: {{ tpl .Values.image.tag . | quote }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
serviceName: {{ template "sonarqube.fullname" . }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/init-sysctl: {{ include (print $.Template.BasePath "/init-sysctl.yaml") . | sha256sum }}
|
||||
checksum/init-fs: {{ include (print $.Template.BasePath "/init-fs.yaml") . | sha256sum }}
|
||||
checksum/plugins: {{ include (print $.Template.BasePath "/install-plugins.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
checksum/prometheus-config: {{ include (print $.Template.BasePath "/prometheus-config.yaml") . | sha256sum }}
|
||||
checksum/prometheus-ce-config: {{ include (print $.Template.BasePath "/prometheus-ce-config.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.annotations}}
|
||||
{{- range $key, $value := .Values.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | indent 8 }}
|
||||
{{- if or .Values.image.pullSecrets .Values.image.pullSecret }}
|
||||
imagePullSecrets:
|
||||
{{- if .Values.image.pullSecret }}
|
||||
- name: {{ .Values.image.pullSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.image.pullSecrets}}
|
||||
{{ toYaml .Values.image.pullSecrets | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.extraInitContainers }}
|
||||
{{ toYaml .Values.extraInitContainers | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
- name: "wait-for-db"
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initContainers.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := .Values.initContainers.securityContext }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.initContainers.resources | indent 12 }}
|
||||
command: ["/bin/bash", "-c"]
|
||||
args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/{{.Release.Name}}-postgresql/5432) && exit 0; sleep 2;done; exit 1']
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- name: ca-certs
|
||||
image: {{ default (include "sonarqube.image" $) .Values.caCerts.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["sh"]
|
||||
args: ["-c", "cp -f \"${JAVA_HOME}/lib/security/cacerts\" /tmp/certs/cacerts; if [ \"$(ls /tmp/secrets/ca-certs)\" ]; then for f in /tmp/secrets/ca-certs/*; do keytool -importcert -file \"${f}\" -alias \"$(basename \"${f}\")\" -keystore /tmp/certs/cacerts -storepass changeit -trustcacerts -noprompt; done; fi;"]
|
||||
{{- if $securityContext := .Values.initContainers.securityContext }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.initContainers.resources | indent 12 }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/certs
|
||||
name: sonarqube
|
||||
subPath: certs
|
||||
- mountPath: /tmp/secrets/ca-certs
|
||||
name: ca-certs
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.initSysctl.enabled .Values.elasticsearch.configureNode }}
|
||||
- name: init-sysctl
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initSysctl.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.initSysctl.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.initSysctl.resources) | indent 12 }}
|
||||
command: ["/bin/bash",
|
||||
"-e",
|
||||
"/tmp/scripts/init_sysctl.sh"]
|
||||
volumeMounts:
|
||||
- name: init-sysctl
|
||||
mountPath: /tmp/scripts/
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretProperties .Values.sonarSecretKey (not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- name: concat-properties
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initContainers.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/bin/sh
|
||||
if [ -f /tmp/props/sonar.properties ]; then
|
||||
cat /tmp/props/sonar.properties > /tmp/result/sonar.properties
|
||||
fi
|
||||
if [ -f /tmp/props/secret.properties ]; then
|
||||
cat /tmp/props/secret.properties > /tmp/result/sonar.properties
|
||||
fi
|
||||
if [ -f /tmp/props/sonar.properties -a -f /tmp/props/secret.properties ]; then
|
||||
awk 1 /tmp/props/sonar.properties /tmp/props/secret.properties > /tmp/result/sonar.properties
|
||||
fi
|
||||
volumeMounts:
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretKey (not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- mountPath: /tmp/props/sonar.properties
|
||||
name: config
|
||||
subPath: sonar.properties
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretProperties }}
|
||||
- mountPath: /tmp/props/secret.properties
|
||||
name: secret-config
|
||||
subPath: secret.properties
|
||||
{{- end }}
|
||||
- mountPath: /tmp/result
|
||||
name: concat-dir
|
||||
{{- if $securityContext := .Values.initContainers.securityContext }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.initContainers.resources | indent 12 }}
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- name: inject-prometheus-exporter
|
||||
image: {{ default (include "sonarqube.image" $) .Values.prometheusExporter.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.prometheusExporter.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.prometheusExporter.resources) | indent 12 }}
|
||||
command: ["/bin/sh","-c"]
|
||||
args: ["curl -s '{{ template "prometheusExporter.downloadURL" . }}' {{ if $.Values.prometheusExporter.noCheckCertificate }}--insecure{{ end }} --output /data/jmx_prometheus_javaagent.jar -v"]
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: sonarqube
|
||||
subPath: data
|
||||
env:
|
||||
- name: http_proxy
|
||||
value: {{ default "" .Values.prometheusExporter.httpProxy }}
|
||||
- name: https_proxy
|
||||
value: {{ default "" .Values.prometheusExporter.httpsProxy }}
|
||||
- name: no_proxy
|
||||
value: {{ default "" .Values.prometheusExporter.noProxy }}
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.initFs.enabled }}
|
||||
- name: init-fs
|
||||
image: {{ default (include "sonarqube.image" $) .Values.initFs.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.initFs.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.initFs.resources) | indent 12 }}
|
||||
command: ["sh",
|
||||
"-e",
|
||||
"/tmp/scripts/init_fs.sh"]
|
||||
volumeMounts:
|
||||
- name: init-fs
|
||||
mountPath: /tmp/scripts/
|
||||
{{- if .Values.persistence.mounts }}
|
||||
{{ toYaml .Values.persistence.mounts | indent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/certs
|
||||
name: sonarqube
|
||||
subPath: certs
|
||||
{{- end }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/data
|
||||
name: sonarqube
|
||||
subPath: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions
|
||||
name: sonarqube
|
||||
subPath: extensions
|
||||
{{- else if .Values.plugins.install }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions/plugins
|
||||
name: sonarqube
|
||||
subPath: extensions/plugins
|
||||
{{- end }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/temp
|
||||
name: sonarqube
|
||||
subPath: temp
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/logs
|
||||
name: sonarqube
|
||||
subPath: logs
|
||||
- mountPath: /tmp
|
||||
name: tmp-dir
|
||||
{{- end }}
|
||||
{{- if .Values.plugins.install }}
|
||||
- name: install-plugins
|
||||
image: {{ default (include "sonarqube.image" $) .Values.plugins.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["sh",
|
||||
"-e",
|
||||
"/tmp/scripts/install_plugins.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions/plugins
|
||||
name: sonarqube
|
||||
subPath: extensions/plugins
|
||||
- name: install-plugins
|
||||
mountPath: /tmp/scripts/
|
||||
{{- if .Values.plugins.netrcCreds }}
|
||||
- name: plugins-netrc-file
|
||||
mountPath: /root
|
||||
{{- end }}
|
||||
{{- if $securityContext := (default .Values.initContainers.securityContext .Values.plugins.securityContext) }}
|
||||
securityContext:
|
||||
{{ toYaml $securityContext | indent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.initContainers.resources .Values.plugins.resource) | indent 12 }}
|
||||
env:
|
||||
- name: http_proxy
|
||||
value: {{ default "" .Values.plugins.httpProxy }}
|
||||
- name: https_proxy
|
||||
value: {{ default "" .Values.plugins.httpsProxy }}
|
||||
- name: no_proxy
|
||||
value: {{ default "" .Values.plugins.noProxy }}
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.extraContainers }}
|
||||
{{- toYaml .Values.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ template "sonarqube.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
# command: ["sleep",
|
||||
# "28935734265834"]
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.internalPort }}
|
||||
protocol: TCP
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- name: monitoring-web
|
||||
containerPort: {{ .Values.prometheusExporter.webBeanPort }}
|
||||
protocol: TCP
|
||||
- name: monitoring-ce
|
||||
containerPort: {{ .Values.prometheusExporter.ceBeanPort }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml (default .Values.resources .Values.resource) | indent 12 }}
|
||||
env:
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: SONAR_HELM_CHART_VERSION
|
||||
value: {{ .Chart.Version | replace "+" "_" }}
|
||||
# - name: SONAR_CE_JAVAOPTS
|
||||
# value: {{ template "sonarqube.jvmCEOpts" . }}
|
||||
# - name: SONAR_WEB_JAVAOPTS
|
||||
# value: {{ template "sonarqube.jvmOpts" . }}
|
||||
- name: SONAR_WEB_CONTEXT
|
||||
value: {{ include "sonarqube.webcontext" . }}
|
||||
- name: SONAR_JDBC_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "jdbc.secret" . }}
|
||||
key: {{ template "jdbc.secretPasswordKey" . }}
|
||||
- name: SONAR_WEB_SYSTEMPASSCODE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if and .Values.monitoringPasscodeSecretName .Values.monitoringPasscodeSecretKey }}
|
||||
name: {{ .Values.monitoringPasscodeSecretName }}
|
||||
key: {{ .Values.monitoringPasscodeSecretKey }}
|
||||
{{- else }}
|
||||
name: {{ template "sonarqube.fullname" . }}-monitoring-passcode
|
||||
key: SONAR_WEB_SYSTEMPASSCODE
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ template "sonarqube.fullname" . }}-jdbc-config
|
||||
{{- range .Values.extraConfig.secrets }}
|
||||
- secretRef:
|
||||
name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.extraConfig.configmaps }}
|
||||
- configMapRef:
|
||||
name: {{ . }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
host="$(hostname -i || echo '127.0.0.1')"
|
||||
wget --no-proxy --quiet -O /dev/null --timeout={{ .Values.livenessProbe.timeoutSeconds }} --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://${host}:{{ .Values.service.internalPort }}{{ .Values.livenessProbe.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/liveness"
|
||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/bin/bash
|
||||
# A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
|
||||
# status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
|
||||
host="$(hostname -i || echo '127.0.0.1')"
|
||||
if wget --no-proxy -qO- http://${host}:{{ .Values.service.internalPort }}{{ .Values.readinessProbe.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
|
||||
exit 0
|
||||
fi
|
||||
exit 1
|
||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
scheme: HTTP
|
||||
path: {{ .Values.startupProbe.sonarWebContext | default (include "sonarqube.webcontext" .) }}api/system/status
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
|
||||
{{- if .Values.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.persistence.mounts }}
|
||||
{{ toYaml .Values.persistence.mounts | indent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- .Values.extraVolumeMounts | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretProperties .Values.sonarSecretKey (not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/conf/
|
||||
name: concat-dir
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretKey }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/secret/
|
||||
name: secret
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/certs
|
||||
name: sonarqube
|
||||
subPath: certs
|
||||
{{- end }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/data
|
||||
name: sonarqube
|
||||
subPath: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions
|
||||
name: sonarqube
|
||||
subPath: extensions
|
||||
{{- else if .Values.plugins.install }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/extensions/plugins
|
||||
name: sonarqube
|
||||
subPath: extensions/plugins
|
||||
{{- end }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/temp
|
||||
name: sonarqube
|
||||
subPath: temp
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/logs
|
||||
name: sonarqube
|
||||
subPath: logs
|
||||
- mountPath: /tmp
|
||||
name: tmp-dir
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/conf/prometheus-config.yaml
|
||||
subPath: prometheus-config.yaml
|
||||
name: prometheus-config
|
||||
- mountPath: {{ .Values.sonarqubeFolder }}/conf/prometheus-ce-config.yaml
|
||||
subPath: prometheus-ce-config.yaml
|
||||
name: prometheus-ce-config
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases:
|
||||
{{ toYaml .Values.hostAliases | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "sonarqube.serviceAccountName" . }}
|
||||
volumes:
|
||||
{{- if .Values.persistence.volumes }}
|
||||
{{ tpl (toYaml .Values.persistence.volumes | indent 6) . }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- .Values.extraVolumes | toYaml | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretKey ( not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-config
|
||||
items:
|
||||
- key: sonar.properties
|
||||
path: sonar.properties
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretProperties }}
|
||||
- name: secret-config
|
||||
secret:
|
||||
secretName: {{ .Values.sonarSecretProperties }}
|
||||
items:
|
||||
- key: secret.properties
|
||||
path: secret.properties
|
||||
{{- end }}
|
||||
{{- if .Values.sonarSecretKey }}
|
||||
- name: secret
|
||||
secret:
|
||||
secretName: {{ .Values.sonarSecretKey }}
|
||||
items:
|
||||
- key: sonar-secret.txt
|
||||
path: sonar-secret.txt
|
||||
{{- end }}
|
||||
{{- if .Values.caCerts.enabled }}
|
||||
- name: ca-certs
|
||||
secret:
|
||||
secretName: {{ .Values.caCerts.secret }}
|
||||
{{- end }}
|
||||
{{- if .Values.plugins.netrcCreds }}
|
||||
- name: plugins-netrc-file
|
||||
secret:
|
||||
secretName: {{ .Values.plugins.netrcCreds }}
|
||||
items:
|
||||
- key: netrc
|
||||
path: .netrc
|
||||
{{- end }}
|
||||
- name: init-sysctl
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-init-sysctl
|
||||
items:
|
||||
- key: init_sysctl.sh
|
||||
path: init_sysctl.sh
|
||||
- name: init-fs
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-init-fs
|
||||
items:
|
||||
- key: init_fs.sh
|
||||
path: init_fs.sh
|
||||
- name: install-plugins
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-install-plugins
|
||||
items:
|
||||
- key: install_plugins.sh
|
||||
path: install_plugins.sh
|
||||
{{- if .Values.prometheusExporter.enabled }}
|
||||
- name: prometheus-config
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-prometheus-config
|
||||
items:
|
||||
- key: prometheus-config.yaml
|
||||
path: prometheus-config.yaml
|
||||
- name: prometheus-ce-config
|
||||
configMap:
|
||||
name: {{ template "sonarqube.fullname" . }}-prometheus-ce-config
|
||||
items:
|
||||
- key: prometheus-ce-config.yaml
|
||||
path: prometheus-ce-config.yaml
|
||||
{{- end }}
|
||||
- name: sonarqube
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "sonarqube.fullname" . }}{{- end }}
|
||||
{{- else }}
|
||||
emptyDir: {{- toYaml .Values.emptyDir | nindent 10 }}
|
||||
{{- end }}
|
||||
- name : tmp-dir
|
||||
emptyDir: {{- toYaml .Values.emptyDir | nindent 10 }}
|
||||
{{- if or .Values.sonarProperties .Values.sonarSecretProperties .Values.sonarSecretKey ( not .Values.elasticsearch.bootstrapChecks) }}
|
||||
- name : concat-dir
|
||||
emptyDir: {{- toYaml .Values.emptyDir | nindent 10 -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,40 @@
|
||||
{{- if .Values.tests.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-ui-test"
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
labels:
|
||||
app: {{ template "sonarqube.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
{{- if or .Values.image.pullSecrets .Values.image.pullSecret }}
|
||||
imagePullSecrets:
|
||||
{{- if .Values.image.pullSecret }}
|
||||
- name: {{ .Values.image.pullSecret }}
|
||||
{{- end}}
|
||||
{{- if .Values.image.pullSecrets}}
|
||||
{{ toYaml .Values.image.pullSecrets | indent 4 }}
|
||||
{{- end}}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Release.Name }}-ui-test
|
||||
image: {{ .Values.tests.image | default (printf "%s:%s" .Values.image.repository (tpl .Values.image.tag .)) | quote }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ['wget']
|
||||
args: [
|
||||
'--retry-connrefused',
|
||||
'--waitretry=1',
|
||||
'--timeout=5',
|
||||
'-t',
|
||||
'12',
|
||||
'-qO-',
|
||||
'{{ template "sonarqube.fullname" . }}:{{ .Values.service.internalPort }}/api/system/status'
|
||||
]
|
||||
resources:
|
||||
{{ toYaml .Values.tests.resources | indent 8 }}
|
||||
restartPolicy: Never
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,67 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"required": [
|
||||
"replicaCount"
|
||||
],
|
||||
"properties": {
|
||||
"postgresql": {
|
||||
"type": "object",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) Please use an external database instead of the embedded one. Please visit https://artifacthub.io/packages/helm/sonarqube/sonarqube#production-use-case for more information"
|
||||
},
|
||||
"replicaCount": {
|
||||
"type": "integer",
|
||||
"enum": [0, 1]
|
||||
},
|
||||
"jvmOpts": {
|
||||
"type": "string",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) Please use SONAR_WEB_JAVAOPTS or sonar.web.javaOpts"
|
||||
},
|
||||
"jvmCeOpts": {
|
||||
"type": "string",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) Please use SONAR_CE_JAVAOPTS or sonar.ce.javaOpts"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"sonarWebContext": {
|
||||
"type": "string",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) please use sonarWebContext at the value top level"
|
||||
}
|
||||
}
|
||||
},
|
||||
"startupProbe": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"sonarWebContext": {
|
||||
"type": "string",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) please use sonarWebContext at the value top level"
|
||||
}
|
||||
}
|
||||
},
|
||||
"readinessProbe": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"sonarWebContext": {
|
||||
"type": "string",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) please use sonarWebContext at the value top level"
|
||||
}
|
||||
}
|
||||
},
|
||||
"account": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"sonarWebContext": {
|
||||
"type": "string",
|
||||
"deprecated": true,
|
||||
"$comment": "(DEPRECATED) please use sonarWebContext at the value top level"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,578 @@
|
||||
# Default values for sonarqube.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
# If the deployment Type is set to Deployment sonarqube is deployed as a replica set.
|
||||
deploymentType: "StatefulSet"
|
||||
|
||||
# There should not be more than 1 sonarqube instance connected to the same database. Please set this value to 1 or 0 (in case you need to scale down programmatically).
|
||||
replicaCount: 1
|
||||
|
||||
# How many revisions to retain (Deployment ReplicaSets or StatefulSets)
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
# This will use the default deployment strategy unless it is overriden
|
||||
deploymentStrategy: {}
|
||||
# Uncomment this to scheduler pods on priority
|
||||
# priorityClassName: "high-priority"
|
||||
|
||||
## Use an alternate scheduler, e.g. "stork".
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
# schedulerName:
|
||||
|
||||
## Is this deployment for OpenShift? If so, we help with SCCs
|
||||
OpenShift:
|
||||
enabled: false
|
||||
createSCC: true
|
||||
|
||||
edition: "community"
|
||||
|
||||
image:
|
||||
repository: sonarqube
|
||||
tag: 10.4.0-{{ .Values.edition }}
|
||||
pullPolicy: IfNotPresent
|
||||
# If using a private repository, the imagePullSecrets to use
|
||||
# pullSecrets:
|
||||
# - name: my-repo-secret
|
||||
|
||||
# Set security context for sonarqube pod
|
||||
securityContext:
|
||||
fsGroup: 0
|
||||
|
||||
# Set security context for sonarqube container
|
||||
containerSecurityContext:
|
||||
# Sonarqube dockerfile creates sonarqube user as UID and GID 0
|
||||
# Those default are used to match pod security standard restricted as least privileged approach
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 0
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# Settings to configure elasticsearch host requirements
|
||||
elasticsearch:
|
||||
# DEPRECATED: Use initSysctl.enabled instead
|
||||
configureNode: false
|
||||
bootstrapChecks: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalPort: 9000
|
||||
internalPort: 9000
|
||||
labels:
|
||||
annotations: {}
|
||||
# May be used in example for internal load balancing in GCP:
|
||||
# cloud.google.com/load-balancer-type: Internal
|
||||
# loadBalancerSourceRanges:
|
||||
# - 0.0.0.0/0
|
||||
# loadBalancerIP: 1.2.3.4
|
||||
|
||||
# Optionally create Network Policies
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
|
||||
# If you plan on using the jmx exporter, you need to define where the traffic is coming from
|
||||
prometheusNamespace: "monitoring"
|
||||
|
||||
# If you are using a external database and enable network Policies to be created
|
||||
# you will need to explicitly allow egress traffic to your database
|
||||
# expects https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#networkpolicyspec-v1-networking-k8s-io
|
||||
# additionalNetworkPolicys:
|
||||
|
||||
# will be used as default for ingress path and probes path, will be injected in .Values.env as SONAR_WEB_CONTEXT
|
||||
# if .Values.env.SONAR_WEB_CONTEXT is set, this value will be ignored
|
||||
sonarWebContext: ""
|
||||
|
||||
# also install the nginx ingress helm chart
|
||||
nginx:
|
||||
enabled: false
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
# Used to create an Ingress record.
|
||||
hosts:
|
||||
- name: sonarqube.your-org.com
|
||||
# Different clouds or configurations might need /* as the default path
|
||||
# path: /
|
||||
# For additional control over serviceName and servicePort
|
||||
# serviceName: someService
|
||||
# servicePort: somePort
|
||||
# the pathType can be one of the following values: Exact|Prefix|ImplementationSpecific(default)
|
||||
# pathType: ImplementationSpecific
|
||||
annotations: {}
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# Set the ingressClassName on the ingress record
|
||||
# ingressClassName: nginx
|
||||
|
||||
# Additional labels for Ingress manifest file
|
||||
# labels:
|
||||
# traffic-type: external
|
||||
# traffic-type: internal
|
||||
tls: []
|
||||
# Secrets must be manually created in the namespace. To generate a self-signed certificate (and private key) and then create the secret in the cluster please refer to official documentation available at https://kubernetes.github.io/ingress-nginx/user-guide/tls/#tls-secrets
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
route:
|
||||
enabled: false
|
||||
host: ""
|
||||
# Add tls section to secure traffic. TODO: extend this section with other secure route settings
|
||||
# Comment this out if you want plain http route created.
|
||||
tls:
|
||||
termination: edge
|
||||
|
||||
annotations: {}
|
||||
# See Openshift/OKD route annotation
|
||||
# https://docs.openshift.com/container-platform/4.10/networking/routes/route-configuration.html#nw-route-specific-annotations_route-configuration
|
||||
# haproxy.router.openshift.io/timeout: 1m
|
||||
|
||||
# Additional labels for Route manifest file
|
||||
# labels:
|
||||
# external: 'true'
|
||||
|
||||
# Affinity for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
affinity: {}
|
||||
|
||||
# Tolerations for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
# taint a node with the following command to mark it as not schedulable for new pods
|
||||
# kubectl taint nodes <node> sonarqube=true:NoSchedule
|
||||
# The following statement will tolerate this taint and as such reverse a node for sonarqube
|
||||
tolerations: []
|
||||
# - key: "sonarqube"
|
||||
# operator: "Equal"
|
||||
# value: "true"
|
||||
# effect: "NoSchedule"
|
||||
|
||||
# Node labels for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
# add a label to a node with the following command
|
||||
# kubectl label node <node> sonarqube=true
|
||||
nodeSelector: {}
|
||||
# sonarqube: "true"
|
||||
|
||||
# hostAliases allows the modification of the hosts file inside a container
|
||||
hostAliases: []
|
||||
# - ip: "192.168.1.10"
|
||||
# hostnames:
|
||||
# - "example.com"
|
||||
# - "www.example.com"
|
||||
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 6
|
||||
# Note that timeoutSeconds was not respected before Kubernetes 1.20 for exec probes
|
||||
timeoutSeconds: 1
|
||||
# If an ingress *path* other than the root (/) is defined, it should be reflected here
|
||||
# A trailing "/" must be included
|
||||
# deprecated please use sonarWebContext at the value top level
|
||||
# sonarWebContext: /
|
||||
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 6
|
||||
# Note that timeoutSeconds was not respected before Kubernetes 1.20 for exec probes
|
||||
timeoutSeconds: 1
|
||||
# If an ingress *path* other than the root (/) is defined, it should be reflected here
|
||||
# A trailing "/" must be included
|
||||
# deprecated please use sonarWebContext at the value top level
|
||||
# sonarWebContext: /
|
||||
|
||||
startupProbe:
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
failureThreshold: 24
|
||||
# Note that timeoutSeconds was not respected before Kubernetes 1.20 for exec probes
|
||||
timeoutSeconds: 1
|
||||
# If an ingress *path* other than the root (/) is defined, it should be reflected here
|
||||
# A trailing "/" must be included
|
||||
# deprecated please use sonarWebContext at the value top level
|
||||
# sonarWebContext: /
|
||||
|
||||
initContainers:
|
||||
# image: busybox:1.36
|
||||
# We allow the init containers to have a separate security context declaration because
|
||||
# the initContainer may not require the same as SonarQube.
|
||||
# Those default are used to match pod security standard restricted as least privileged approach
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 0
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
# We allow the init containers to have a separate resources declaration because
|
||||
# the initContainer does not take as much resources.
|
||||
resources: {}
|
||||
|
||||
# Extra init containers to e.g. download required artifacts
|
||||
extraInitContainers: {}
|
||||
|
||||
## Array of extra containers to run alongside the sonarqube container
|
||||
##
|
||||
## Example:
|
||||
## - name: myapp-container
|
||||
## image: busybox
|
||||
## command: ['sh', '-c', 'echo Hello && sleep 3600']
|
||||
##
|
||||
extraContainers: []
|
||||
|
||||
## Provide a secret containing one or more certificate files in the keys that will be added to cacerts
|
||||
## The cacerts file will be set via SONARQUBE_WEB_JVM_OPTS and SONAR_CE_JAVAOPTS
|
||||
##
|
||||
caCerts:
|
||||
enabled: false
|
||||
image: adoptopenjdk/openjdk11:alpine
|
||||
secret: your-secret
|
||||
|
||||
initSysctl:
|
||||
enabled: true
|
||||
vmMaxMapCount: 524288
|
||||
fsFileMax: 131072
|
||||
nofile: 131072
|
||||
nproc: 8192
|
||||
# image: busybox:1.36
|
||||
securityContext:
|
||||
# Compatible with podSecurity standard privileged
|
||||
privileged: true
|
||||
# if run without root permissions, error "sysctl: permission denied on key xxx, ignoring"
|
||||
runAsUser: 0
|
||||
# resources: {}
|
||||
|
||||
# This should not be required anymore, used to chown/chmod folder created by faulty CSI driver that are not applying properly POSIX fsgroup.
|
||||
initFs:
|
||||
enabled: true
|
||||
# Image: busybox:1.36
|
||||
# Compatible with podSecurity standard baseline.
|
||||
securityContext:
|
||||
privileged: false
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
add: ["CHOWN"]
|
||||
|
||||
prometheusExporter:
|
||||
enabled: false
|
||||
# jmx_prometheus_javaagent version to download from Maven Central
|
||||
version: "0.17.2"
|
||||
# Alternative full download URL for the jmx_prometheus_javaagent.jar (overrides prometheusExporter.version)
|
||||
# downloadURL: ""
|
||||
# if you need to ignore TLS certificates for whatever reason enable the following flag
|
||||
noCheckCertificate: false
|
||||
|
||||
# Ports for the jmx prometheus agent to export metrics at
|
||||
webBeanPort: 8000
|
||||
ceBeanPort: 8001
|
||||
|
||||
config:
|
||||
rules:
|
||||
- pattern: ".*"
|
||||
# Overrides config for the CE process Prometheus exporter (by default, the same rules are used for both the Web and CE processes).
|
||||
# ceConfig:
|
||||
# rules:
|
||||
# - pattern: ".*"
|
||||
# image: curlimages/curl:8.2.1
|
||||
# For use behind a corporate proxy when downloading prometheus
|
||||
# httpProxy: ""
|
||||
# httpsProxy: ""
|
||||
# noProxy: ""
|
||||
# Reuse default initcontainers.securityContext that match restricted pod security standard
|
||||
# securityContext: {}
|
||||
|
||||
prometheusMonitoring:
|
||||
# Generate a Prometheus Pod Monitor (https://github.com/coreos/prometheus-operator)
|
||||
#
|
||||
podMonitor:
|
||||
# Create PodMonitor Resource for Prometheus scraping
|
||||
enabled: false
|
||||
# Specify a custom namespace where the PodMonitor will be created
|
||||
namespace: "default"
|
||||
# Specify the interval how often metrics should be scraped
|
||||
interval: 30s
|
||||
# Specify the timeout after a scrape is ended
|
||||
# scrapeTimeout: ""
|
||||
# Name of the label on target services that prometheus uses as job name
|
||||
# jobLabel: ""
|
||||
|
||||
# List of plugins to install.
|
||||
# For example:
|
||||
# plugins:
|
||||
# install:
|
||||
# - "https://github.com/AmadeusITGroup/sonar-stash/releases/download/1.3.0/sonar-stash-plugin-1.3.0.jar"
|
||||
# - "https://github.com/SonarSource/sonar-ldap/releases/download/2.2-RC3/sonar-ldap-plugin-2.2.0.601.jar"
|
||||
#
|
||||
plugins:
|
||||
install: []
|
||||
|
||||
# For use behind a corporate proxy when downloading plugins
|
||||
# httpProxy: ""
|
||||
# httpsProxy: ""
|
||||
# noProxy: ""
|
||||
|
||||
# image: curlimages/curl:8.2.1
|
||||
# resources: {}
|
||||
|
||||
# .netrc secret file with a key "netrc" to use basic auth while downloading plugins
|
||||
# netrcCreds: ""
|
||||
|
||||
# Set to true to not validate the server's certificate to download plugin
|
||||
noCheckCertificate: false
|
||||
# Reuse default initcontainers.securityContext that match restricted pod security standard
|
||||
# securityContext: {}
|
||||
|
||||
## (DEPRECATED) The following value sets SONAR_WEB_JAVAOPTS (e.g., jvmOpts: "-Djava.net.preferIPv4Stack=true"). However, this is deprecated, please set SONAR_WEB_JAVAOPTS or sonar.web.javaOpts directly instead.
|
||||
jvmOpts: ""
|
||||
|
||||
## (DEPRECATED) The following value sets SONAR_CE_JAVAOPTS. However, this is deprecated, please set SONAR_CE_JAVAOPTS or sonar.ce.javaOpts directly instead.
|
||||
jvmCeOpts: ""
|
||||
|
||||
## a monitoring passcode needs to be defined in order to get reasonable probe results
|
||||
# not setting the monitoring passcode will result in a deployment that will never be ready
|
||||
monitoringPasscode: "define_it"
|
||||
# Alternatively, you can define the passcode loading it from an existing secret specifying the right key
|
||||
# monitoringPasscodeSecretName: "pass-secret-name"
|
||||
# monitoringPasscodeSecretKey: "pass-key"
|
||||
|
||||
## Environment variables to attach to the pods
|
||||
##
|
||||
# env:
|
||||
# # If you use a different ingress path from /, you have to add it here as the value of SONAR_WEB_CONTEXT
|
||||
# - name: SONAR_WEB_CONTEXT
|
||||
# value: /sonarqube
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
|
||||
# Set annotations for pods
|
||||
annotations: {}
|
||||
|
||||
## We usually don't make specific ressource recommandations, as they are heavily dependend on
|
||||
## The usage of SonarQube and the surrounding infrastructure.
|
||||
## Adjust these values to your needs, but make sure that the memory limit is never under 4 GB
|
||||
resources:
|
||||
limits:
|
||||
cpu: 800m
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 400m
|
||||
memory: 2Gi
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
## Set annotations on pvc
|
||||
annotations: {}
|
||||
|
||||
## Specify an existing volume claim instead of creating a new one.
|
||||
## When using this option all following options like storageClass, accessMode and size are ignored.
|
||||
# existingClaim:
|
||||
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
storageClass:
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
uid: 1000
|
||||
guid: 0
|
||||
|
||||
## Specify extra volumes. Refer to ".spec.volumes" specification : https://kubernetes.io/fr/docs/concepts/storage/volumes/
|
||||
volumes: []
|
||||
## Specify extra mounts. Refer to ".spec.containers.volumeMounts" specification : https://kubernetes.io/fr/docs/concepts/storage/volumes/
|
||||
mounts: []
|
||||
|
||||
# In case you want to specify different resources for emptyDir than {}
|
||||
emptyDir: {}
|
||||
# Example of resouces that might be used:
|
||||
# medium: Memory
|
||||
# sizeLimit: 16Mi
|
||||
|
||||
# A custom sonar.properties file can be provided via dictionary.
|
||||
# For example:
|
||||
# sonarProperties:
|
||||
# sonar.forceAuthentication: true
|
||||
# sonar.security.realm: LDAP
|
||||
# ldap.url: ldaps://organization.com
|
||||
|
||||
# Additional sonar properties to load from a secret with a key "secret.properties" (must be a string)
|
||||
# sonarSecretProperties:
|
||||
|
||||
# Kubernetes secret that contains the encryption key for the sonarqube instance.
|
||||
# The secret must contain the key 'sonar-secret.txt'.
|
||||
# The 'sonar.secretKeyPath' property will be set automatically.
|
||||
# sonarSecretKey: "settings-encryption-secret"
|
||||
|
||||
## Override JDBC values
|
||||
## for external Databases
|
||||
jdbcOverwrite:
|
||||
# If enable the JDBC Overwrite, make sure to set `postgresql.enabled=false`
|
||||
enable: false
|
||||
# The JDBC url of the external DB
|
||||
jdbcUrl: "jdbc:postgresql://myPostgress/myDatabase?socketTimeout=1500"
|
||||
# The DB user that should be used for the JDBC connection
|
||||
jdbcUsername: "sonarUser"
|
||||
# Use this if you don't mind the DB password getting stored in plain text within the values file
|
||||
jdbcPassword: "sonarPass"
|
||||
## Alternatively, use a pre-existing k8s secret containing the DB password
|
||||
# jdbcSecretName: "sonarqube-jdbc"
|
||||
## and the secretValueKey of the password found within that secret
|
||||
# jdbcSecretPasswordKey: "jdbc-password"
|
||||
|
||||
## (DEPRECATED) Configuration values for postgresql dependency
|
||||
## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md
|
||||
postgresql:
|
||||
# Enable to deploy the bitnami PostgreSQL chart
|
||||
enabled: true
|
||||
## postgresql Chart global settings
|
||||
# global:
|
||||
# imageRegistry: ''
|
||||
# imagePullSecrets: ''
|
||||
## bitnami/postgres image tag
|
||||
image:
|
||||
registry: asia-southeast1-docker.pkg.dev
|
||||
repository: meesho-devops-admin-0622/admin/devops/bitnami/postgresql
|
||||
tag: 11.14.0-debian-10-r22
|
||||
# existingSecret Name of existing secret to use for PostgreSQL passwords
|
||||
# The secret has to contain the keys postgresql-password which is the password for postgresqlUsername when it is
|
||||
# different of postgres, postgresql-postgres-password which will override postgresqlPassword,
|
||||
# postgresql-replication-password which will override replication.password and postgresql-ldap-password which will be
|
||||
# used to authenticate on LDAP. The value is evaluated as a template.
|
||||
# existingSecret: ""
|
||||
#
|
||||
# The bitnami chart enforces the key to be "postgresql-password". This value is only here for historic purposes
|
||||
# existingSecretPasswordKey: "postgresql-password"
|
||||
postgresqlUsername: "sonarUser"
|
||||
postgresqlPassword: "sonarPass"
|
||||
postgresqlDatabase: "sonarDB"
|
||||
# Specify the TCP port that PostgreSQL should use
|
||||
service:
|
||||
port: 5432
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 2Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 200Mi
|
||||
persistence:
|
||||
enabled: true
|
||||
accessMode: ReadWriteOnce
|
||||
size: 20Gi
|
||||
storageClass:
|
||||
securityContext:
|
||||
# For standard Kubernetes deployment, set enabled=true
|
||||
# If using OpenShift, enabled=false for restricted SCC and enabled=true for anyuid/nonroot SCC
|
||||
enabled: true
|
||||
# fsGroup specification below are not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully.
|
||||
# postgresql dockerfile sets user as 1001
|
||||
fsGroup: 1001
|
||||
containerSecurityContext:
|
||||
# For standard Kubernetes deployment, set enabled=true
|
||||
# If using OpenShift, enabled=false for restricted SCC and enabled=true for anyuid/nonroot SCC
|
||||
enabled: true
|
||||
# runAsUser specification below are not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully.
|
||||
# postgresql dockerfile sets user as 1001, the rest aim at making it compatible with restricted pod security standard.
|
||||
runAsUser: 1001
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
volumePermissions:
|
||||
# For standard Kubernetes deployment, set enabled=false
|
||||
# For OpenShift, set enabled=true and ensure to set volumepermissions.securitycontext.runAsUser below.
|
||||
enabled: false
|
||||
# if using restricted SCC set runAsUser: "auto" and if running under anyuid/nonroot SCC - runAsUser needs to match runAsUser above
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
shmVolume:
|
||||
chmod:
|
||||
enabled: false
|
||||
serviceAccount:
|
||||
## If enabled = true, and name is not set, postgreSQL will create a serviceAccount
|
||||
enabled: false
|
||||
# name:
|
||||
|
||||
# Additional labels to add to the pods:
|
||||
# podLabels:
|
||||
# key: value
|
||||
podLabels: {}
|
||||
# For compatibility with 8.0 replace by "/opt/sq"
|
||||
# For compatibility with 8.2, leave the default. They changed it back to /opt/sonarqube
|
||||
sonarqubeFolder: /opt/sonarqube
|
||||
|
||||
tests:
|
||||
image: ""
|
||||
enabled: true
|
||||
resources: {}
|
||||
|
||||
# For OpenShift set create=true to ensure service account is created.
|
||||
serviceAccount:
|
||||
create: false
|
||||
# name:
|
||||
# automountToken: false # default
|
||||
## Annotations for the Service Account
|
||||
annotations: {}
|
||||
|
||||
# extraConfig is used to load Environment Variables from Secrets and ConfigMaps
|
||||
# which may have been written by other tools, such as external orchestrators.
|
||||
#
|
||||
# These Secrets/ConfigMaps are expected to contain Key/Value pairs, such as:
|
||||
#
|
||||
# apiVersion: v1
|
||||
# kind: ConfigMap
|
||||
# metadata:
|
||||
# name: external-sonarqube-opts
|
||||
# data:
|
||||
# SONARQUBE_JDBC_USERNAME: foo
|
||||
# SONARQUBE_JDBC_URL: jdbc:postgresql://db.example.com:5432/sonar
|
||||
#
|
||||
# These vars can then be injected into the environment by uncommenting the following:
|
||||
#
|
||||
# extraConfig:
|
||||
# configmaps:
|
||||
# - external-sonarqube-opts
|
||||
|
||||
extraConfig:
|
||||
secrets: []
|
||||
configmaps: []
|
||||
|
||||
# account:
|
||||
# The values can be set to define the current and the (new) custom admin passwords at the startup (the username will remain "admin")
|
||||
# adminPassword: admin
|
||||
# currentAdminPassword: admin
|
||||
# The above values can be also provided by a secret that contains "password" and "currentPassword" as keys. You can generate such a secret in your cluster
|
||||
# using "kubectl create secret generic admin-password-secret-name --from-literal=password=admin --from-literal=currentPassword=admin"
|
||||
# adminPasswordSecretName: ""
|
||||
# # Reuse default initcontainers.securityContext that match restricted pod security standard
|
||||
# # securityContext: {}
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# curlContainerImage: curlimages/curl:8.2.1
|
||||
# adminJobAnnotations: {}
|
||||
# deprecated please use sonarWebContext at the value top level
|
||||
# sonarWebContext: /
|
||||
|
||||
terminationGracePeriodSeconds: 60
|
||||
Reference in New Issue
Block a user