619 lines
18 KiB
YAML
619 lines
18 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
labels:
|
|
kubernetes.io/metadata.name: sonarqube
|
|
name: sonarqube
|
|
spec:
|
|
finalizers:
|
|
- kubernetes
|
|
---
|
|
# Source: sonarqube/charts/postgresql/templates/secrets.yaml
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: sonarqube-postgresql
|
|
namespace: sonarqube
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
helm.sh/chart: postgresql-10.15.0
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/managed-by: Helm
|
|
namespace: sonarqube
|
|
type: Opaque
|
|
data:
|
|
postgresql-postgres-password: "YjlLdzZzWVlYOQ=="
|
|
postgresql-password: "c29uYXJQYXNz"
|
|
---
|
|
# Source: sonarqube/templates/secret.yaml
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: sonarqube-sonarqube-monitoring-passcode
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
type: Opaque
|
|
data:
|
|
SONAR_WEB_SYSTEMPASSCODE: "ZGVmaW5lX2l0"
|
|
---
|
|
# Source: sonarqube/templates/config.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: sonarqube-sonarqube-config
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
data:
|
|
sonar.properties: |
|
|
---
|
|
# Source: sonarqube/templates/init-fs.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: sonarqube-sonarqube-init-fs
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
data:
|
|
init_fs.sh: |-
|
|
---
|
|
# Source: sonarqube/templates/init-sysctl.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: sonarqube-sonarqube-init-sysctl
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
data:
|
|
init_sysctl.sh: |-
|
|
if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
|
|
sysctl -w vm.max_map_count=524288
|
|
fi
|
|
if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
|
|
sysctl -w fs.file-max=131072
|
|
fi
|
|
if [[ "$(ulimit -n)" != "unlimited" ]]; then
|
|
if [[ "$(ulimit -n)" -lt 131072 ]]; then
|
|
echo "ulimit -n 131072"
|
|
ulimit -n 131072
|
|
fi
|
|
fi
|
|
if [[ "$(ulimit -u)" != "unlimited" ]]; then
|
|
if [[ "$(ulimit -u)" -lt 8192 ]]; then
|
|
echo "ulimit -u 8192"
|
|
ulimit -u 8192
|
|
fi
|
|
fi
|
|
---
|
|
# Source: sonarqube/templates/install-plugins.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: sonarqube-sonarqube-install-plugins
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
data:
|
|
install_plugins.sh: |-
|
|
---
|
|
# Source: sonarqube/templates/jdbc-config.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: sonarqube-sonarqube-jdbc-config
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
data:
|
|
SONAR_JDBC_USERNAME: "sonarUser"
|
|
SONAR_JDBC_URL: "jdbc:postgresql://sonarqube-postgresql:5432/sonarDB"
|
|
---
|
|
# Source: sonarqube/charts/postgresql/templates/svc-headless.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: sonarqube-postgresql-headless
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
helm.sh/chart: postgresql-10.15.0
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/managed-by: Helm
|
|
# Use this annotation in addition to the actual publishNotReadyAddresses
|
|
# field below because the annotation will stop being respected soon but the
|
|
# field is broken in some versions of Kubernetes:
|
|
# https://github.com/kubernetes/kubernetes/issues/58662
|
|
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
|
namespace: sonarqube
|
|
spec:
|
|
type: ClusterIP
|
|
clusterIP: None
|
|
# We want all pods in the StatefulSet to have their addresses published for
|
|
# the sake of the other Postgresql pods even before they're ready, since they
|
|
# have to be able to talk to each other in order to become ready.
|
|
publishNotReadyAddresses: true
|
|
ports:
|
|
- name: tcp-postgresql
|
|
port: 5432
|
|
targetPort: tcp-postgresql
|
|
selector:
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/instance: sonarqube
|
|
---
|
|
# Source: sonarqube/charts/postgresql/templates/svc.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: sonarqube-postgresql
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
helm.sh/chart: postgresql-10.15.0
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/managed-by: Helm
|
|
annotations:
|
|
namespace: sonarqube
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: tcp-postgresql
|
|
port: 5432
|
|
targetPort: tcp-postgresql
|
|
selector:
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/instance: sonarqube
|
|
role: primary
|
|
---
|
|
# Source: sonarqube/templates/service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: sonarqube-sonarqube
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 9000
|
|
targetPort: http
|
|
protocol: TCP
|
|
name: http
|
|
selector:
|
|
app: sonarqube
|
|
release: sonarqube
|
|
---
|
|
# Source: sonarqube/charts/postgresql/templates/statefulset.yaml
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: sonarqube-postgresql
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
helm.sh/chart: postgresql-10.15.0
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: primary
|
|
annotations:
|
|
namespace: sonarqube
|
|
spec:
|
|
serviceName: sonarqube-postgresql-headless
|
|
replicas: 1
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/instance: sonarqube
|
|
role: primary
|
|
template:
|
|
metadata:
|
|
name: sonarqube-postgresql
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
helm.sh/chart: postgresql-10.15.0
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/managed-by: Helm
|
|
role: primary
|
|
app.kubernetes.io/component: primary
|
|
spec:
|
|
affinity:
|
|
podAffinity:
|
|
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/component: primary
|
|
namespaces:
|
|
- "sonarqube"
|
|
topologyKey: kubernetes.io/hostname
|
|
weight: 1
|
|
nodeAffinity:
|
|
|
|
securityContext:
|
|
fsGroup: 1001
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: sonarqube-postgresql
|
|
image: reg.inje-private.com/nnd002/bitnami/postgresql:11.14.0-debian-10-r22
|
|
imagePullPolicy: "IfNotPresent"
|
|
resources:
|
|
limits:
|
|
cpu: 2
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 200Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
env:
|
|
- name: BITNAMI_DEBUG
|
|
value: "false"
|
|
- name: POSTGRESQL_PORT_NUMBER
|
|
value: "5432"
|
|
- name: POSTGRESQL_VOLUME_DIR
|
|
value: "/bitnami/postgresql"
|
|
- name: PGDATA
|
|
value: "/bitnami/postgresql/data"
|
|
- name: POSTGRES_POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sonarqube-postgresql
|
|
key: postgresql-postgres-password
|
|
- name: POSTGRES_USER
|
|
value: "sonarUser"
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sonarqube-postgresql
|
|
key: postgresql-password
|
|
- name: POSTGRES_DB
|
|
value: "sonarDB"
|
|
- name: POSTGRESQL_ENABLE_LDAP
|
|
value: "no"
|
|
- name: POSTGRESQL_ENABLE_TLS
|
|
value: "no"
|
|
- name: POSTGRESQL_LOG_HOSTNAME
|
|
value: "false"
|
|
- name: POSTGRESQL_LOG_CONNECTIONS
|
|
value: "false"
|
|
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
|
value: "false"
|
|
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
|
value: "off"
|
|
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
|
value: "error"
|
|
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
|
value: "pgaudit"
|
|
ports:
|
|
- name: tcp-postgresql
|
|
containerPort: 5432
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 6
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- -e
|
|
- |
|
|
exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
|
|
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 6
|
|
volumeMounts:
|
|
- name: dshm
|
|
mountPath: /dev/shm
|
|
- name: data
|
|
mountPath: /bitnami/postgresql
|
|
subPath:
|
|
volumes:
|
|
- name: dshm
|
|
emptyDir:
|
|
medium: Memory
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: data
|
|
spec:
|
|
accessModes:
|
|
- "ReadWriteOnce"
|
|
resources:
|
|
requests:
|
|
storage: "20Gi"
|
|
---
|
|
# Source: sonarqube/templates/sonarqube-sts.yaml
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: sonarqube-sonarqube
|
|
namespace: sonarqube
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
app.kubernetes.io/name: sonarqube-sonarqube-sonarqube
|
|
app.kubernetes.io/instance: sonarqube
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/part-of: sonarqube
|
|
app.kubernetes.io/component: sonarqube-sonarqube
|
|
app.kubernetes.io/version: "10.6.0-community"
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
serviceName: sonarqube-sonarqube
|
|
selector:
|
|
matchLabels:
|
|
app: sonarqube
|
|
release: sonarqube
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: 2256323f7d9ffc8a4e18606aa35e18a28b05412806a19e4e6a15359f9b710ad0
|
|
checksum/init-fs: 915551fa9592e2d81312781f423a59e6ba0837510c2e1d996e899eecd057ee91
|
|
checksum/init-sysctl: 7aa0dd9441283780322cf0596f09a398219af7dd756fcead24179a08adcebc32
|
|
checksum/plugins: 14cc0e459ae2f5de6499309b22cfdbcc1452d9e0e4f01a0ea45a43793e95e550
|
|
checksum/secret: b433376554b78de7ccf285d4ffebc8759355e6916f285189ce33ba1eba4ba28a
|
|
labels:
|
|
app: sonarqube
|
|
release: sonarqube
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
fsGroup: 0
|
|
initContainers:
|
|
- name: "wait-for-db"
|
|
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsGroup: 0
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
command: ["/bin/bash", "-c"]
|
|
args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonarqube-postgresql/5432) && exit 0; sleep 2;done; exit 1']
|
|
- name: init-sysctl
|
|
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
privileged: true
|
|
runAsUser: 0
|
|
command: ["/bin/bash", "-e", "/tmp/scripts/init_sysctl.sh"]
|
|
volumeMounts:
|
|
- name: init-sysctl
|
|
mountPath: /tmp/scripts/
|
|
env:
|
|
- name: SONAR_WEB_CONTEXT
|
|
value: "/"
|
|
- name: SONAR_WEB_JAVAOPTS
|
|
value: ""
|
|
- name: SONAR_CE_JAVAOPTS
|
|
value: ""
|
|
containers:
|
|
- name: sonarqube
|
|
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- name: http
|
|
containerPort: 9000
|
|
protocol: TCP
|
|
resources:
|
|
limits:
|
|
cpu: 800m
|
|
ephemeral-storage: 512000M
|
|
memory: 6144M
|
|
requests:
|
|
cpu: 400m
|
|
ephemeral-storage: 1536M
|
|
memory: 2048M
|
|
env:
|
|
- name: SONAR_HELM_CHART_VERSION
|
|
value: 10.6.0_3033
|
|
- name: SONAR_JDBC_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sonarqube-postgresql
|
|
key: postgresql-password
|
|
- name: SONAR_WEB_SYSTEMPASSCODE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sonarqube-sonarqube-monitoring-passcode
|
|
key: SONAR_WEB_SYSTEMPASSCODE
|
|
- name: SONAR_WEB_CONTEXT
|
|
value: "/"
|
|
- name: SONAR_WEB_JAVAOPTS
|
|
value: ""
|
|
- name: SONAR_CE_JAVAOPTS
|
|
value: ""
|
|
envFrom:
|
|
- configMapRef:
|
|
name: sonarqube-sonarqube-jdbc-config
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
wget --no-proxy --quiet -O /dev/null --timeout=1 --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://localhost:9000/api/system/liveness"
|
|
failureThreshold: 6
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 1
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
#!/bin/bash
|
|
# A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
|
|
# status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
|
|
if wget --no-proxy -qO- http://localhost:9000/api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
|
|
exit 0
|
|
fi
|
|
exit 1
|
|
failureThreshold: 6
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 1
|
|
startupProbe:
|
|
httpGet:
|
|
scheme: HTTP
|
|
path: /api/system/status
|
|
port: http
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
failureThreshold: 24
|
|
timeoutSeconds: 1
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsGroup: 0
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- mountPath: /opt/sonarqube/data
|
|
name: sonarqube
|
|
subPath: data
|
|
- mountPath: /opt/sonarqube/temp
|
|
name: sonarqube
|
|
subPath: temp
|
|
- mountPath: /opt/sonarqube/logs
|
|
name: sonarqube
|
|
subPath: logs
|
|
- mountPath: /tmp
|
|
name: tmp-dir
|
|
serviceAccountName: default
|
|
volumes:
|
|
- name: init-sysctl
|
|
configMap:
|
|
name: sonarqube-sonarqube-init-sysctl
|
|
items:
|
|
- key: init_sysctl.sh
|
|
path: init_sysctl.sh
|
|
- name: init-fs
|
|
configMap:
|
|
name: sonarqube-sonarqube-init-fs
|
|
items:
|
|
- key: init_fs.sh
|
|
path: init_fs.sh
|
|
- name: sonarqube
|
|
persistentVolumeClaim:
|
|
claimName: sonarqube-sonarqube
|
|
- name : tmp-dir
|
|
emptyDir:
|
|
{}
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
name: sonarqube-sonarqube
|
|
namespace: sonarqube
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: sc-monitoring
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
|
|
---
|
|
# Source: sonarqube/templates/tests/sonarqube-test.yaml
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: "sonarqube-ui-test"
|
|
namespace: sonarqube
|
|
annotations:
|
|
"helm.sh/hook": test-success
|
|
labels:
|
|
app: sonarqube
|
|
chart: sonarqube-10.6.0_3033
|
|
release: sonarqube
|
|
heritage: Helm
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: sonarqube-ui-test
|
|
image: "reg.inje-private.com/nnd002/sonarqube:10.6.0-community"
|
|
imagePullPolicy: IfNotPresent
|
|
command: ['wget']
|
|
args: [
|
|
'--retry-connrefused',
|
|
'--waitretry=1',
|
|
'--timeout=5',
|
|
'-t',
|
|
'12',
|
|
'-qO-',
|
|
'sonarqube-sonarqube:9000/api/system/status'
|
|
]
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
ephemeral-storage: 1000M
|
|
memory: 200M
|
|
requests:
|
|
cpu: 500m
|
|
ephemeral-storage: 100M
|
|
memory: 200M
|
|
restartPolicy: Never
|