apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: sonarqube
  name: sonarqube
spec:
  finalizers:
  - kubernetes
---
# Source: sonarqube/charts/postgresql/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: sonarqube-postgresql
  namespace: sonarqube
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.15.0
    app.kubernetes.io/instance: sonarqube
    app.kubernetes.io/managed-by: Helm
  namespace: sonarqube
type: Opaque
data:
  postgresql-postgres-password: "YjlLdzZzWVlYOQ=="
  postgresql-password: "c29uYXJQYXNz"
---
# Source: sonarqube/templates/secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: sonarqube-sonarqube-monitoring-passcode
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
type: Opaque
data:
  SONAR_WEB_SYSTEMPASSCODE: "ZGVmaW5lX2l0"
---
# Source: sonarqube/templates/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sonarqube-sonarqube-config
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
data:
  sonar.properties: |
---
# Source: sonarqube/templates/init-fs.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sonarqube-sonarqube-init-fs
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
data:
  init_fs.sh: |-
---
# Source: sonarqube/templates/init-sysctl.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sonarqube-sonarqube-init-sysctl
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
data:
  init_sysctl.sh: |-
    if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
      sysctl -w vm.max_map_count=524288
    fi
    if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
      sysctl -w fs.file-max=131072
    fi
    if [[ "$(ulimit -n)" != "unlimited" ]]; then
      if [[ "$(ulimit -n)" -lt 131072 ]]; then
        echo "ulimit -n 131072"
        ulimit -n 131072
      fi
    fi
    if [[ "$(ulimit -u)" != "unlimited" ]]; then
      if [[ "$(ulimit -u)" -lt 8192 ]]; then
        echo "ulimit -u 8192"
        ulimit -u 8192
      fi
    fi
---
# Source: sonarqube/templates/install-plugins.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sonarqube-sonarqube-install-plugins
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
data:
  install_plugins.sh: |-
---
# Source: sonarqube/templates/jdbc-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sonarqube-sonarqube-jdbc-config
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
data:
  SONAR_JDBC_USERNAME: "sonarUser"
  SONAR_JDBC_URL: "jdbc:postgresql://sonarqube-postgresql:5432/sonarDB"
---
# Source: sonarqube/charts/postgresql/templates/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: sonarqube-postgresql-headless
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.15.0
    app.kubernetes.io/instance: sonarqube
    app.kubernetes.io/managed-by: Helm
    # Use this annotation in addition to the actual publishNotReadyAddresses
    # field below because the annotation will stop being respected soon but the
    # field is broken in some versions of Kubernetes:
    # https://github.com/kubernetes/kubernetes/issues/58662
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
  namespace: sonarqube
spec:
  type: ClusterIP
  clusterIP: None
  # We want all pods in the StatefulSet to have their addresses published for
  # the sake of the other Postgresql pods even before they're ready, since they
  # have to be able to talk to each other in order to become ready.
  publishNotReadyAddresses: true
  ports:
    - name: tcp-postgresql
      port: 5432
      targetPort: tcp-postgresql
  selector:
    app.kubernetes.io/name: postgresql
    app.kubernetes.io/instance: sonarqube
---
# Source: sonarqube/charts/postgresql/templates/svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: sonarqube-postgresql
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.15.0
    app.kubernetes.io/instance: sonarqube
    app.kubernetes.io/managed-by: Helm
  annotations:
  namespace: sonarqube
spec:
  type: ClusterIP
  ports:
    - name: tcp-postgresql
      port: 5432
      targetPort: tcp-postgresql
  selector:
    app.kubernetes.io/name: postgresql
    app.kubernetes.io/instance: sonarqube
    role: primary
---
# Source: sonarqube/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: sonarqube-sonarqube
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
spec:
  type: ClusterIP
  ports:
    - port: 9000
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app: sonarqube
    release: sonarqube
---
# Source: sonarqube/charts/postgresql/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sonarqube-postgresql
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.15.0
    app.kubernetes.io/instance: sonarqube
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
  annotations:
  namespace: sonarqube
spec:
  serviceName: sonarqube-postgresql-headless
  replicas: 1
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/name: postgresql
      app.kubernetes.io/instance: sonarqube
      role: primary
  template:
    metadata:
      name: sonarqube-postgresql
      labels:
        app.kubernetes.io/name: postgresql
        helm.sh/chart: postgresql-10.15.0
        app.kubernetes.io/instance: sonarqube
        app.kubernetes.io/managed-by: Helm
        role: primary
        app.kubernetes.io/component: primary
    spec:      
      affinity:
        podAffinity:
          
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: postgresql
                    app.kubernetes.io/instance: sonarqube
                    app.kubernetes.io/component: primary
                namespaces:
                  - "sonarqube"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:
          
      securityContext:
        fsGroup: 1001
      automountServiceAccountToken: false
      containers:
        - name: sonarqube-postgresql
          image: reg.inje-private.com/nnd002/bitnami/postgresql:11.14.0-debian-10-r22
          imagePullPolicy: "IfNotPresent"
          resources:
            limits:
              cpu: 2
              memory: 2Gi
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1001
            seccompProfile:
              type: RuntimeDefault
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: POSTGRESQL_PORT_NUMBER
              value: "5432"
            - name: POSTGRESQL_VOLUME_DIR
              value: "/bitnami/postgresql"
            - name: PGDATA
              value: "/bitnami/postgresql/data"
            - name: POSTGRES_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sonarqube-postgresql
                  key: postgresql-postgres-password
            - name: POSTGRES_USER
              value: "sonarUser"
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sonarqube-postgresql
                  key: postgresql-password
            - name: POSTGRES_DB
              value: "sonarDB"
            - name: POSTGRESQL_ENABLE_LDAP
              value: "no"
            - name: POSTGRESQL_ENABLE_TLS
              value: "no"
            - name: POSTGRESQL_LOG_HOSTNAME
              value: "false"
            - name: POSTGRESQL_LOG_CONNECTIONS
              value: "false"
            - name: POSTGRESQL_LOG_DISCONNECTIONS
              value: "false"
            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
              value: "off"
            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
              value: "error"
            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
              value: "pgaudit"
          ports:
            - name: tcp-postgresql
              containerPort: 5432
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - -e
                - |
                  exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
                  [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          volumeMounts:
            - name: dshm
              mountPath: /dev/shm
            - name: data
              mountPath: /bitnami/postgresql
              subPath: 
      volumes:
        - name: dshm
          emptyDir:
            medium: Memory
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "20Gi"
---
# Source: sonarqube/templates/sonarqube-sts.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sonarqube-sonarqube
  namespace: sonarqube
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
    app.kubernetes.io/name: sonarqube-sonarqube-sonarqube
    app.kubernetes.io/instance: sonarqube
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: sonarqube
    app.kubernetes.io/component: sonarqube-sonarqube
    app.kubernetes.io/version: "10.6.0-community"
spec:
  replicas: 1
  revisionHistoryLimit: 10
  serviceName: sonarqube-sonarqube
  selector:
    matchLabels:
      app: sonarqube
      release: sonarqube
  template:
    metadata:
      annotations:
        checksum/config: 2256323f7d9ffc8a4e18606aa35e18a28b05412806a19e4e6a15359f9b710ad0
        checksum/init-fs: 915551fa9592e2d81312781f423a59e6ba0837510c2e1d996e899eecd057ee91
        checksum/init-sysctl: 7aa0dd9441283780322cf0596f09a398219af7dd756fcead24179a08adcebc32
        checksum/plugins: 14cc0e459ae2f5de6499309b22cfdbcc1452d9e0e4f01a0ea45a43793e95e550
        checksum/secret: b433376554b78de7ccf285d4ffebc8759355e6916f285189ce33ba1eba4ba28a
      labels:
        app: sonarqube
        release: sonarqube
    spec:
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 0
      initContainers:
        - name: "wait-for-db"
          image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          command: ["/bin/bash", "-c"]
          args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonarqube-postgresql/5432) && exit 0; sleep 2;done; exit 1']
        - name: init-sysctl
          image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
            runAsUser: 0
          command: ["/bin/bash", "-e", "/tmp/scripts/init_sysctl.sh"]
          volumeMounts:
            - name: init-sysctl
              mountPath: /tmp/scripts/
          env:
            - name: SONAR_WEB_CONTEXT
              value: "/"
            - name: SONAR_WEB_JAVAOPTS
              value: ""
            - name: SONAR_CE_JAVAOPTS
              value: ""
      containers:
        - name: sonarqube
          image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 9000
              protocol: TCP
          resources:
            limits:
              cpu: 800m
              ephemeral-storage: 512000M
              memory: 6144M
            requests:
              cpu: 400m
              ephemeral-storage: 1536M
              memory: 2048M
          env:
            - name: SONAR_HELM_CHART_VERSION
              value: 10.6.0_3033
            - name: SONAR_JDBC_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sonarqube-postgresql
                  key: postgresql-password
            - name: SONAR_WEB_SYSTEMPASSCODE
              valueFrom:
                secretKeyRef:
                  name: sonarqube-sonarqube-monitoring-passcode
                  key: SONAR_WEB_SYSTEMPASSCODE
            - name: SONAR_WEB_CONTEXT
              value: "/"
            - name: SONAR_WEB_JAVAOPTS
              value: ""
            - name: SONAR_CE_JAVAOPTS
              value: ""
          envFrom:
            - configMapRef:
                name: sonarqube-sonarqube-jdbc-config
          livenessProbe:
            exec:
              command:
              - sh
              - -c
              - |
                wget --no-proxy --quiet -O /dev/null --timeout=1 --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://localhost:9000/api/system/liveness"
            failureThreshold: 6
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 1
          readinessProbe:
            exec:
              command:
              - sh
              - -c
              - |
                #!/bin/bash
                # A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
                # status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
                if wget --no-proxy -qO- http://localhost:9000/api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
                  exit 0
                fi
                exit 1
            failureThreshold: 6
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 1
          startupProbe:
            httpGet:
              scheme: HTTP
              path: /api/system/status
              port: http
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 24
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - mountPath: /opt/sonarqube/data
              name: sonarqube
              subPath: data
            - mountPath: /opt/sonarqube/temp
              name: sonarqube
              subPath: temp
            - mountPath: /opt/sonarqube/logs
              name: sonarqube
              subPath: logs
            - mountPath: /tmp
              name: tmp-dir
      serviceAccountName: default
      volumes:
        - name: init-sysctl
          configMap:
            name: sonarqube-sonarqube-init-sysctl
            items:
              - key: init_sysctl.sh
                path: init_sysctl.sh
        - name: init-fs
          configMap:
            name: sonarqube-sonarqube-init-fs
            items:
              - key: init_fs.sh
                path: init_fs.sh
        - name: sonarqube
          persistentVolumeClaim:
            claimName: sonarqube-sonarqube
        - name : tmp-dir
          emptyDir:
            {}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
  name: sonarqube-sonarqube
  namespace: sonarqube
spec:
  accessModes:
  - ReadWriteMany
  storageClassName: sc-monitoring
  resources:
    requests:
      storage: 20Gi

---
# Source: sonarqube/templates/tests/sonarqube-test.yaml
apiVersion: v1
kind: Pod
metadata:
  name: "sonarqube-ui-test"
  namespace: sonarqube
  annotations:
    "helm.sh/hook": test-success
  labels:
    app: sonarqube
    chart: sonarqube-10.6.0_3033
    release: sonarqube
    heritage: Helm
spec:
  automountServiceAccountToken: false
  containers:
    - name: sonarqube-ui-test
      image: "reg.inje-private.com/nnd002/sonarqube:10.6.0-community"
      imagePullPolicy: IfNotPresent
      command: ['wget']
      args: [
        '--retry-connrefused',
        '--waitretry=1',
        '--timeout=5',
        '-t',
        '12',
        '-qO-',
        'sonarqube-sonarqube:9000/api/system/status'
        ]
      resources:
        limits:
          cpu: 500m
          ephemeral-storage: 1000M
          memory: 200M
        requests:
          cpu: 500m
          ephemeral-storage: 100M
          memory: 200M
  restartPolicy: Never