fix

2024-02-23 13:48:07 +01:00
parent 08e71d69cd
commit 818a21befc
28 changed files with 948 additions and 896 deletions
--- a/apps/sonar/apps_v1_StatefulSet_sonar-sonarqube.yaml
+++ b/apps/sonar/apps_v1_StatefulSet_sonar-sonarqube.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
    app.kubernetes.io/name: sonarqube-sonar-sonarqube
@@ -13,9 +13,10 @@ metadata:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: sonarqube
    app.kubernetes.io/component: sonar-sonarqube
-    app.kubernetes.io/version: "10.2.1-community"
+    app.kubernetes.io/version: "10.4.0-community"
 spec:
  replicas: 1
+  revisionHistoryLimit: 10
  serviceName: sonar-sonarqube
  selector:
    matchLabels:
@@ -27,42 +28,61 @@ spec:
        app: sonarqube
        release: sonar
      annotations:
-        checksum/init-sysctl: cee36a3c219877f5e5283c33ac42dd45ab515536473d11327c3fb16451fcf389
-        checksum/init-fs: e91ea63db7f365c895f20cd1aa88f5ddbfcc2673527e33ba18b7f0dcb21d8699
-        checksum/plugins: 81e69508572a0af41c9f523d7e3fa65c76d7808be29b9313b6d627230c64837f
-        checksum/config: 62f22fcd909503d99971789b55a68daa5265a47a2d16a30943a6b01c8510978f
-        checksum/secret: 6bc1c9a02ff03ca932d573bccf2803e0b3a46df7466f4cdff80a3716fab6c5f2
-        checksum/prometheus-config: f7ab66f106b162963a4b644166c9755dd34eca76f8bbe57e4d11ce61e7e055af
-        checksum/prometheus-ce-config: 767e03641f6a1999c70f373b40fc2a348a36697cfc75a97d245021e68d30606a
+        checksum/init-sysctl: a12e75ed1a8c3b06d9caf75f108948bde1e6cf6210bb3035994c8d4fdb9e1f39
+        checksum/init-fs: 36564fb78d2715ef7f589fd3df9b29b970835c4f265186a47fbb0f1f8ce35c7e
+        checksum/plugins: db3ffc7959ef0fc65edbd6803efe5cfa5bed57043487c5d29af43708459ce9fd
+        checksum/config: ead0105b73e0ab65eebc0f041f2c07af74aab9f4e121ada0b788b5e287bc1132
+        checksum/secret: 14fc9b43c5d5c61345694c7c8a2cab4fdee67d198dfec45498f58eb7a30b283d
+        checksum/prometheus-config: 79e17e350acb6b7a07c0204a52a6fe22bcb4c38b9f8339d15757f040698774dc
+        checksum/prometheus-ce-config: ef57c8341973db7eb712730278966b61b4aa23721f65f5e0e51a9012a6a7b28b
    spec:      
      securityContext:
-        fsGroup: 1000
+        fsGroup: 0
      initContainers:
        - name: "wait-for-db"
-          image: busybox:1.32
+          image: sonarqube:10.4.0-community
          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 0
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
          resources:
            {}
-          command: ["/bin/sh", "-c", "for i in $(seq 1 200); do nc -z -w3 sonar-postgresql 5432 && exit 0 || sleep 2; done; exit 1"]
+          command: ["/bin/bash", "-c"]
+          args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonar-postgresql/5432) && exit 0; sleep 2;done; exit 1']
        - name: init-sysctl
-          image: busybox:1.32
+          image: sonarqube:10.4.0-community
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
+            runAsUser: 0
          resources:
            {}
-          command: ["sh",
+          command: ["/bin/bash",
            "-e",
            "/tmp/scripts/init_sysctl.sh"]
          volumeMounts:
            - name: init-sysctl
              mountPath: /tmp/scripts/
        - name: inject-prometheus-exporter
-          image: curlimages/curl:8.2.0
+          image: sonarqube:10.4.0-community
          imagePullPolicy: IfNotPresent
          securityContext:
-            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 0
+            runAsNonRoot: true
            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
          resources:
            {}
          command: ["/bin/sh","-c"]
@@ -79,7 +99,7 @@ spec:
            - name: no_proxy
              value: 
        - name: install-plugins
-          image: curlimages/curl:8.2.0
+          image: sonarqube:10.4.0-community
          imagePullPolicy: IfNotPresent
          command: ["sh",
            "-e",
@@ -91,8 +111,15 @@ spec:
            - name: install-plugins
              mountPath: /tmp/scripts/
          securityContext:
-            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 0
+            runAsNonRoot: true
            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
          resources:
            {}
          env:
@@ -104,7 +131,7 @@ spec:
              value: 
      containers:
        - name: sonarqube
-          image: "sonarqube:10.2.1-community"
+          image: sonarqube:10.4.0-community
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -125,7 +152,7 @@ spec:
              memory: 2Gi
          env:
            - name: SONAR_HELM_CHART_VERSION
-              value: 10.2.1_800
+              value: 10.4.0_2288
            - name: SONAR_WEB_JAVAOPTS
              value: "-javaagent:/opt/sonarqube/data/jmx_prometheus_javaagent.jar=8000:/opt/sonarqube/conf/prometheus-config.yaml"
            - name: SONAR_WEB_CONTEXT
@@ -185,7 +212,15 @@ spec:
            failureThreshold: 24
            timeoutSeconds: 1
          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 0
+            runAsNonRoot: true
            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
          volumeMounts:
            - mountPath: /opt/sonarqube/data
              name: sonarqube
--- a/apps/sonar/index.yaml
+++ b/apps/sonar/index.yaml
@@ -4,18 +4,36 @@ kind: Component
 category: apps
 metadata:
  name: sonar
-  description: null
+  description: The code quality tool for better code
 options:
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
+  plugins:
+    default:
+    - https://github.com/vaulttec/sonar-auth-oidc/releases/download/v2.1.1/sonar-auth-oidc-plugin-2.1.1.jar
+    - https://github.com/jycr/sonar-l10n-fr/releases/download/9.9.0/sonar-l10n-fr-plugin-9.9.0.jar
+    - https://github.com/sbaudoin/sonar-yaml/releases/download/v1.7.0/sonar-yaml-plugin-1.7.0.jar
+    - https://github.com/sbaudoin/sonar-shellcheck/releases/download/v2.5.0/sonar-shellcheck-plugin-2.5.0.jar
+    - https://github.com/cnescatlab/sonar-hadolint-plugin/releases/download/1.1.0/sonar-hadolint-plugin-1.1.0.jar
+    - https://github.com/sbaudoin/sonar-ansible/releases/download/v2.5.1/sonar-ansible-extras-plugin-2.5.1.jar
+    examples:
+    - - https://github.com/vaulttec/sonar-auth-oidc/releases/download/v2.1.1/sonar-auth-oidc-plugin-2.1.1.jar
+      - https://github.com/jycr/sonar-l10n-fr/releases/download/9.9.0/sonar-l10n-fr-plugin-9.9.0.jar
+      - https://github.com/sbaudoin/sonar-yaml/releases/download/v1.7.0/sonar-yaml-plugin-1.7.0.jar
+      - https://github.com/sbaudoin/sonar-shellcheck/releases/download/v2.5.0/sonar-shellcheck-plugin-2.5.0.jar
+      - https://github.com/cnescatlab/sonar-hadolint-plugin/releases/download/1.1.0/sonar-hadolint-plugin-1.1.0.jar
+      - https://github.com/sbaudoin/sonar-ansible/releases/download/v2.5.1/sonar-ansible-extras-plugin-2.5.1.jar
+    items:
+      type: string
+    type: array
  ingress_class:
    default: traefik
    examples:
    - traefik
    type: string
-  sub_domain:
-    default: sonar
-    examples:
-    - sonar
-    type: string
  images:
    default:
      sonar:
@@ -55,38 +73,20 @@ options:
            type: string
        type: object
    type: object
-  plugins:
-    default:
-    - https://github.com/vaulttec/sonar-auth-oidc/releases/download/v2.1.1/sonar-auth-oidc-plugin-2.1.1.jar
-    - https://github.com/jycr/sonar-l10n-fr/releases/download/9.9.0/sonar-l10n-fr-plugin-9.9.0.jar
-    - https://github.com/sbaudoin/sonar-yaml/releases/download/v1.7.0/sonar-yaml-plugin-1.7.0.jar
-    - https://github.com/sbaudoin/sonar-shellcheck/releases/download/v2.5.0/sonar-shellcheck-plugin-2.5.0.jar
-    - https://github.com/cnescatlab/sonar-hadolint-plugin/releases/download/1.1.0/sonar-hadolint-plugin-1.1.0.jar
-    - https://github.com/sbaudoin/sonar-ansible/releases/download/v2.5.1/sonar-ansible-extras-plugin-2.5.1.jar
-    examples:
-    - - https://github.com/vaulttec/sonar-auth-oidc/releases/download/v2.1.1/sonar-auth-oidc-plugin-2.1.1.jar
-      - https://github.com/jycr/sonar-l10n-fr/releases/download/9.9.0/sonar-l10n-fr-plugin-9.9.0.jar
-      - https://github.com/sbaudoin/sonar-yaml/releases/download/v1.7.0/sonar-yaml-plugin-1.7.0.jar
-      - https://github.com/sbaudoin/sonar-shellcheck/releases/download/v2.5.0/sonar-shellcheck-plugin-2.5.0.jar
-      - https://github.com/cnescatlab/sonar-hadolint-plugin/releases/download/1.1.0/sonar-hadolint-plugin-1.1.0.jar
-      - https://github.com/sbaudoin/sonar-ansible/releases/download/v2.5.1/sonar-ansible-extras-plugin-2.5.1.jar
-    items:
-      type: string
-    type: array
-  domain:
-    default: your-company
-    examples:
-    - your-company
-    type: string
  domain_name:
    default: your_company.com
    examples:
    - your_company.com
    type: string
-  issuer:
-    default: letsencrypt-prod
+  sub_domain:
+    default: sonar
    examples:
-    - letsencrypt-prod
+    - sonar
+    type: string
+  domain:
+    default: your-company
+    examples:
+    - your-company
    type: string
 dependencies: []
 providers:
@@ -94,6 +94,7 @@ providers:
  authentik: true
  kubectl: true
  postgresql: null
+  mysql: null
  restapi: null
  http: null
  gitea: null
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-config.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-config.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-config
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-init-fs.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-init-fs.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-init-fs
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-init-sysctl.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-init-sysctl.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-init-sysctl
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-install-plugins.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-install-plugins.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-install-plugins
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-jdbc-config.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-jdbc-config.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-jdbc-config
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-prometheus-ce-config.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-prometheus-ce-config.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-prometheus-ce-config
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_ConfigMap_sonar-sonarqube-prometheus-config.yaml
+++ b/apps/sonar/v1_ConfigMap_sonar-sonarqube-prometheus-config.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube-prometheus-config
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 data:
--- a/apps/sonar/v1_Secret_sonar-sonarqube-monitoring-passcode.yaml
+++ b/apps/sonar/v1_Secret_sonar-sonarqube-monitoring-passcode.yaml
@@ -4,7 +4,7 @@ metadata:
  name: sonar-sonarqube-monitoring-passcode
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm
 type: Opaque
--- a/apps/sonar/v1_Service_sonar-sonarqube.yaml
+++ b/apps/sonar/v1_Service_sonar-sonarqube.yaml
@@ -5,7 +5,7 @@ metadata:
  name: sonar-sonarqube
  labels:
    app: sonarqube
-    chart: sonarqube-10.2.1_800
+    chart: sonarqube-10.4.0_2288
    release: sonar
    heritage: Helm