sonarqube-persistent-template.yml

apiVersion: v1
kind: Template
metadata:
  name: "sonarqube"
objects:
- apiVersion: v1
  kind: ImageStream
  metadata:
    labels:
      app: code-scan
    name: code-scan
  spec:
    tags:
    - annotations:
        description: The SonarQube Docker image
        tags: code-scan
      from:
        kind: DockerImage
        name: docker.io/siamaksade/sonarqube:latest
      importPolicy: {}
      name: latest
- apiVersion: v1
  kind: Secret
  stringData:
    database-name: ${POSTGRES_DATABASE_NAME}
    database-password: ${POSTGRES_PASSWORD}
    database-user: ${POSTGRES_USERNAME}
  metadata:
    labels:
      app: code-scan
      template: postgresql-persistent-template
    name: code-scan-db
  type: Opaque
- apiVersion: v1
  stringData:
    password: ${SONAR_LDAP_BIND_PASSWORD}
    username: ${SONAR_LDAP_BIND_DN}
  kind: Secret
  metadata:
    name: codescan-ldap-bind-dn
  type: kubernetes.io/basic-auth
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: code-scan-data
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: ${SONARQUBE_PERSISTENT_VOLUME_SIZE}
  status: {}
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    generation: 1
    labels:
      app: code-scan
      template: postgresql-persistent-template
    name: code-scan-db
  spec:
    replicas: 1
    selector:
      name: code-scan-db
    strategy:
      activeDeadlineSeconds: 21600
      recreateParams:
        timeoutSeconds: 600
      resources: {}
      type: Recreate
    template:
      metadata:
        labels:
          name: code-scan-db
      spec:
        containers:
        - env:
          - name: POSTGRESQL_USER
            valueFrom:
              secretKeyRef:
                key: database-user
                name: code-scan-db
          - name: POSTGRESQL_PASSWORD
            valueFrom:
              secretKeyRef:
                key: database-password
                name: code-scan-db
          - name: POSTGRESQL_DATABASE
            valueFrom:
              secretKeyRef:
                key: database-name
                name: code-scan-db
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 5432
            timeoutSeconds: 1
          name: postgresql
          ports:
          - containerPort: 5432
            protocol: TCP
          readinessProbe:
            exec:
              command:
              - /bin/sh
              - -i
              - -c
              - psql -h 127.0.0.1 -U $POSTGRESQL_USER -q -d $POSTGRESQL_DATABASE -c
                'SELECT 1'
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              memory: ${POSTGRES_CONTAINER_MEMORY_SIZE_LIMIT}
              cpu: ${POSTGRES_CONTAINER_CPU_LIMIT}
            requests:
              memory: 1Gi
          securityContext:
            capabilities: {}
            privileged: false
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/lib/pgsql/data
            name: code-scan-db-data
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - name: code-scan-db-data
          persistentVolumeClaim:
            claimName: code-scan-db
    test: false
    triggers:
    - imageChangeParams:
        automatic: true
        containerNames:
          - postgresql
        from:
          kind: ImageStreamTag
          name: 'postgresql:9.6'
          namespace: openshift
      type: ImageChange
    - type: ConfigChange
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    generation: 1
    labels:
      app: code-scan
    name: code-scan
  spec:
    replicas: 1
    selector:
      app: code-scan
      deploymentconfig: code-scan
    strategy:
      activeDeadlineSeconds: 21600
      recreateParams:
        timeoutSeconds: 600
      type: Recreate
    template:
      metadata:
        labels:
          app: code-scan
          deploymentconfig: code-scan
      spec:
        containers:
        - env:
          - name: JDBC_URL
            value: jdbc:postgresql://code-scan-db:5432/sonar
          - name: JDBC_USERNAME
            valueFrom:
              secretKeyRef:
                key: database-user
                name: code-scan-db
          - name: JDBC_PASSWORD
            valueFrom:
              secretKeyRef:
                key: database-password
                name: code-scan-db
          - name: FORCE_AUTHENTICATION
            value: ${FORCE_AUTHENTICATION}
          - name: PROXY_HOST
            value: ${PROXY_HOST}
          - name: PROXY_PORT
            value: ${PROXY_PORT}
          - name: PROXY_USER
            value: ${PROXY_USER}
          - name: PROXY_PASSWORD
            value: ${PROXY_PASSWORD}
          - name: LDAP_URL
            value: ${SONAR_LDAP_URL}
          - name: LDAP_REALM
            value: ${SONAR_AUTH_REALM}
          - name: LDAP_AUTHENTICATION
            value: ${SONAR_LDAP_BIND_METHOD}
          - name: LDAP_USER_BASEDN
            value: ${SONAR_BASE_DN}
          - name: LDAP_USER_REAL_NAME_ATTR
            value: ${SONAR_LDAP_USER_REAL_NAME_ATTR}
          - name: LDAP_USER_EMAIL_ATTR
            value: ${SONAR_LDAP_USER_EMAIL_ATTR}
          - name: LDAP_USER_REQUEST
            value: ${SONAR_LDAP_USER_REQUEST}
          - name: LDAP_GROUP_BASEDN
            value: ${SONAR_LDAP_GROUP_BASEDN}
          - name: LDAP_GROUP_REQUEST
            value: ${SONAR_LDAP_GROUP_REQUEST}
          - name: LDAP_GROUP_ID_ATTR
            value: ${SONAR_LDAP_GROUP_ID_ATTR}
          - name: LDAP_CONTEXTFACTORY
            value: ${SONAR_LDAP_CONTEXTFACTORY}
          - name: SONAR_AUTOCREATE_USERS
            value: ${SONAR_AUTOCREATE_USERS}
          - name: LDAP_BINDDN
            valueFrom:
              secretKeyRef:
                key: username
                name: codescan-ldap-bind-dn
          - name: LDAP_BINDPASSWD
            valueFrom:
              secretKeyRef:
                key: password
                name: codescan-ldap-bind-dn
          imagePullPolicy: Always
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: 9000
              scheme: HTTP
            initialDelaySeconds: 45
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: code-scan
          ports:
          - containerPort: 9000
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: 9000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 200m
              memory: 1Gi
            limits:
              cpu: ${SONARQUBE_CPU_LIMIT}
              memory: ${SONARQUBE_MEMORY_LIMIT}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /opt/sonarqube/data
            name: sonar-data
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - name: sonar-data
          persistentVolumeClaim:
            claimName: code-scan-data
    test: false
    triggers:
    - imageChangeParams:
        automatic: true
        containerNames:
        - code-scan
        from:
          kind: ImageStreamTag
          name: code-scan:latest
      type: ImageChange
    - type: ConfigChange
- apiVersion: v1
  kind: Route
  metadata:
    labels:
      app: code-scan
    name: code-scan
  spec:
    port:
      targetPort: 9000-tcp
    tls:
      termination: edge
    to:
      kind: Service
      name: code-scan
      weight: 100
    wildcardPolicy: None
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      template.openshift.io/expose-uri: postgres://{.spec.clusterIP}:{.spec.ports[?(.name=="postgresql")].port}
    labels:
      app: code-scan
      template: postgresql-persistent-template
    name: code-scan-db
  spec:
    ports:
    - name: postgresql
      port: 5432
      protocol: TCP
      targetPort: 5432
    selector:
      name: code-scan-db
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app: code-scan
    name: code-scan
  spec:
    ports:
    - name: 9000-tcp
      port: 9000
      protocol: TCP
      targetPort: 9000
    selector:
      deploymentconfig: code-scan
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    labels:
      app: code-scan
      template: postgresql-persistent-template
    name: code-scan-db
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: ${POSTGRES_PERSISTENT_VOLUME_CLAIM_SIZE}
  status: {}
parameters:
  - description: Password for the Posgres Database to be used by Sonarqube
    displayName: Postgres password
    name: POSTGRES_PASSWORD
    generate: expression
    from: '[a-zA-Z0-9]{16}'
    required: true
  - description: Username for the Posgres Database to be used by Sonarqube
    displayName: Postgres username
    name: POSTGRES_USERNAME
    generate: expression
    from: 'user[a-z0-9]{8}'
    required: true
  - description: Database name for the Posgres Database to be used by Sonarqube
    displayName: Postgres database name
    name: POSTGRES_DATABASE_NAME
    value: sonar
    required: true
  - description: Postgres Persistent volume claim size
    displayName: Postgres Persistent volume claim size
    name: POSTGRES_PERSISTENT_VOLUME_CLAIM_SIZE
    value: 5Gi
    required: true
  - description: Postgres Container Memory size limit
    displayName: Postgres Container Memory size limit
    name: POSTGRES_CONTAINER_MEMORY_SIZE_LIMIT
    value: 1Gi
  - description: Postgres Container CPU limit
    displayName: Postgres Container CPU limit
    name: POSTGRES_CONTAINER_CPU_LIMIT
    value: "1"
  - name: SONARQUBE_MEMORY_LIMIT
    description: SonarQube memory
    displayName: SonarQube memory
    value: 2Gi
  - name: SONARQUBE_CPU_LIMIT
    description: SonarQube Container CPU limit
    displayName: SonarQube Container CPU limit
    value: "2"
  - name: SONARQUBE_PERSISTENT_VOLUME_SIZE
    description: The persistent storage volume for SonarQube to use for plugins/config/logs/etc...
    displayName: SonarQube Storage Space Size
    required: true
    value: 5Gi
  - name: FORCE_AUTHENTICATION
    displayName: Force authentication
    value: "false"
  - name: SONAR_AUTH_REALM
    value: ''
    description: The type of authentication that SonarQube should be using (None or LDAP) (Ref - https://docs.sonarqube.org/display/PLUG/LDAP+Plugin)
    displayName: SonarQube Authentication Realm
  - name: SONAR_AUTOCREATE_USERS
    value: 'false'
    description: When using an external authentication system, should SonarQube automatically create accounts for users?
    displayName: Enable auto-creation of users from external authentication systems?
    required: true
  - name: PROXY_HOST
    description: Hostname of proxy server the SonarQube application should use to access the Internet
    displayName: Proxy server hostname/IP
  - name: PROXY_PORT
    description: TCP port of proxy server the SonarQube application should use to access the Internet
    displayName: Proxy server port
  - name: PROXY_USER
    description: Username credential when the Proxy Server requires authentication
    displayName: Proxy server username
  - name: PROXY_PASSWORD
    description: Password credential when the Proxy Server requires authentication
    displayName: Proxy server password
  - name: SONAR_LDAP_BIND_DN
    description: When using LDAP authentication, this is the Distinguished Name used for binding to the LDAP server
    displayName: LDAP Bind DN
  - name: SONAR_LDAP_BIND_PASSWORD
    description: When using LDAP for authentication, this is the password with which to bind to the LDAP server
    displayName: LDAP Bind Password
  - name: SONAR_LDAP_URL
    description: When using LDAP for authentication, this is the URL of the LDAP server in the form of ldap(s)://<hostname>:<port>
    displayName: LDAP Server URL
  - name: SONAR_LDAP_REALM
    description: When using LDAP, this allows for specifying a Realm within the directory server (Usually not used)
    displayName: LDAP Realm
  - name: SONAR_LDAP_AUTHENTICATION
    description: When using LDAP, this is the bind method (simple, GSSAPI, kerberos, CRAM-MD5, DIGEST-MD5)
    displayName: LDAP Bind Mode
  - name: SONAR_LDAP_USER_BASEDN
    description: The Base DN under which SonarQube should search for user accounts in the LDAP directory
    displayName: LDAP User Base DN
  - name: SONAR_LDAP_USER_REAL_NAME_ATTR
    description: The LDAP attribute which should be referenced to get a user's full name
    displayName: LDAP Real Name Attribute
  - name: SONAR_LDAP_USER_EMAIL_ATTR
    description: The LDAP attribute which should be referenced to get a user's e-mail address
    displayName: LDAP User E-Mail Attribute
  - name: SONAR_LDAP_USER_REQUEST
    description: An LDAP filter to be used to search for user objects in the LDAP directory
    displayName: LDAP User Request Filter
  - name: SONAR_LDAP_GROUP_BASEDN
    description: The Base DN under which SonarQube should search for groups in the LDAP directory
    displayName: LDAP Group Base DN
  - name: SONAR_LDAP_GROUP_REQUEST
    description: An LDAP filter to be used to search for group objects in the LDAP directory
    displayName: LDAP Group Request Filter
  - name: SONAR_LDAP_GROUP_ID_ATTR
    description: The LDAP attribute which should be referenced to get a group's ID
    displayName: LDAP Group Name Attribute
  - name: SONAR_LDAP_CONTEXTFACTORY
    description: The ContextFactory implementation to be used when communicating with the LDAP server
    displayName: LDAP Context Factory
    value: com.sun.jndi.ldap.LdapCtxFactory