[stable/sonarqube] Option for settings encryption secret (#11419)

Add another option to use a Kubernetes Secret for settings
encryption by setting the the sonar.secretKeyPath property
and mounting the actual secret file as a volume.

Signed-off-by: Jannis Oeltjen <oss@jcoeltjen.de>

stable/sonarqube/Chart.yaml

@@ -1,6 +1,6 @@
 name: sonarqube
 description: Sonarqube is an open sourced code quality scanning tool
-version: 0.14.1
+version: 0.15.0
 appVersion: 7.6
 keywords:
   - coverage

stable/sonarqube/README.md

@@ -60,6 +60,7 @@ The following table lists the configurable parameters of the Sonarqube chart and
 | `persistence.accessMode`                    | Volumes access mode to be set             | `ReadWriteOnce`                            |
 | `persistence.size`                          | Size of the volume                        | None                                     |
 | `sonarProperties`                           | Custom `sonar.properties` file            | None                                       |
+| `sonarSecretKey`                            | Name of existing secret used for settings encryption | None                            |
 | `database.type`                             | Set to "mysql" to use mysql database       | `postgresql`|
 | `postgresql.enabled`                        | Set to `false` to use external server / mysql database     | `true`                                     |
 | `postgresql.postgresServer`                 | Hostname of the external Postgresql server| `null`                                     |

stable/sonarqube/templates/config.yaml

@@ -9,7 +9,13 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 data:
+  {{- if and .Values.sonarSecretKey (not .Values.sonarProperties) }}
+  sonar.properties: sonar.secretKeyPath=/opt/sonarqube/secret/sonar-secret.txt    
+  {{- end }}
   {{- if .Values.sonarProperties }}
   sonar.properties:
-{{ toYaml .Values.sonarProperties | indent 4}}
-  {{- end}}
+{{ toYaml .Values.sonarProperties | indent 4 }}
+  {{- end }}
+    {{- if and .Values.sonarSecretKey .Values.sonarProperties }}
+      sonar.secretKeyPath=/opt/sonarqube/secret/sonar-secret.txt
+    {{- end }}

stable/sonarqube/templates/deployment.yaml

@@ -119,6 +119,10 @@ spec:
             - mountPath: /opt/sonarqube/conf/
               name: config
             {{- end }}
+            {{- if .Values.sonarSecretKey }}
+            - mountPath: /opt/sonarqube/secret/
+              name: secret
+            {{- end }}
             - mountPath: /opt/sonarqube/data
               name: sonarqube
               subPath: data
@@ -150,6 +154,14 @@ spec:
           - key: sonar.properties
             path: sonar.properties
       {{- end }}
+      {{- if .Values.sonarSecretKey }}
+      - name: secret
+        secret: 
+          secretName: {{ .Values.sonarSecretKey }}
+          items:
+          - key: sonar-secret.txt
+            path: sonar-secret.txt
+      {{- end }}
       - name: install-plugins
         configMap:
           name: {{ template "sonarqube.fullname" . }}-install-plugins

stable/sonarqube/values.yaml

@@ -126,6 +126,11 @@ plugins:
 #   sonar.security.realm=LDAP
 #   ldap.url=ldaps://organization.com
 
+# Kubernetes secret that contains the encryption key for the sonarqube instance.
+# The secret must contain the key 'sonar-secret.txt'.
+# The 'sonar.secretKeyPath' property will be set automatically.
+# sonarSecretKey: "settings-encryption-secret"
+
 ## Configuration value to select database type
 ## Option to use "postgresql" or "mysql" database type, by default "postgresql" is chosen
 ## Set the "enable" field to true of the database type you select (if you want to use internal database) and false of the one you don't select