[stable/sonarqube] Add settings to toggle Elasticsearch bootstrap checks and node configuration (#17634)

* Add elasticsearch.configureNode setting to enable/disable modification of worker node on pod start to conform to Elasticsearch requirements.  Add elasticsearch.bootstrapChecks to enable/disable the bootstrap checks Elasticsearch does on the host.

Signed-off-by: Chris Suran <suran.c@gmail.com>

* Increment chart version to 2.4.0

Signed-off-by: Chris Suran <suran.c@gmail.com>

stable/sonarqube/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: sonarqube
 description: Sonarqube is an open sourced code quality scanning tool
-version: 3.1.0
+version: 3.2.0
 appVersion: 7.9.1
 keywords:
   - coverage

stable/sonarqube/README.md

@@ -46,6 +46,8 @@ The following table lists the configurable parameters of the Sonarqube chart and
 | `image.pullPolicy`                          | Image pull policy                         | `IfNotPresent`                             |
 | `image.pullSecret`                          | imagePullSecret to use for private repository      |                                   |
 | `command`                                   | command to run in the container           | `nil` (need to be set prior to 6.7.6, and 7.4)      |
+| `elasticsearch.configureNode`               | Modify k8s worker to conform to system requirements | `true`                           |
+| `elasticsearch.bootstrapChecks`             | Enables/disables Elasticsearch bootstrap checks | `true`                               |
 | `securityContext.fsGroup`                   | Group applied to mounted directories/files|  `999`                                     |
 | `ingress.enabled`                           | Flag for enabling ingress                 | false                                      |
 | `ingress.labels`                            | Ingress additional labels                 | `{}`                                       |
@@ -135,3 +137,15 @@ In environments with air-gapped setup, especially with internal tooling (repos)
       enabled: false
       secretName: my-cacerts
    ```
+
+### Elasticsearch Settings
+
+Since SonarQube comes bundled with an Elasticsearch instance, some [bootstrap checks](https://www.elastic.co/guide/en/elasticsearch/reference/master/bootstrap-checks.html) of the host settings are done at start.
+
+This chart offers the option to use an initContainer in privilaged mode to automatically set certain kernel settings on the kube worker.  While this can ensure proper functionality of Elasticsearch, modifying the underlying kernel settings on the Kubernetes node can impact other users.  It may be best to work with your cluster administrator to either provide specific nodes with the proper kernel settings, or ensure they are set cluster wide.
+
+To enable auto-configuration of the kube worker node, set `elasticsearch.configureNode` to `true`
+
+This will run `sysctl -w vm.max_map_count=262144` on the worker where the sonarqube pod(s) get scheduled.  This needs to be set to `262144` but normally defaults to `65530`.  Other kernel settings are recommended by the [docker image](https://hub.docker.com/_/sonarqube/#requirements), but the defaults work fine in most cases.
+
+Note that if node configuration is not enabled, then you will likely need to disable the Elasticsearch bootstrap checks.  These can be explicitly enabled by setting `elasticsearch.bootstrapChecks` to `false`.

stable/sonarqube/templates/config.yaml

@@ -9,14 +9,17 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 data:
-  {{- if and .Values.sonarSecretKey (not .Values.sonarProperties) }}
+  {{- if and .Values.sonarSecretKey (not .Values.sonarProperties) (not .Values.elasticsearch.bootstrapChecks) }}
   sonar.properties: sonar.secretKeyPath=/opt/sonarqube/secret/sonar-secret.txt
   {{- end }}
-  {{- if .Values.sonarProperties }}
+  {{- if or .Values.sonarProperties (not .Values.elasticsearch.bootstrapChecks) }}
   sonar.properties:
   {{ range $key, $val := .Values.sonarProperties }}
     {{ $key }}={{ $val }}
   {{ end }}
+  {{- if not .Values.elasticsearch.bootstrapChecks }}
+    sonar.es.bootstrap.checks.disable=true
+  {{- end }}
   {{- end }}
     {{- if and .Values.sonarSecretKey .Values.sonarProperties }}
       sonar.secretKeyPath=/opt/sonarqube/secret/sonar-secret.txt

stable/sonarqube/templates/deployment.yaml

@@ -35,6 +35,7 @@ spec:
       securityContext:
 {{ toYaml .Values.securityContext | indent 8 }}
       initContainers:
+      {{- if .Values.elasticsearch.configureNode }}
         - name: init-sysctl
           image: {{ default "busybox:1.31" .Values.plugins.initSysctlContainerImage }}
           command:
@@ -44,6 +45,7 @@ spec:
           imagePullPolicy: IfNotPresent
           securityContext:
             privileged: true
+      {{- end }}
       {{- if .Values.plugins.install }}
         - name: install-plugins
           image: {{ default "joosthofman/wget:1.0" .Values.plugins.initContainerImage }}
@@ -143,7 +145,7 @@ spec:
             periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
             failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
           volumeMounts:
-            {{- if .Values.sonarProperties }}
+            {{- if or .Values.sonarProperties (not .Values.elasticsearch.bootstrapChecks) }}
             - mountPath: /opt/sonarqube/conf/
               name: config
             {{- end }}
@@ -193,7 +195,7 @@ spec:
 {{ toYaml .Values.affinity | indent 8 }}
     {{- end }}
       volumes:
-      {{- if .Values.sonarProperties }}
+      {{- if or .Values.sonarProperties (not .Values.elasticsearch.bootstrapChecks) }}
       - name: config
         configMap:
           name: {{ template "sonarqube.fullname" . }}-config

stable/sonarqube/values.yaml

@@ -16,6 +16,11 @@ image:
 securityContext:
   fsGroup: 999
 
+# Settings to configure elasticsearch host requirements
+elasticsearch:
+  configureNode: true
+  bootstrapChecks: true
+
 service:
   type: ClusterIP
   externalPort: 9000