From 6c8bcba789238a41ea9e64c8f80447a457a06a3e Mon Sep 17 00:00:00 2001 From: Chris Suran Date: Tue, 22 Oct 2019 10:39:22 -0400 Subject: [PATCH] [stable/sonarqube] Add settings to toggle Elasticsearch bootstrap checks and node configuration (#17634) * Add elasticsearch.configureNode setting to enable/disable modification of worker node on pod start to conform to Elasticsearch requirements. Add elasticsearch.bootstrapChecks to enable/disable the bootstrap checks Elasticsearch does on the host. Signed-off-by: Chris Suran * Increment chart version to 2.4.0 Signed-off-by: Chris Suran --- stable/sonarqube/Chart.yaml | 2 +- stable/sonarqube/README.md | 14 ++++++++++++++ stable/sonarqube/templates/config.yaml | 7 +++++-- stable/sonarqube/templates/deployment.yaml | 6 ++++-- stable/sonarqube/values.yaml | 5 +++++ 5 files changed, 29 insertions(+), 5 deletions(-) diff --git a/stable/sonarqube/Chart.yaml b/stable/sonarqube/Chart.yaml index d7e92971d5..fb166fb3db 100644 --- a/stable/sonarqube/Chart.yaml +++ b/stable/sonarqube/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: sonarqube description: Sonarqube is an open sourced code quality scanning tool -version: 3.1.0 +version: 3.2.0 appVersion: 7.9.1 keywords: - coverage diff --git a/stable/sonarqube/README.md b/stable/sonarqube/README.md index d71856a154..d19f24e4fd 100644 --- a/stable/sonarqube/README.md +++ b/stable/sonarqube/README.md @@ -46,6 +46,8 @@ The following table lists the configurable parameters of the Sonarqube chart and | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecret` | imagePullSecret to use for private repository | | | `command` | command to run in the container | `nil` (need to be set prior to 6.7.6, and 7.4) | +| `elasticsearch.configureNode` | Modify k8s worker to conform to system requirements | `true` | +| `elasticsearch.bootstrapChecks` | Enables/disables Elasticsearch bootstrap checks | `true` | | `securityContext.fsGroup` | Group applied to mounted directories/files| `999` | | `ingress.enabled` | Flag for enabling ingress | false | | `ingress.labels` | Ingress additional labels | `{}` | @@ -135,3 +137,15 @@ In environments with air-gapped setup, especially with internal tooling (repos) enabled: false secretName: my-cacerts ``` + +### Elasticsearch Settings + +Since SonarQube comes bundled with an Elasticsearch instance, some [bootstrap checks](https://www.elastic.co/guide/en/elasticsearch/reference/master/bootstrap-checks.html) of the host settings are done at start. + +This chart offers the option to use an initContainer in privilaged mode to automatically set certain kernel settings on the kube worker. While this can ensure proper functionality of Elasticsearch, modifying the underlying kernel settings on the Kubernetes node can impact other users. It may be best to work with your cluster administrator to either provide specific nodes with the proper kernel settings, or ensure they are set cluster wide. + +To enable auto-configuration of the kube worker node, set `elasticsearch.configureNode` to `true` + +This will run `sysctl -w vm.max_map_count=262144` on the worker where the sonarqube pod(s) get scheduled. This needs to be set to `262144` but normally defaults to `65530`. Other kernel settings are recommended by the [docker image](https://hub.docker.com/_/sonarqube/#requirements), but the defaults work fine in most cases. + +Note that if node configuration is not enabled, then you will likely need to disable the Elasticsearch bootstrap checks. These can be explicitly enabled by setting `elasticsearch.bootstrapChecks` to `false`. diff --git a/stable/sonarqube/templates/config.yaml b/stable/sonarqube/templates/config.yaml index edc5f57b1a..8835b0af68 100644 --- a/stable/sonarqube/templates/config.yaml +++ b/stable/sonarqube/templates/config.yaml @@ -9,14 +9,17 @@ metadata: release: {{ .Release.Name }} heritage: {{ .Release.Service }} data: - {{- if and .Values.sonarSecretKey (not .Values.sonarProperties) }} + {{- if and .Values.sonarSecretKey (not .Values.sonarProperties) (not .Values.elasticsearch.bootstrapChecks) }} sonar.properties: sonar.secretKeyPath=/opt/sonarqube/secret/sonar-secret.txt {{- end }} - {{- if .Values.sonarProperties }} + {{- if or .Values.sonarProperties (not .Values.elasticsearch.bootstrapChecks) }} sonar.properties: {{ range $key, $val := .Values.sonarProperties }} {{ $key }}={{ $val }} {{ end }} + {{- if not .Values.elasticsearch.bootstrapChecks }} + sonar.es.bootstrap.checks.disable=true + {{- end }} {{- end }} {{- if and .Values.sonarSecretKey .Values.sonarProperties }} sonar.secretKeyPath=/opt/sonarqube/secret/sonar-secret.txt diff --git a/stable/sonarqube/templates/deployment.yaml b/stable/sonarqube/templates/deployment.yaml index c6d93f7763..c0aa3d762e 100644 --- a/stable/sonarqube/templates/deployment.yaml +++ b/stable/sonarqube/templates/deployment.yaml @@ -35,6 +35,7 @@ spec: securityContext: {{ toYaml .Values.securityContext | indent 8 }} initContainers: + {{- if .Values.elasticsearch.configureNode }} - name: init-sysctl image: {{ default "busybox:1.31" .Values.plugins.initSysctlContainerImage }} command: @@ -44,6 +45,7 @@ spec: imagePullPolicy: IfNotPresent securityContext: privileged: true + {{- end }} {{- if .Values.plugins.install }} - name: install-plugins image: {{ default "joosthofman/wget:1.0" .Values.plugins.initContainerImage }} @@ -143,7 +145,7 @@ spec: periodSeconds: {{ .Values.readinessProbe.periodSeconds }} failureThreshold: {{ .Values.readinessProbe.failureThreshold }} volumeMounts: - {{- if .Values.sonarProperties }} + {{- if or .Values.sonarProperties (not .Values.elasticsearch.bootstrapChecks) }} - mountPath: /opt/sonarqube/conf/ name: config {{- end }} @@ -193,7 +195,7 @@ spec: {{ toYaml .Values.affinity | indent 8 }} {{- end }} volumes: - {{- if .Values.sonarProperties }} + {{- if or .Values.sonarProperties (not .Values.elasticsearch.bootstrapChecks) }} - name: config configMap: name: {{ template "sonarqube.fullname" . }}-config diff --git a/stable/sonarqube/values.yaml b/stable/sonarqube/values.yaml index 0e4d415fef..7826c3646b 100755 --- a/stable/sonarqube/values.yaml +++ b/stable/sonarqube/values.yaml @@ -16,6 +16,11 @@ image: securityContext: fsGroup: 999 +# Settings to configure elasticsearch host requirements +elasticsearch: + configureNode: true + bootstrapChecks: true + service: type: ClusterIP externalPort: 9000