From d3b9ed1ecdc0b0661cca093d04fe50df0321406b Mon Sep 17 00:00:00 2001 From: Chris Suran Date: Tue, 18 Feb 2020 09:53:28 -0500 Subject: [PATCH] [stable/sonarqube] Remove privileged securityContext from chmod-volume-mounts init container (#20525) * [stable/sonarqube] Remove privileged securityContext from chmod-volume-mounts init container Signed-off-by: Chris Suran * [stable/sonarqube] Update README to clarify Elasticsearch settings Signed-off-by: Chris Suran --- stable/sonarqube/Chart.yaml | 2 +- stable/sonarqube/README.md | 4 ++-- stable/sonarqube/templates/deployment.yaml | 2 -- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/stable/sonarqube/Chart.yaml b/stable/sonarqube/Chart.yaml index e1c67157c7..30de94217f 100644 --- a/stable/sonarqube/Chart.yaml +++ b/stable/sonarqube/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: sonarqube description: SonarQube is an open sourced code quality scanning tool -version: 3.4.0 +version: 3.4.1 appVersion: 7.9.2 keywords: - coverage diff --git a/stable/sonarqube/README.md b/stable/sonarqube/README.md index 857cd3abb5..dbaf43069a 100644 --- a/stable/sonarqube/README.md +++ b/stable/sonarqube/README.md @@ -149,8 +149,8 @@ Since SonarQube comes bundled with an Elasticsearch instance, some [bootstrap ch This chart offers the option to use an initContainer in privilaged mode to automatically set certain kernel settings on the kube worker. While this can ensure proper functionality of Elasticsearch, modifying the underlying kernel settings on the Kubernetes node can impact other users. It may be best to work with your cluster administrator to either provide specific nodes with the proper kernel settings, or ensure they are set cluster wide. -To enable auto-configuration of the kube worker node, set `elasticsearch.configureNode` to `true` +To enable auto-configuration of the kube worker node, set `elasticsearch.configureNode` to `true`. This is the default behavior, so you do not need to explicitly set this. This will run `sysctl -w vm.max_map_count=262144` on the worker where the sonarqube pod(s) get scheduled. This needs to be set to `262144` but normally defaults to `65530`. Other kernel settings are recommended by the [docker image](https://hub.docker.com/_/sonarqube/#requirements), but the defaults work fine in most cases. -Note that if node configuration is not enabled, then you will likely need to disable the Elasticsearch bootstrap checks. These can be explicitly enabled by setting `elasticsearch.bootstrapChecks` to `false`. +To disable worker node configuration, set `elasticsearch.configureNode` to `false`. Note that if node configuration is not enabled, then you will likely need to also disable the Elasticsearch bootstrap checks. These can be explicitly disabled by setting `elasticsearch.bootstrapChecks` to `false`. diff --git a/stable/sonarqube/templates/deployment.yaml b/stable/sonarqube/templates/deployment.yaml index 48762ac648..e20fa4a93e 100644 --- a/stable/sonarqube/templates/deployment.yaml +++ b/stable/sonarqube/templates/deployment.yaml @@ -43,8 +43,6 @@ spec: chown 999:999 -R $(printf "/opt/sonarqube/${1-%s\n}" temp logs data extensions/downloads extensions/plugins/tmp extensions/plugins)' image: busybox:1.31 imagePullPolicy: IfNotPresent - securityContext: - privileged: true volumeMounts: - mountPath: /opt/sonarqube/temp name: sonarqube