$ show SonarSource/helm-chart-sonarqube
This repository contains the official Helm charts for deploying SonarQube on Kubernetes, maintained by SonarSource. It provides two charts: `sonarqube` for standard (Community/Developer/Enterprise) deployments and `sonarqube-dce` for Data Center Edition with clustered search and application nodes. The charts are production-grade, supporting a wide range of Kubernetes features including StatefulSets, Deployments, Ingress, NetworkPolicies, PodDisruptionBudgets, Prometheus monitoring, Istio service mesh with strict mTLS, OpenShift integration, and autoscaling via HPA and KEDA. A distinguishing feature is the agentic AI subsystem: the charts deploy an orchestrator, hunter, and remediation agent runtimes, a Squid-based egress proxy for sandboxed runtime isolation, gVisor/Kata sandboxing, and an HKDF-based key derivation hook for secure inter-component communication. The repository also includes integrations for Azure and Google Cloud marketplaces, comprehensive CI/CD pipelines (build, sign, publish, compatibility tests), and migration scripts for PostgreSQL and ingress-nginx to Gateway API/Istio. The codebase demonstrates high craftsmanship in Helm template design, with extensive validation, test fixtures, and golden-file tests covering hundreds of configuration permutations.
The LLM identified 3 files worth highlighting for reuse:
Defines a Squid proxy configuration with per-runtime-family listeners (ports 3128, 3129), domain-based allowlisting via `dstdomain` ACL, and hardcoded rules for SonarQube agentic endpoints. This pattern is reusable for any scenario where untrusted workloads need controlled egress without network-level DNS filtering, and can be extracted as a generic egress proxy Helm chart.
Implements a pre-install/pre-upgrade Kubernetes Job that derives per-hop signing keys from a single instance secret using HKDF-SHA256, and writes them as Kubernetes Secrets via the API. The design ensures key isolation between hops and deterministic key rotation. This pattern can be extracted as a reusable Helm hook for any multi-component system requiring derived cryptographic keys.
Provides Go test helpers (`RunChartTest`, `RunAgentRuntimeClassCheckTest`, `RunPrometheusExporterTest`) that automate deploying a Helm chart to a live cluster, waiting for readiness, and verifying health endpoints. These utilities encapsulate common patterns for dynamic Helm chart testing (setup, teardown, retries, resource cleanup) and can be reused for testing any Helm chart on Kubernetes.