diff --git a/README.md b/README.md index dc8c51e122c3c3c9f68dfc846ce9efc8fbe1b2ab..6f827240c797f1a92cf5d0fecb56601b0f12d9e5 100644 --- a/README.md +++ b/README.md @@ -1,81 +1,6 @@ -# Sonarqube 8.3 Community version [Version 8.3.1 (build 34397)] with auth-oidc 2.0.0 plugin +# Sonarqube -This repo contains manifests to deploy Sonarqube static code analysis tool into a Kubernetes cluster. +See the [README in the *docs* folder](docs/README.md) for documentation -Additional docs for using Sonarqube and its plugins can be found at https://docs.sonarqube.org/latest/ +Copy the *deploy* folder into the appropriate spot in your bootstrap repo to add Sonarqube to your deployment. Be sure to check the docs for additional instructions. -## Usage - -### Pre-requisites - -* Kubernetes cluster deployed -* kubectl configuration installed - -Install kubectl - -``` -brew install kubectl -``` - -Install kustomize - -``` -brew install kustomize -``` - -### Deployment - -Clone repository - -``` -git clone https://repo1.dsop.io/platform-one/apps/sonarqube.git -``` - -``` -cd sonarqube -``` - -Please note that appropriate secrets (listed below) should be defined before the sonarqube pod is able to connect to the postgres database and is able to function properly. -Sonarqube needs three environment variables to access the postgres database. - -SONARQUBE_JDBC_URL - URL for the postgres database to use - -SONARQUBE_JDBC_USERNAME - username to access the postgres database - -SONARQUBE_JDBC_PASSWORD - password for the above user - -These need to be added in as Kubernetes secrets and mounted into the sonarqube pod https://kubernetes.io/docs/concepts/configuration/secret/. - -To deploy Sonarqube, add the secrets, volumes, volumeMounts and env to set values for the above variables. -After the above secrets are incorporated into the sonarqube/ manifests, to deploy Sonarqube apply the kustomized manifest: - -``` -kubectl apply -k sonarqube/ -``` - -### IMPORTANT Default Admin Credentials - -When installing SonarQube, a default user with administrator privileges is created automatically: - -Login: admin -Password: admin - -For security reasons the administrator password should be changed. This can be done from the SonarQube dashboard by following these steps: - -1)Log in to the SonarQube dashboard. - -2)Under the “User Name” dropdown menu in the upper right corner, click on “My Account”. - -3)Select the “Security” tab. - -4)Enter your old password and enter your new password twice to confirm the change. - -5)Click the “Change password” button. - -## Contributing - -To contribute to Big Bang Sonarqube, see the [Contributing Guide](CONTRIBUTING.md). - -## References - -Docker image https://dcar.dsop.io/repomap/sonarsource/sonarqube/sonarqube8-community SHA tag - sha256:7356de08b61c240302aa91040a7abea1ebea190afb2d14f35191e272ddbc712a diff --git a/docs/LOGGING.md b/docs/ECK.md similarity index 97% rename from docs/LOGGING.md rename to docs/ECK.md index aed6bd7e5f08be5f5e9a54bbdc698d76ec7dfee5..c34652b756e1b32304b9458f5db8f7aab59072dc 100644 --- a/docs/LOGGING.md +++ b/docs/ECK.md @@ -1,4 +1,3 @@ - # Logging # Pre-requisites @@ -79,4 +78,4 @@ The number of Lines of Code (for licensing purposes) in an instance can be found Further logging information can be found in the sonarqube configuration file. For details run the following command: -``kubectl exec sonarqube-sonarqube-5dd795f449-xxxx -n sonarqube -- cat ./conf/sonar.properties`` +```kubectl exec sonarqube-sonarqube-5dd795f449-xxxx -n sonarqube -- cat ./conf/sonar.properties`` diff --git a/docs/Keycloak.md b/docs/Keycloak.md new file mode 100644 index 0000000000000000000000000000000000000000..d24d1906029145fbbe65d1c7f12d97c9a6f21c9c --- /dev/null +++ b/docs/Keycloak.md @@ -0,0 +1,37 @@ +# Keycloak integration for Sonarqube + +1. Login to Sonarqube with default admin credentials username: admin password: admin +2. In Adminstration->General + set Server base URL to Sonarqube URL + (for ex: https:/sonarqube.dsop.io) without a trailing / +3. On a different tab on the browser, login to keycloak realm + - From Clients choose the sonarqube client and note the Client id + - Set Root URL to empty string + - Set Valid Redirect URI to + ```https:///*``` + (for ex: https://sonarqube.dsop.io/*) + - Set Base URI to Sonarqube URL + (for ex: https://sonarqube.dsop.io) without a trailing / + - On Clients-->Credentials regenerate the secret and note it down + - On Clients-->ClientScopes->Sonarqube->Mappers + - Click Add Builtin and add "groups" scope + - On Users, click "Add User" and enter + - Username - + - email - must have @admin.mil id + - First name + - Last name + - Email Verified - On + - Save + - On Users, on the Credentials tab and set password + - On Users, on the Groups tab and join Impact Level2 Authorized and System Admins IL2 +4. In Administration-> Security Set OpenID Connect to enabled + - Issuer URI to https://keycloak.fences.dsop.io/auth/realms/baby-yoda + - ClientId noted from keycloak above + - ClientSecret regeneretaed from keycloak above + - Scopes - openid Sonarqube +5. Logout of sonarqube and log back in with the username created above by clicking on oidc login +6. Logout of sonarqube and log back in with the username admin and password admin +7. Go to Administration->Security->Users and add username created above to sonar-admin group +8. Go to Administration->Security->Users and delete admin user +9. Logout of Sonarqune and login with username and password created in keycloak + diff --git a/docs/Prometheus.md b/docs/Prometheus.md new file mode 100644 index 0000000000000000000000000000000000000000..b30d52c0cd37992acc58ea10b594cce6aa291188 --- /dev/null +++ b/docs/Prometheus.md @@ -0,0 +1,5 @@ +# Sonarqube integration with Prometheus + +Prometheus integration is pending. Placeholder for future documentation. +Sonarqube does not have built-in support for a ```/metrics``` endpoint for Prometheus integration. A metrics exporter plugin is required. +For example [https://github.com/dmeiners88/sonarqube-prometheus-exporter](https://github.com/dmeiners88/sonarqube-prometheus-exporter) \ No newline at end of file diff --git a/docs/README.md b/docs/README.md index 18f32eebee3959096554869e3fe076d57daf3875..e63b06ecd81d3c46e16ef980b54597f12a88a35a 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,39 +1,24 @@ # Sonarqube 8.3 Community version [Version 8.3.1 (build 34397)] with auth oidc 2.0.0 plugin -This repo contains manifests to deploy Sonarqube static code analysis tool into a Kubernetes cluster. - -Additional docs for using Sonarqube and its plugins can be found at - -## Usage - -### Pre-requisites - -* Kubernetes cluster deployed -* kubectl configuration installed +## Table Of Contents -Install kubectl +- Application Overview +- Usage +- Integrations + - Prometheus + - ECK + - Keycloak +- Troubleshooting Tips -`` -brew install kubectl -`` +### Application Overview -Install kustomize - -`` -brew install kustomize -`` - -### Deployment +This repo contains manifests to deploy Sonarqube static code analysis tool into a Kubernetes cluster. +Additional docs for using Sonarqube and its plugins can be found at -Clone repository -`` -git clone https://repo1.dsop.io/platform-one/apps/sonarqube.git -`` +### Usage -`` -cd sonarqube -`` +#### Deployment Notes Please note the settings applied in the file "sonar.properties" since they override any settings applied through the UI. [Documentation can be found here](https://docs.sonarqube.org/latest/setup/operate-cluster/#header-8) with additional properties shown in the Sonarqube instance's settings page. @@ -54,14 +39,9 @@ SONARQUBE_JDBC_PASSWORD - password for the above user These need to be added in as Kubernetes secrets and mounted into the sonarqube pod . -To deploy Sonarqube, add the secrets, volumes, volumeMounts and env to set values for the above variables. -After the above secrets are incorporated into the sonarqube/ manifests, to deploy Sonarqube apply the kustomized manifest: -`` -kubectl apply -k sonarqube/ -`` -### IMPORTANT Default Admin Credentials +#### Default Admin Credentials When installing SonarQube, a default user with administrator privileges is created automatically: @@ -80,10 +60,22 @@ For security reasons the administrator password should be changed. This can be d 5)Click the “Change password” button. -## Contributing -To contribute to Big Bang Sonarqube, see the [Contributing Guide](CONTRIBUTING.md). +### Integrations + +#### [Prometheus.md](Prometheus.md) +- Configuration items +- List of metrics gathered +- Useful queries [living list] -## References +#### [ECK.md](ECK.md) +- Configuration items +- Fluentd Pipelines +- Important Logs +- Useful queries [living list] -Docker image SHA tag - sha256:7356de08b61c240302aa91040a7abea1ebea190afb2d14f35191e272ddbc712a +#### [Keycloak.md](Keycloak.md) +- Configuration items +- Add new groups +- Claim information +- OiD / SAML application items