SonarQube

Big Bang deploys SonarQube as the sonarqube add-on in the sonarqube namespace. The package wraps the upstream chart with Iron Bank images, FIPS-host compatibility options, bb-common ingress, network, and Istio resources, monitoring, OpenShift support, SAML bootstrap, and UI/SSO test support.

For SonarQube product use, project administration, quality gates, scanners, and full configuration, use the SonarQube documentation and the versioned upstream chart values.

Configuration entry points

Enable and configure the package through the umbrella’s canonical packages.sonarqube configuration. The legacy addons.sonarqube path remains supported for compatibility. Big Bang owns package source selection, namespace, image-pull credentials, dependency ordering, and the package-to-chart values mapping; this repository owns the chart values consumed by the release.

Use the package upstream value only for settings passed to the bundled upstream chart. The wrapper’s values.yaml contains the Big Bang overrides and links to the complete upstream values surface; do not copy upstream defaults into an umbrella override. Package-specific SSO, OpenShift, and test values are top-level chart values. Shared Istio, route, and network-policy values are under the bb-common key.

Prerequisites and persistence

SonarQube includes Elasticsearch and needs Linux kernel limits on every node where its pod can be scheduled. Configure the host through the operating-system or cluster provisioning workflow before installation; do not use a privileged application init container to modify node settings. Follow the SonarQube Linux host prerequisites for the version in use.

Use persistent storage appropriate for the workload. For production, use a supported external PostgreSQL database. The umbrella supplies the external database connection details and creates the JDBC Secret when all database fields are configured. Treat the database credentials and Secret, SonarQube version, schema migration, and verified backups as one upgrade boundary. See database guidance and the upgrade guide.

This chart supports only replicaCount: 0 or 1; do not connect multiple SonarQube instances to the same database. Quiesce the existing instance before a database migration or cutover.

Security and SSO

Big Bang keeps forced authentication and disabled telemetry in its SonarQube properties. Properties supplied by an operator can override UI configuration, so preserve those controls and the FIPS Java options when replacing the properties or environment map. SonarQube is not FIPS compatible; Big Bang sets -Dcom.redhat.fips=false for FIPS-enabled Kubernetes hosts.

When SAML SSO is enabled with Keycloak, the umbrella supplies the SAML client and attribute mapping and makes SonarQube depend on Keycloak. The chart’s pre-install/pre-upgrade Job retrieves trusted IdP metadata and writes the SAML certificate Secret using namespace-scoped RBAC. Review IdP URL trust, required egress, certificate lifecycle, redirect URI, and SAML attributes together. Use the SAML integration guide for Big Bang-specific behavior and the SonarQube SAML documentation for product configuration.

Upgrade notice: bb-common values

This release moves the chart’s shared Big Bang settings from the former top-level istio, routes, and networkPolicies keys to bb-common.istio, bb-common.routes, and bb-common.networkPolicies. Update existing SonarQube overrides before upgrading; the former paths are not aliases and are no longer consumed. The wrapper-only networkPolicies.egressHttps key is also removed; express required egress through the corresponding bb-common definition and route values.

The Big Bang 4.0 compatibility migration for packages.sonarqube.values.networkPolicies.allowEgress.enabled is removed. That legacy switch no longer enables marketplace or repository egress. Configure only the required traffic through bb-common.networkPolicies definitions and bb-common.routes.outbound; explicitly enable marketplace egress when plugins require it. Legacy istio.hardened.customServiceEntries and istio.hardened.customAuthorizationPolicies overrides are no longer migrated; move them to bb-common.istio.serviceEntries.custom and bb-common.istio.authorizationPolicies.custom, respectively.

Ingress, mesh, and network policy

The package publishes an inbound route for sonarqube.<domain> through the selected Istio gateway. The umbrella maps its gateway selection and enables Istio dependencies; the chart renders route, Istio, and network-policy resources from bb-common.routes, bb-common.istio, and bb-common.networkPolicies. When network policies are enabled, explicitly allow only the required database, IdP, code-repository, marketplace/plugin, test, and monitoring traffic. Marketplace plugins and repository integrations require intentional outbound access; review plugin provenance and compatibility rather than enabling unrestricted egress.

See network policy guidance and the bb-common integration guide.

Monitoring and operations

When umbrella monitoring is enabled, the chart enables the JMX exporter and renders a ServiceMonitor for the web, compute-engine, and system metrics endpoints. The umbrella adds the JMX service ports when Istio and monitoring are enabled. Protect the system passcode and verify the ServiceMonitor, network policy, and sidecar-versus-ambient TLS/scheme settings together. See Prometheus integration.

SonarQube MCP remains disabled because its image is not available in Iron Bank; the chart rejects upstream.mcp.enabled: true. OpenShift support uses the chart’s compatible security settings rather than custom SCCs. Before an upgrade, review the upstream release and upgrade notes, back up persistent data and the external database, validate in a representative environment, and plan rollback before running an irreversible schema migration.