SonarQube

SonarQube Community Build provides code quality and security analysis. The HelmForge chart deploys the official SonarQube image with PostgreSQL integration, plugin automation, and operational guardrails.

Key Features

• Official docker.io/library/sonarqube image pinned to 26.8.0.126808-community
• HelmForge PostgreSQL dependency or external PostgreSQL
• Plugin download init container with shell-safe URLs and optional SHA-256 verification
• First-class community branch plugin wiring, Java agents, and webapp replacement support
• Gateway API, Ingress, dual-stack Service fields, NetworkPolicy, PDB, persistence, and Helm tests
• External Secrets Operator support for database credentials
• extraManifests extension point for small companion resources and self-contained validation fixtures

Installation

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install sonarqube helmforge/sonarqube --namespace sonarqube --create-namespace

helm install sonarqube oci://ghcr.io/helmforgedev/helm/sonarqube --namespace sonarqube --create-namespace

Examples

Bundled PostgreSQL:

sonarqube:
  databaseMode: postgresql
postgresql:
  enabled: true
  auth:
    database: sonarqube
    username: sonar
    password: change-me

Community branch plugin:

communityBranchPlugin:
  enabled: true
  version: '26.4.0'
  jarSha256: ''
  webappSha256: ''

Operations

SonarQube embeds Elasticsearch and has host kernel requirements for production bootstrap checks. The chart keeps local evaluation approachable, but production clusters should satisfy SonarQube host requirements and use PostgreSQL, either bundled or external.

Architecture

The chart runs SonarQube Community Build with one of three database paths:

• embedded for disposable local validation
• postgresql for the HelmForge PostgreSQL subchart
• external for a platform-managed PostgreSQL database

SonarQube also embeds Elasticsearch for search. That makes node kernel settings, persistent data, and startup probes part of the production contract.

The Service targets the named http port. containerPorts.http changes the real SonarQube listener through SONAR_WEB_PORT; service.port changes only the client-facing Kubernetes Service port.

Production Values

Use PostgreSQL, persistent data and extensions volumes, and production bootstrap checks:

sonarqube:
  databaseMode: external
  esBootstrapChecksDisable: false

database:
  external:
    jdbcUrl: jdbc:postgresql://postgresql.database.svc.cluster.local:5432/sonarqube
    username: sonar
    existingSecret: sonarqube-database
    existingSecretPasswordKey: jdbc-password

persistence:
  data:
    enabled: true
    size: 50Gi
  extensions:
    enabled: true
    size: 10Gi

networkPolicy:
  enabled: true
  egress:
    enabled: true
    extraEgress:
      - to:
          - ipBlock:
              cidr: 10.80.0.0/16
        ports:
          - protocol: TCP
            port: 443

pdb:
  enabled: true

Bundled HelmForge PostgreSQL is useful for self-contained releases:

sonarqube:
  databaseMode: postgresql
  esBootstrapChecksDisable: false

postgresql:
  enabled: true
  auth:
    database: sonarqube
    username: sonar
    password: change-me
  standalone:
    persistence:
      enabled: true
      size: 50Gi

Host Requirements

Production nodes must satisfy SonarQube’s Elasticsearch requirements before enabling bootstrap checks:

• vm.max_map_count=524288
• fs.file-max=131072
• file descriptor limit of 131072
• process limit of 8192

Keep sonarqube.esBootstrapChecksDisable=true only for local and disposable environments.

Plugins

The chart can download plugins during initialization:

plugins:
  enabled: true
  install:
    - name: sonar-auth-oidc
      url: https://artifacts.example.com/sonar-auth-oidc.jar
      sha256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

Plugin URLs are passed through environment variables so shell characters are not interpreted. When sha256 is set, the init container verifies the artifact before SonarQube starts. Use an internal artifact repository and checksums for production.

Extension Manifests

Use extraManifests for small companion resources that must ship with the release, such as a Service alias or a short-lived validation dependency:

extraManifests:
  - apiVersion: v1
    kind: ConfigMap
    metadata:
      name: sonarqube-extra
    data:
      enabled: 'true'

Community Branch Plugin

Community Branch Plugin wiring is explicit because it replaces web application files and adds Java agents:

communityBranchPlugin:
  enabled: true
  version: '26.4.0'

plugins:
  enabled: true

persistence:
  extensions:
    enabled: true
    size: 10Gi

Keep the plugin major and minor version aligned with the SonarQube major and minor version. Mirror jarUrl and webappUrl internally when outbound internet is restricted. Configure jarSha256 and webappSha256 to establish artifact integrity.

Backup and Security Boundaries

A recoverable backup includes PostgreSQL plus the data and extensions volumes. The logs volume is optional and is not application state. Backup scheduling, retention, and restore testing remain platform responsibilities.

Also preserve the database credential source of truth. With bundled PostgreSQL, this is the Secret referenced by postgresql.auth.existingSecret or the auth Secret generated by the dependency. With an external database, preserve the referenced Secret or the ExternalSecret definition and provider-side data that recreate it. Restore the applicable credential source before SonarQube starts. During recovery, keep SonarQube stopped, restore PostgreSQL and required volumes, remove the restored data/es8 directory, and then start SonarQube so it rebuilds its Elasticsearch indexes from PostgreSQL.

The pod defaults to a non-root UID, RuntimeDefault seccomp, dropped capabilities, no privilege escalation, a read-only root filesystem, and no service account token. NetworkPolicy is opt-in because database and plugin-mirror destinations are environment-specific.

Networking

Ingress example:

ingress:
  enabled: true
  ingressClassName: nginx
  hosts:
    - host: sonarqube.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: sonarqube-tls
      hosts:
        - sonarqube.example.com

Gateway API uses gatewayAPI for this chart:

gatewayAPI:
  enabled: true
  parentRefs:
    - name: public-gateway
      namespace: gateway-system
  hostnames:
    - sonarqube.example.com

Validation

After deployment:

helm test sonarqube -n sonarqube
kubectl get pods -n sonarqube -l app.kubernetes.io/name=sonarqube
kubectl logs -n sonarqube deploy/sonarqube --since=10m
kubectl get events -n sonarqube --sort-by=.lastTimestamp

Also validate the UI system status, a project scan, plugin loading, and branch analysis when the community branch plugin is enabled.

Common Issues

Symptom	Likely Cause	Fix
Elasticsearch bootstrap check fails	Node kernel limits are too low	Configure node sysctls and process/file limits.
Plugin disappears after restart	Extensions persistence disabled	Enable persistence.extensions.
Startup waits forever for DB	JDBC URL, Secret key, or network policy is wrong	Check DB Secret, DNS, and egress policy.
Branch plugin fails after upgrade	Plugin version mismatches SonarQube	Align plugin and SonarQube major/minor versions.

Values

Parameter	Default	Description
image.repository	docker.io/library/sonarqube	Official SonarQube image.
image.tag	26.8.0.126808-community	SonarQube Community Build tag.
containerPorts.http	9000	Real SonarQube listener wired through SONAR_WEB_PORT.
service.port	9000	Client-facing Service port targeting named port http.
sonarqube.databaseMode	auto	Database mode: auto, embedded, postgresql, or external.
postgresql.enabled	false	Deploy HelmForge PostgreSQL dependency.
waitForDatabase.enabled	true	Wait for PostgreSQL before startup.
plugins.enabled	false	Enable plugin download init container.
communityBranchPlugin.enabled	false	Install and wire the community branch plugin.
communityBranchPlugin.jarSha256	""	Optional SHA-256 checksum for the branch plugin JAR.
communityBranchPlugin.webappSha256	""	Optional SHA-256 checksum for the patched webapp ZIP.
persistence.data.enabled	true	Persist SonarQube data.
persistence.extensions.enabled	true	Persist installed plugins and extensions.
gatewayAPI.enabled	false	Render Gateway API HTTPRoute.
networkPolicy.enabled	false	Render NetworkPolicy.
networkPolicy.egress.extraEgress	[]	Additional complete NetworkPolicy egress rules.
externalSecrets.enabled	false	Render ExternalSecret resources.
extraManifests	[]	Additional Kubernetes manifests rendered with the release.

Links

• SonarQube Community Build
• Community branch plugin
• Chart source