Skip to content

WPB-23896: Handle SonarQube yaml alerts #5160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
blackheaven wants to merge 8 commits into
base: develop
Choose a base branch
from
Open

WPB-23896: Handle SonarQube yaml alerts #5160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d7b97f0
WPB-23896: Handle SonarQube yaml alerts
blackheaven Mar 31, 2026
1e580ed
fix: try something
blackheaven Mar 31, 2026
f99b72d
fix: feedbacks
blackheaven Apr 1, 2026
4173142
feat: another lint
blackheaven Apr 1, 2026
28ee720
Hello CI
blackheaven Apr 1, 2026
d87ae19
fix: indent
blackheaven Apr 2, 2026
21d63d9
fix: indent
blackheaven Apr 2, 2026
a4be264
feat: outlook-addin resources/limits
blackheaven Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/0-release-notes/WPB-23896
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Helm charts updates, specifying resources limit/requests.
1 change: 1 addition & 0 deletions changelog.d/5-internal/WPB-23896
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fixed SonarQube Helm template formatting and RBAC issues in charts/.
3 changes: 3 additions & 0 deletions charts/backoffice/templates/tests/stern-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ metadata:
app: stern-integration
release: {{ .Release.Name }}
spec:
automountServiceAccountToken: false
volumes:
- name: "stern-integration"
configMap:
Expand Down Expand Up @@ -53,6 +54,8 @@ spec:
requests:
memory: "128Mi"
cpu: "1"
limits:
memory: "256Mi"
env:
- name: TEST_XML
value: /tmp/result.xml
Expand Down
8 changes: 4 additions & 4 deletions charts/cassandra-migrations/templates/cassandra-certs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ metadata:
type: Opaque
data:
ca.pem: {{ include "tlsCaBrig" . | b64enc | quote }}
{{- end}}
{{- end }}
{{- if ne (trim (include "tlsCaGalley" .)) "" }}
---
apiVersion: v1
Expand All @@ -34,7 +34,7 @@ metadata:
type: Opaque
data:
ca.pem: {{ include "tlsCaGalley" . | b64enc | quote }}
{{- end}}
{{- end }}
{{- if ne (trim (include "tlsCaGundeck" .)) "" }}
---
apiVersion: v1
Expand All @@ -53,7 +53,7 @@ metadata:
type: Opaque
data:
ca.pem: {{ include "tlsCaGundeck" . | b64enc | quote }}
{{- end}}
{{- end }}
{{- if ne (trim (include "tlsCaSpar" .)) "" }}
---
apiVersion: v1
Expand All @@ -72,4 +72,4 @@ metadata:
type: Opaque
data:
ca.pem: {{ include "tlsCaSpar" . | b64enc | quote }}
{{- end}}
{{- end }}
2 changes: 1 addition & 1 deletion charts/elasticsearch-index/templates/elasticsearch-ca-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
apiVersion: v1
kind: Secret
metadata:
name: "{{ include "fullname" .}}-ca"
name: "{{ include "fullname" . }}-ca"
labels:
app: elasticsearch-index
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
Expand Down
1 change: 1 addition & 0 deletions charts/k8ssandra-test-cluster/templates/check-cluster-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ metadata:
spec:
template:
spec:
automountServiceAccountToken: false
containers:
- name: cassandra
image: cassandra:4.1.10
Expand Down
4 changes: 2 additions & 2 deletions charts/nginx-ingress-services/templates/issuer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: cert-manager.io/v1
{{- if or (eq .Values.tls.issuer.kind "Issuer") (eq .Values.tls.issuer.kind "ClusterIssuer") }}
kind: "{{ .Values.tls.issuer.kind }}"
{{- else }}
{{- fail (cat ".tls.issuer.kind can only be one of Issuer or ClusterIssuer, got: " .tls.issuer.kind )}}
{{- fail (cat ".tls.issuer.kind can only be one of Issuer or ClusterIssuer, got: " .tls.issuer.kind ) }}
{{- end }}
metadata:
name: {{ include "nginx-ingress-services.getIssuerName" . | quote }}
Expand All @@ -28,5 +28,5 @@ spec:
- http01:
ingress:
class: nginx
{{- end }}
{{- end -}}
{{- end }}
66 changes: 33 additions & 33 deletions charts/nginz/templates/configmap.yaml
View file
Open in desktop
Copy link
Copy Markdown
Contributor

@battermann battermann Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this file does not render correctly

Copy link
Copy Markdown
Contributor Author

@blackheaven blackheaven Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you mean precisely?

Copy link
Copy Markdown
Contributor

@battermann battermann Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just mean that there was an error during rendering:

Error: parse error at (wire-server/charts/nginz/templates/configmap.yaml:6): undefined variable "$nginx_conf"

Copy link
Copy Markdown
Contributor Author

@blackheaven blackheaven Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, thanks

Copy link
Copy Markdown
Contributor Author

@blackheaven blackheaven Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does not there's not $nginx_conf, how do you get this error?

Copy link
Copy Markdown
Contributor

@supersven supersven Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't done it for this branch, but you could helm template the chart with --set-string "foo=bar" for the missing values Helm will scream for.

Copy link
Copy Markdown
Contributor Author

@blackheaven blackheaven Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot find which arguments to give to evaluate this file :/

Copy link
Copy Markdown
Contributor

@supersven supersven Apr 2, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

helm template test charts/nginz \
    --set secrets.zAuth.publicKeys="test-key=test-value" \
    --set secrets.basicAuth="user:pass"

The values don't really matter. But, the keys need to be defined

Copy link
Copy Markdown
Contributor Author

@blackheaven blackheaven Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, no more parse error

Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
{{- $nginxConf := .Values.nginx_conf }}

{{- $nginx_conf := .Values.nginx_conf }}

{{- if hasKey $nginx_conf "external_env_domain" }}
{{- $external_env_domain := $nginx_conf.external_env_domain }}
{{- range $nginx_conf.additional_external_env_domains }}
{{- if eq $external_env_domain . }}
{{- fail (printf "Error: external_env_domain (%s) cannot be part of additional_external_env_domains list." $external_env_domain) }}
{{- if hasKey $nginxConf "external_env_domain" }}
{{- $externalEnvDomain := $nginxConf.external_env_domain }}
{{- range $nginxConf.additional_external_env_domains }}
{{- if eq $externalEnvDomain . }}
{{- fail (printf "Error: external_env_domain (%s) cannot be part of additional_external_env_domains list." $externalEnvDomain) }}
{{- end }}
{{- end }}
{{- end }}
Expand All @@ -26,46 +25,47 @@ kind: ConfigMap
metadata:
name: nginz-deeplink
data:
{{- if and (hasKey .Values.nginx_conf "deeplink") (hasKey .Values.nginx_conf "external_env_domain") }}
{{- $backendURL := .Values.nginx_conf.deeplink.endpoints.backendURL }}
{{- $deeplink_json := $backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.json" }}
{{- $deeplink_html := $backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.html" }}
{{ $deeplink_json }}: |
{{- if and (hasKey $nginxConf "deeplink") (hasKey $nginxConf "external_env_domain") }}
{{- $deeplinkJson := $nginxConf.deeplink.endpoints.backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.json" }}
{{- $deeplinkHtml := $nginxConf.deeplink.endpoints.backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.html" }}
{{ $deeplinkJson }}: |
{{- $deeplink := dict
"endpoints" (dict
"backendURL" .Values.nginx_conf.deeplink.endpoints.backendURL
"backendWSURL" .Values.nginx_conf.deeplink.endpoints.backendWSURL
"blackListURL" .Values.nginx_conf.deeplink.endpoints.blackListURL
"teamsURL" .Values.nginx_conf.deeplink.endpoints.teamsURL
"accountsURL" .Values.nginx_conf.deeplink.endpoints.accountsURL
"websiteURL" .Values.nginx_conf.deeplink.endpoints.websiteURL
"backendURL" $nginxConf.deeplink.endpoints.backendURL
"backendWSURL" $nginxConf.deeplink.endpoints.backendWSURL
"blackListURL" $nginxConf.deeplink.endpoints.blackListURL
"teamsURL" $nginxConf.deeplink.endpoints.teamsURL
"accountsURL" $nginxConf.deeplink.endpoints.accountsURL
"websiteURL" $nginxConf.deeplink.endpoints.websiteURL
)
"title" .Values.nginx_conf.deeplink.title
"title" $nginxConf.deeplink.title
}}
{{- if hasKey .Values.nginx_conf.deeplink "apiProxy" }}
{{- if hasKey $nginxConf.deeplink "apiProxy" }}
{{- $_ := set $deeplink "apiProxy" (dict
"host" .Values.nginx_conf.deeplink.apiProxy.host
"port" .Values.nginx_conf.deeplink.apiProxy.port
"needsAuthentication" .Values.nginx_conf.deeplink.apiProxy.needsAuthentication
"host" $nginxConf.deeplink.apiProxy.host
"port" $nginxConf.deeplink.apiProxy.port
"needsAuthentication" $nginxConf.deeplink.apiProxy.needsAuthentication
) }}
{{- end }}
{{ toJson $deeplink | indent 4 }}
{{ $deeplink_html }}: |
{{ $deeplinkHtml }}: |
<html>
<head></head>
<head>
<title>Deeplink for {{ $nginxConf.deeplink.endpoints.backendURL }}</title>
</head>
<body>
<a href="wire://access/?config={{ .Values.nginx_conf.deeplink.endpoints.backendURL }}/deeplink.json">Click here for access</a>
<a href="wire://access/?config={{ $nginxConf.deeplink.endpoints.backendURL }}/deeplink.json">Click here for access</a>
</body>
</html>
{{- end }}

{{- if (hasKey $nginx_conf "additional_external_env_domains") }}
{{- range $domain, $config := $nginx_conf.multi_ingress_deeplink }}
{{- if (has $domain $nginx_conf.additional_external_env_domains) }}
{{- if (hasKey $nginxConf "additional_external_env_domains") }}
{{- range $domain, $config := $nginxConf.multi_ingress_deeplink }}
{{- if (has $domain $nginxConf.additional_external_env_domains) }}
{{- $backendURL := $config.endpoints.backendURL }}
{{- $deeplink_json := $backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.json" }}
{{- $deeplink_html := $backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.html" }}
{{ $deeplink_json }}: |
{{- $deeplinkJson := $backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.json" }}
{{- $deeplinkHtml := $backendURL | replace "https://" "" | trimSuffix "/" | printf "%s-deeplink.html" }}
{{ $deeplinkJson }}: |
{{- $deeplink := dict
"endpoints" (dict
"backendURL" $config.endpoints.backendURL
Expand All @@ -86,7 +86,7 @@ data:
{{- end }}
{{ toJson $deeplink | indent 4 }}
{{ printf "\n" }}
{{ $deeplink_html }}: |
{{ $deeplinkHtml }}: |
<html>
<head>
<title>Deeplink for {{ $domain }}</title>
Expand Down
1 change: 1 addition & 0 deletions charts/openldap/templates/openldap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ metadata:
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
automountServiceAccountToken: false
topologySpreadConstraints:
- maxSkew: 1
topologyKey: "kubernetes.io/hostname"
Expand Down
7 changes: 7 additions & 0 deletions charts/outlook-addin/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ spec:
labels:
app: {{ include "outlook.fullname" . }}
spec:
automountServiceAccountToken: false
topologySpreadConstraints:
- maxSkew: 1
topologyKey: "kubernetes.io/hostname"
Expand Down Expand Up @@ -45,3 +46,9 @@ spec:
httpGet:
path: /
port: http
resources:
requests:
memory: "64Mi"
cpu: "10m"
limits:
memory: "256Mi"
4 changes: 2 additions & 2 deletions charts/wire-server/templates/background-worker/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,10 @@ data:
migrateConversationCodes: {{ .migrateConversationCodes }}
migrateTeamFeatures: {{ .migrateTeamFeatures }}
migrateConversationsOptions:
{{toYaml .migrateConversationsOptions | indent 6 }}
{{ toYaml .migrateConversationsOptions | indent 6 }}

backendNotificationPusher:
{{toYaml .backendNotificationPusher | indent 6 }}
{{ toYaml .backendNotificationPusher | indent 6 }}
{{- with .backgroundJobs }}
backgroundJobs:
{{ toYaml . | indent 6 }}
Expand Down
6 changes: 3 additions & 3 deletions charts/wire-server/templates/brig/tests/brig-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,12 +48,12 @@ spec:
- name: elasticsearch-ca
secret:
secretName: {{ include "brig.elasticsearchTlsSecretName" .Values.brig.config }}
{{- end}}
{{- end }}
{{- if eq (include "useCassandraTLS" .Values.brig.config.cassandra) "true" }}
- name: "brig-cassandra"
secret:
secretName: {{ (include "brig.tlsSecretRef" .Values.brig.config | fromYaml).name }}
{{- end}}
{{- end }}
{{- if .Values.brig.config.rabbitmq.tlsCaSecretRef }}
- name: "rabbitmq-ca"
secret:
Expand Down Expand Up @@ -119,7 +119,7 @@ spec:
{{- if eq (include "brig.configureElasticSearchCa" .Values.brig.config) "true" }}
- name: elasticsearch-ca
mountPath: "/etc/wire/brig/elasticsearch-ca"
{{- end}}
{{- end }}
{{- if eq (include "useCassandraTLS" .Values.brig.config.cassandra) "true" }}
- name: "brig-cassandra"
mountPath: "/etc/wire/brig/cassandra"
Expand Down
1 change: 1 addition & 0 deletions charts/wire-server/templates/cargohold/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ spec:
checksum/secret: {{ include (print .Template.BasePath "/cargohold/secret.yaml") . | sha256sum }}
spec:
serviceAccountName: {{ .Values.cargohold.serviceAccount.name }}
automountServiceAccountToken: false
topologySpreadConstraints:
- maxSkew: 1
topologyKey: "kubernetes.io/hostname"
Expand Down
2 changes: 1 addition & 1 deletion charts/wire-server/templates/galley/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ data:
{{- else if .settings.multiIngress }}
multiIngress: {{- toYaml .settings.multiIngress | nindent 8 }}
{{- else }}
{{ fail "Either settings.conversationCodeURI or settings.multiIngress have to be set"}}
{{ fail "Either settings.conversationCodeURI or settings.multiIngress have to be set" }}
{{- end }}
{{- if (and .settings.conversationCodeURI .settings.multiIngress) }}
{{ fail "settings.conversationCodeURI and settings.multiIngress are mutually exclusive" }}
Expand Down
4 changes: 2 additions & 2 deletions charts/wire-server/templates/gundeck/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ data:
enableTls: {{ .redis.enableTls }}
insecureSkipVerifyTls: {{ .redis.insecureSkipVerifyTls }}
{{- if eq (include "gundeck.configureRedisCa" .) "true" }}
tlsCa: /etc/wire/gundeck/redis-ca/{{ include "gundeck.redisTlsSecretKey" .}}
tlsCa: /etc/wire/gundeck/redis-ca/{{ include "gundeck.redisTlsSecretKey" . }}
{{- end }}

{{- if .redisAdditionalWrite }}
Expand All @@ -59,7 +59,7 @@ data:
enableTls: {{ .redisAdditionalWrite.enableTls }}
insecureSkipVerifyTls: {{ .redisAdditionalWrite.insecureSkipVerifyTls }}
{{- if eq (include "gundeck.configureAdditionalRedisCa" .) "true" }}
tlsCa: /etc/wire/gundeck/additional-redis-ca/{{ include "gundeck.additionalRedisTlsSecretKey" .}}
tlsCa: /etc/wire/gundeck/additional-redis-ca/{{ include "gundeck.additionalRedisTlsSecretKey" . }}
{{- end }}
{{- end }}

Expand Down
2 changes: 1 addition & 1 deletion charts/wire-server/templates/gundeck/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ spec:
- name: "gundeck-cassandra"
secret:
secretName: {{ (include "gundeck.tlsSecretRef" .Values.gundeck.config | fromYaml).name }}
{{- end}}
{{- end }}
{{- if eq (include "gundeck.configureRedisCa" .Values.gundeck.config) "true" }}
- name: "redis-ca"
secret:
Expand Down
2 changes: 1 addition & 1 deletion charts/wire-server/templates/gundeck/tests/gundeck-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ spec:
- name: "gundeck-cassandra"
secret:
secretName: {{ (include "gundeck.tlsSecretRef" .Values.gundeck.config | fromYaml).name }}
{{- end}}
{{- end }}
{{- if eq (include "gundeck.configureRedisCa" .Values.gundeck.config) "true" }}
- name: "redis-ca"
secret:
Expand Down
2 changes: 1 addition & 1 deletion charts/wire-server/templates/spar/tests/spar-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ spec:
- name: "spar-cassandra"
secret:
secretName: {{ (include "spar.tlsSecretRef" .Values.spar.config | fromYaml).name }}
{{- end}}
{{- end }}
containers:
- name: integration
image: "{{ .Values.spar.image.repository }}-integration:{{ .Values.spar.image.tag }}"
Expand Down