Skip to content

Commit b8d373c

Browse files
alain-kermis-sonarsourcealain-kermis-sonarsource
authored
SONAR-25554 Add validation for jwtSecret and existingJwtSecret values
1 parent a7f01a7 commit b8d373c

36 files changed

+102
-91
lines changed

‎.cirrus/generate_helm_fixtures.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ for path in "sonarqube" "sonarqube-dce"; do
2222
FIXTURE_STATIC_TEST_FOLDER="./tests/unit-compatibility-test/fixtures/${path}/${TEST_CASE_NAME}"
2323

2424
echo "Entering fixture test for ${TEST_CASE_NAME}"
25-
helm template --set monitoringPasscode='test' --set global.postgresql.postgresqlPostgresPassword='toto' --kube-version "$KUBE_VERSION" --dry-run --debug -f "$file" "${TEST_CASE_NAME}" ${CHART_TEST_FOLDER} > "${FIXTURE_STATIC_TEST_FOLDER}"
25+
helm template --set monitoringPasscode='test' --set applicationNodes.jwtSecret='some-secret' --set global.postgresql.postgresqlPostgresPassword='toto' --kube-version "$KUBE_VERSION" --dry-run --debug -f "$file" "${TEST_CASE_NAME}" ${CHART_TEST_FOLDER} > "${FIXTURE_STATIC_TEST_FOLDER}"
2626
echo "Ending fixture test test for ${TEST_CASE_NAME}"
2727
done
2828

‎.cirrus/unit_helm_compatibility_test.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ for file in "${STATIC_TEST_FOLDER}"/*; do
2929
--dry-run \
3030
--debug \
3131
--set monitoringPasscode='test' \
32+
--set applicationNodes.jwtSecret='some-secret' \
3233
-f "${file}" "${TEST_CASE_NAME}" "${CHART_PATH}" \
3334
| kubeconform \
3435
--kubernetes-version "${KUBE_VERSION}" \

‎charts/sonarqube-dce/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ All changes to this chart will be documented in this file.
55
* Update Chart's version to 2025.4.0
66
* Upgrade nginx subchart to 4.12.3
77
* Support Kubernetes v1.33
8+
* Added validation to ensure that either the `applicationNodes.jwtSecret` or `applicationNodes.jwtExistingSecret` value is set
89

910
## [2025.3.0]
1011
* Update Chart's version to 2025.3.0

‎charts/sonarqube-dce/Chart.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ annotations:
3131
description: "Upgrade nginx subchart to 4.12.3"
3232
- kind: changed
3333
description: "Support Kubernetes v1.33"
34+
- kind: added
35+
description: "Added validation to ensure that either the applicationNodes.jwtSecret or applicationNodes.jwtExistingSecret value is set"
3436
artifacthub.io/links: |
3537
- name: support
3638
url: https://community.sonarsource.com/

‎charts/sonarqube-dce/templates/validation.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
{{/* Validation for monitoring passcode */}}
12
{{- if or (and (not .Values.monitoringPasscode) (not .Values.monitoringPasscodeSecretName) (not .Values.monitoringPasscodeSecretKey)) (and (not .Values.monitoringPasscodeSecretName) .Values.monitoringPasscodeSecretKey) (and .Values.monitoringPasscodeSecretName (not .Values.monitoringPasscodeSecretKey)) -}}
23
{{- fail "\n ** The values.yaml file is not valid. ** \n Please provide a passcode either setting \"monitoringPasscode\" or \"monitoringPasscodeSecretName\" and \"monitoringPasscodeSecretKey\"" -}}
34
{{- end -}}
5+
6+
{{/* Validation for jwtSecret and existingJwtSecret (XOR check) */}}
7+
{{- if or (and .Values.ApplicationNodes.jwtSecret .Values.ApplicationNodes.existingJwtSecret) (and (not .Values.ApplicationNodes.jwtSecret) (not .Values.ApplicationNodes.existingJwtSecret)) -}}
8+
{{- fail "\n ** The values.yaml file is not valid. ** \n You must set a value for either \"jwtSecret\" or \"existingJwtSecret\", but not both." -}}
9+
{{- end -}}

‎tests/dynamic-compatibility-test/sonarqube-dce/all-values.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ searchNodes:
2626
ApplicationNodes:
2727
sonarProperties:
2828
sonar.log.level: DEBUG
29+
jwtSecret: someSecret
2930

3031
# tests/unit-compatibility-test/sonarqube-dce/ingress-values.yaml
3132
ingress:

‎tests/unit-compatibility-test/fixtures/sonarqube-dce/application-values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ metadata:
7676
heritage: Helm
7777
type: Opaque
7878
data:
79-
SONAR_AUTH_JWTBASE64HS256SECRET: ""
79+
SONAR_AUTH_JWTBASE64HS256SECRET: "c29tZS1zZWNyZXQ="
8080
---
8181
# Source: sonarqube-dce/templates/secret.yaml
8282
---
@@ -402,7 +402,7 @@ spec:
402402
annotations:
403403
checksum/plugins: 65d56aea10ed1c0cd6fca52fa0b1119e172bb86bb859739187c1eb364cb09f26
404404
checksum/config: 52aa90e008d21e2b9dd209b41439f963c6560e7a63594c99030221a63b787a8d
405-
checksum/secret: 1e41674c1cc90202f3ed6d4efccc7dc485a6d2334dd4e1e5c83271f6f3b30a9c
405+
checksum/secret: 01dcab2809732b9cc414a6fc196fe7549c340721454577fe75b3cd7340630b11
406406
spec:
407407
automountServiceAccountToken: false
408408
initContainers:
@@ -771,7 +771,7 @@ spec:
771771
checksum/init-sysctl: abb3cec82532ac72ec508ff713f4348a67ebc0250ff6c84dd74514c2ecefba2a
772772
checksum/init-fs: 42db87ee4aad1d5bed387840b22747c74a26dc96794f91e1e52d48756fd58c2d
773773
checksum/config: 52aa90e008d21e2b9dd209b41439f963c6560e7a63594c99030221a63b787a8d
774-
checksum/secret: 1e41674c1cc90202f3ed6d4efccc7dc485a6d2334dd4e1e5c83271f6f3b30a9c
774+
checksum/secret: 01dcab2809732b9cc414a6fc196fe7549c340721454577fe75b3cd7340630b11
775775
spec:
776776
automountServiceAccountToken: false
777777
initContainers:

‎tests/unit-compatibility-test/fixtures/sonarqube-dce/ca-certificates-configmap.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ metadata:
7676
heritage: Helm
7777
type: Opaque
7878
data:
79-
SONAR_AUTH_JWTBASE64HS256SECRET: ""
79+
SONAR_AUTH_JWTBASE64HS256SECRET: "c29tZS1zZWNyZXQ="
8080
---
8181
# Source: sonarqube-dce/templates/secret.yaml
8282
---
@@ -419,7 +419,7 @@ spec:
419419
annotations:
420420
checksum/plugins: 5e4cfa308393c7ca89f120b028dd53cf70d38bb377ea3a33423e5fb74edfcdc6
421421
checksum/config: ba70acaa0a7181daf62e5f4dbdc41b1300512b11ea795f4901aede87df9105da
422-
checksum/secret: 70247c2dbe7d96b834e275fbce23f2b30beadb66d83f9168fde1151c01e9956d
422+
checksum/secret: 166c32a438d7226e9499c3706b63e38caf6f5dad4ba8358b4b9746971a0d989d
423423
spec:
424424
automountServiceAccountToken: false
425425
initContainers:
@@ -860,7 +860,7 @@ spec:
860860
checksum/init-sysctl: b3cdd18fe1febdb4e7de8a5e729ab44e8cd2e5a2dd042031ac4c9a5d1e29f8b5
861861
checksum/init-fs: ea5f89376cf540cc7f3dd8d8c04431da798ea0480dc4558e570a3db41f740541
862862
checksum/config: ba70acaa0a7181daf62e5f4dbdc41b1300512b11ea795f4901aede87df9105da
863-
checksum/secret: 70247c2dbe7d96b834e275fbce23f2b30beadb66d83f9168fde1151c01e9956d
863+
checksum/secret: 166c32a438d7226e9499c3706b63e38caf6f5dad4ba8358b4b9746971a0d989d
864864
spec:
865865
automountServiceAccountToken: false
866866
initContainers:

‎tests/unit-compatibility-test/fixtures/sonarqube-dce/ca-certificates-secret.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ metadata:
7676
heritage: Helm
7777
type: Opaque
7878
data:
79-
SONAR_AUTH_JWTBASE64HS256SECRET: ""
79+
SONAR_AUTH_JWTBASE64HS256SECRET: "c29tZS1zZWNyZXQ="
8080
---
8181
# Source: sonarqube-dce/templates/secret.yaml
8282
---
@@ -403,7 +403,7 @@ spec:
403403
annotations:
404404
checksum/plugins: 02ed19b642943e663f38735420eb71a86a72bc8decf121e5dee94fe6bd0a2e93
405405
checksum/config: a6b7f0fd2ac14026c8a6411fe253bcaecd9c9a1df808ff506fb53af6d72385e6
406-
checksum/secret: 3becd5d31be9df39332441d3fd675b9f0f92cba26a8cf489bbc7b195a54fe9c6
406+
checksum/secret: e9b03728d46108380e928ac3b261daff37a38fb55d73ba80bc12190e5f11ae51
407407
spec:
408408
automountServiceAccountToken: false
409409
initContainers:
@@ -799,7 +799,7 @@ spec:
799799
checksum/init-sysctl: 22cc1c844c39540f63da86297054685b42f1a7b30f5724a3ac1dc7c87f7343f1
800800
checksum/init-fs: 7e710847fac552e19060ee83d35d1f18d09a367ddee33f17b1fa5fc4942b834c
801801
checksum/config: a6b7f0fd2ac14026c8a6411fe253bcaecd9c9a1df808ff506fb53af6d72385e6
802-
checksum/secret: 3becd5d31be9df39332441d3fd675b9f0f92cba26a8cf489bbc7b195a54fe9c6
802+
checksum/secret: e9b03728d46108380e928ac3b261daff37a38fb55d73ba80bc12190e5f11ae51
803803
spec:
804804
automountServiceAccountToken: false
805805
initContainers:

‎tests/unit-compatibility-test/fixtures/sonarqube-dce/change-admin-password-hook-values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ metadata:
7676
heritage: Helm
7777
type: Opaque
7878
data:
79-
SONAR_AUTH_JWTBASE64HS256SECRET: ""
79+
SONAR_AUTH_JWTBASE64HS256SECRET: "c29tZS1zZWNyZXQ="
8080
---
8181
# Source: sonarqube-dce/templates/secret.yaml
8282
apiVersion: v1
@@ -416,7 +416,7 @@ spec:
416416
annotations:
417417
checksum/plugins: fba434ce910a0bb523913cbfe9ab0e2b422cab6cc534bb62c78d2b2beed9fe42
418418
checksum/config: 40e1d013116c1b57a1b296e5a5de956c79bfd4c5de73d4ca9fcd783ad1bba5ec
419-
checksum/secret: 7dbef8d9b088aceee1c55756efe66344220c03fbd0727bd254b3571e06b65769
419+
checksum/secret: 640b684f0291cc17fb4e3822b55cb3e8a739e012ec8b81461eff0fda6057c60f
420420
spec:
421421
automountServiceAccountToken: false
422422
initContainers:
@@ -785,7 +785,7 @@ spec:
785785
checksum/init-sysctl: a5ac379545dd2307eae35cf4b7c8c32a50b3202089e02b7f81d4f537adaf8851
786786
checksum/init-fs: a3cbfaa6bed90db39cd45a7938f41a3b1406128dda539a091bfbb3571472bfe5
787787
checksum/config: 40e1d013116c1b57a1b296e5a5de956c79bfd4c5de73d4ca9fcd783ad1bba5ec
788-
checksum/secret: 7dbef8d9b088aceee1c55756efe66344220c03fbd0727bd254b3571e06b65769
788+
checksum/secret: 640b684f0291cc17fb4e3822b55cb3e8a739e012ec8b81461eff0fda6057c60f
789789
spec:
790790
automountServiceAccountToken: false
791791
initContainers:

0 commit comments

Comments
 (0)