Kubernetes yaml file not getting scanned

SonarQube Cloud
1

Hi, here is a snippet of my log:

10:03:39.532 DEBUG 'apps/****.yaml' indexed with language 'kubernetes'
10:03:39.537 INFO 37 files indexed
10:03:39.541 DEBUG Available languages:
10:03:39.541 DEBUG * Secrets => "secrets"
10:03:39.544 DEBUG * Text => "text"
10:03:39.544 DEBUG * Ansible => "ansible"
10:03:39.545 DEBUG * Terraform => "terraform"
10:03:39.545 DEBUG * CloudFormation => "cloudformation"
10:03:39.545 DEBUG * Kubernetes => "kubernetes"
10:03:39.545 DEBUG * Docker => "docker"
10:03:39.545 DEBUG * AzureResourceManager => "azureresourcemanager"
10:03:39.545 DEBUG * YAML => "yaml"
10:03:39.545 DEBUG * JSON => "json"
10:03:39.545 INFO Quality profile for kubernetes: Kubernetes
10:03:39.545 INFO ------------- Run sensors on module ****
10:03:39.579 INFO Load metrics repository
10:03:39.584 DEBUG --> GET ****
10:03:39.696 DEBUG <-- 200 ****
10:03:39.701 INFO Load metrics repository (done) | time=123ms
10:03:39.706 INFO Sensor cache enabled
10:03:39.706 DEBUG Initialize GenericWsClient
10:03:39.706 DEBUG Loading OS trusted SSL certificates...
10:03:39.707 DEBUG This operation might be slow or even get stuck. You can skip it by passing the scanner property 'sonar.scanner.skipSystemTruststore=true'
10:03:39.859 DEBUG Loaded [440] system trusted certificates
10:03:39.870 INFO Load sensor cache
10:03:39.870 DEBUG --> GET ****
10:03:40.715 DEBUG <-- 200 ****
10:03:40.738 INFO Load sensor cache (404) | time=869ms
10:03:41.058 DEBUG 'Import external issues report' skipped because of missing configuration requirements.
Accessed configuration:
- sonar.externalIssuesReportPaths: <empty>
10:03:41.062 DEBUG 'IaC Ansible Sensor' skipped because there is no related file in current project
10:03:41.064 DEBUG 'IaC Terraform Sensor' skipped because there is no related file in current project
10:03:41.065 DEBUG 'IaC CloudFormation Sensor' skipped because there is no related file in current project
10:03:41.066 DEBUG 'IaC Kubernetes Sensor' skipped because there is no related file in current project
10:03:41.066 DEBUG 'IaC AzureResourceManager Sensor' skipped because there is no related file in current project
10:03:41.071 DEBUG 'Generic Coverage Report' skipped because of missing configuration requirements.

All 37 files are actually detected as Kubernetes, but the scanner is not running. Why?

5

Hi @Gr33n! Welcome to the community.

Could you please share the information about the environment in which you perform the analysis: is it sonar-scanner-cli or Maven/Gradle plugin, which version of SonarQube it connects to, etc.

If it is possible, it would be also great to see your Kubernetes files, or some minimal reproducers.

For now, I can say that indexing is only the first stage of assigning a language; these files are then checked by the Kubernetes sensor more carefully. Among other things, we are looking for some required keys in YAML files: apiVersion, kind, and metadata. Do your files contain them? Are you using any template engine (Kustomize? Helm?) for these files?

I can hopefully provide more details when I know more about your setup.

Cheers,

Peter

6

Hi Peter,

I believe it is sonar-scanner-cli, it is the SonarQube Cloud GitHub Action analysis method.

On the connected SonarQube, may I ask how do it check that? I am using SonarQube Cloud.

On the Kubernetes files, this is 1 out of the 37 files that are in the repo, even if the others are not scanned, I believe at least this one will be scanned and flagged:

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /var/run/docker.sock
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      path: /var/run/docker.sock
      type: Socket

Looking forward for your reply.

Thank you!

Gr33n

7

Hi,

Thanks for the info. The version of SonarQube is only applicable if you use a SonarQube Server instance, so no need to check it here.

Do you have any additional configuration in place? The part indexed with language 'kubernetes' seems weird to me. The way the analyzer works is the following. Since YAML files can be related to a lot of different languages, we index them with ‘yaml’ language, and then language-specific analyzers themselves can decide how to analyze them. This is also the case for the Kubernetes analyzer: it expects files with the ‘yaml’ language, and because your files are indexed with ‘kubernetes’, it ignores them (which sounds weird now that I think about it and worth fixing, but it’s not a setup that should happen normally).

For now, unfortunately, I’m not able to reproduce your case. In case you don’t have any additional configuration options, you can try to force indexing of these files as YAML with something like-Dsonar.yaml.file.suffixes=.yaml,.yml -Dsonar.kubernetes.file.suffixes=''.