Query about how SonarQube stores DB password

SonarQube Server / Community Build
,
1

Hi Team,

I have setup SonarQube 7.9.6 on Kubernetes platform. SQ is up and working fine as expected.
We are using AWS RDS service for Database(PostgreSQL).
As far as I know, DB URL, username and password is stored under conf/sonar.properites file in traditional setup. Since this setup is containerised, default sonar.properties under conf directory is not available.

We are interested to know how SonarQube fetches DB related information during restart of SQ service (when we restart SQ service from UI: Administration > System > System Info > Restart Server )

Moreover, during container initialisation, we pass DB related details through environment variables as below:

env:
          - name: "SONARQUBE_JDBC_USERNAME"
            value: {{ .Values.environment.username }}
          - name: "SONARQUBE_JDBC_URL"
            value: {{ .Values.environment.jdbcUrl }}
          - name: "SONARQUBE_JDBC_PASSWORD"
            valueFrom:
              secretKeyRef:
                name: {{ .Values.environment.password }}
                key: dbpassword

Here, we have defined below variables in Dockerfile:

ENV SONAR_VERSION=7.9.6 \
    SONARQUBE_HOME=/opt/sonarqube \
    SONARQUBE_JDBC_USERNAME=sonar \
    SONARQUBE_JDBC_PASSWORD=sonar \
    SONARQUBE_JDBC_URL=""

And passing these below parameters through run.sh

declare -a sq_opts

if [ -n "$SONARQUBE_JDBC_USERNAME" ]
then
    sq_opts+=("-Dsonar.jdbc.username=$SONARQUBE_JDBC_USERNAME")
fi
if [ -n "$SONARQUBE_JDBC_PASSWORD" ]
then
    sq_opts+=("-Dsonar.jdbc.password=$SONARQUBE_JDBC_PASSWORD")
fi
if [ -n "$SONARQUBE_JDBC_URL" ]
then
    sq_opts+=("-Dsonar.jdbc.url=$SONARQUBE_JDBC_URL")
fi

while IFS='=' read -r envvar_key envvar_value
do
    if [[ "$envvar_key" =~ sonar.* ]] || [[ "$envvar_key" =~ ldap.* ]]; then
        sq_opts+=("-D${envvar_key}=${envvar_value}")
    fi
done < <(env)

We understand that DB related values are getting fetched through environment variables and K8s secrets and this is applicable when pod/container gets started.

But when we restart SQ service from UI, how come SonarQube gets these DB related values ?

Thanks,
Vaibhav Jariwala.