Continuous Inspection made easy

SonarQube on Azure

SonarQube is a SonarSource platform for continuous inspection of code quality to perform automatic reviews with static code analysis to detect various bugs, code smells, and security vulnerabilities on 20+ programming languages.

SonarQube server is available here: Install the Server. SonarSource provides examples using a standard installation with the zip file or Docker container using Docker images.

However, I wanted to have SonarQube deployed on Azure Service App with Azure SQL Database instance (a real-world scenario). A serverless approach with minimum maintenance. For once, I am accustomed to Azure, I have used it for a very long time, so this would be my natural choice.

Furthermore, the Azure App Service is excellent because it focuses more on the application than the infrastructure’s operational maintenance. It provides by default:

Prerequisites

Assuming the reader has already an Azure subscription:

Deployment

The Docker compose file of the solution consists of the SonarQube service exposing the port 9000.

We will use mounting volumes on Azure File Share and an external SQL database hosted on Azure for data persistence.

STEP 1: Azure Services

First deploy Azure services, either via Azure CLI or using Azure Portal, so that the resource group will host:

STEP 2: Azure File Share

On Azure Storage, add the below folders to Azure File Share:

STEP 3: Azure App Service

On Azure App Service, in the configuration, add below mappings:

STEP 4: SQL Database

Setup Azure SQL server and add SQL Database. A basic tier with 2 GB storage will suffice. Use connection string for JDBC; however, please do not place username and password in the given connection string. Credentials should be passed via environment variables in Docker compose a script.

Once the database is setup, create login and user, and assign permissions, for example:

Execute on master only:

Note: Password must comply with Password policy in Azure AD.

Execute on target database:

STEP 5: Running SonarQube

The last step is to enable Docker Compose in Azure App Service and save the below script:

Note: because SonarQube will migrate the database, the first run may take some time. From my experience: SonarQube application that uses Azure SQL Database on basic tier usually take a few minutes to take off.

To prevent from max virtual memory error we must disable use of memory mapping in ElasticSearch, thus we use the following options:

STEP 6: First login

After SonarQube is up and running, log in with:

And change the admin password so nobody else will log in to your SonarQube service. Additionally, one can navigate to the below address to quick check installed plugins:

https://<your_app_name>.azurewebsites.net/api/plugins/installed

For SonarQube 8.9 LTS, there should be around 15 plugins installed by default:

Other plugins can be easily added; just go to Administration -> Marketplace.

Conclusion

As we see, deploying and running SonarQube on Azure cloud is very easy. Once deployed, we can set up a project(s) and run Sonar Scanner to perform static code analysis (most likely in some CI/CD pipeline).

It is a handy tool that will surely improve your code in the long term by indicating bugs, code smells etc.

Thank you for reading this article! Please leave a comment should you have any questions or have a different experience.

Software Developer | Freelancer | Contractor