Kubernetes and OpenShift Deployment Patterns: Core Concepts and Mental Model

1. Current orchestration baseline: Pods are replaceable, state is not

The current reproducible baseline is SonarQube Community Build 26.9.0.129388 rendered by released Helm chart 2026.4.1. The chart release supports Kubernetes 1.32–1.35 and OpenShift 4.17–4.20. Its default Community Build is older than the current product release, so this chapter always records both the chart version and the explicit community.buildNumber.

2. Mental model: chart input to durable service

flowchart TD
R[Chart release + values] --> H[Helm render]
S[Secrets] --> H
SC[StorageClass / PVC policy] --> H
DB[(External database)] --> N[Cluster network / DNS]
H --> O[Kubernetes objects]
O --> P[SonarQube Pod]
O --> V[(PVC)]
O --> SV[Service]
O --> RP[Ingress / Route / HTTPRoute]
NODE[Node/kernel prerequisites] --> P
N --> P
P --> DB
P --> V
SV --> P
RP --> SV
P --> Q[Readiness / liveness / logs]
Q --> OPS[Operational evidence]

Helm is a renderer and release manager, not a persistence layer. A Pod is replaceable runtime state. A PVC is a claim on storage whose durability depends on its StorageClass and backing system. A Secret stores sensitive configuration but is not automatically an external secret manager. A Service provides stable in-cluster addressing. Ingress, OpenShift Route, and Gateway API objects are separate edge-routing choices. The supported database remains the durable SonarQube application store.

3. State stores you must not collapse into “the cluster”

4. Pod Security and OpenShift are configuration, not magic

The maintained chart classifies SonarQube application and ordinary init containers as compatible with the Kubernetes restricted Pod Security level. The init-sysctl helper is privileged and init-fs needs root-oriented filesystem repair behavior. For a full restricted namespace, SonarSource recommends disabling both helpers and making node/kernel and storage ownership prerequisites an administrator responsibility.

initSysctl:
  enabled: false
initFs:
  enabled: false
containerSecurityContext:
  allowPrivilegeEscalation: false
  runAsNonRoot: true
  runAsUser: 1000
  seccompProfile:
    type: RuntimeDefault
  capabilities:
    drop: ["ALL"]

With OpenShift, set OpenShift.enabled=true and keep OpenShift.createSCC=false. The chart adapts to default SCCv2 behavior and disables helpers that conflict with the restricted model. Do not invent custom SCC grants merely to make an old manifest start.

5. Persistence: a PVC is a contract with a storage system

The current single-node chart has persistence.enabled=false by default. Enabling it creates or consumes a PVC; the chart defaults to a 5Gi ReadWriteOnce claim when you do not supply an existing claim. The actual durability, latency, snapshot, expansion, zone, and recovery semantics come from the selected StorageClass/backend.

6. Service, Ingress, Route, and Gateway API own different edges

The chart’s default Service is a ClusterIP on port 9000. That is an internal stable endpoint. External exposure is a separate decision. On OpenShift, a Route may be created when explicitly enabled. On Kubernetes, an Ingress resource can target a controller you manage. Current SonarSource material warns against treating a bundled ingress controller as production infrastructure and points toward Gateway API as the modern direction.

Mandatory labs keep routing internal or use kubectl port-forward only against an isolated local namespace. They do not publish a public hostname or teach TLS verification bypasses.

7. Read-only inspection before cluster mutation

helm version
kubectl version --client
helm repo add sonarqube https://SonarSource.github.io/helm-chart-sonarqube
helm repo update
helm show chart sonarqube/sonarqube --version 2026.4.1
helm show values sonarqube/sonarqube --version 2026.4.1 > sq-chart-2026.4.1-values.yaml

grep -nE 'community:|persistence:|initSysctl:|initFs:|OpenShift:|resources:|jdbcOverwrite:' sq-chart-2026.4.1-values.yaml

If a cluster is available, inspect it without mutation: kubectl get ns, kubectl get storageclass, kubectl auth can-i create deployments -n sq-ch05-lab, and available node capacity. Do not assume a local kubeconfig points to a disposable cluster.

8. Edition boundary: one chart is not every SonarQube topology

The sonarqube/sonarqube chart supports Community Build plus commercial Developer and Enterprise editions. The commercial Data Center Edition uses the separate sonarqube-dce chart with multiple application/search-node concepts and additional cluster secrets/topology. Community Build labs must not simulate “HA” by setting multiple replicas on the single-node chart.

SonarQube Cloud is a SaaS product and is not something you deploy with these charts.

9. Foundation mistakes to reject early

• “A Deployment manifest is the whole system.” It omits DB, storage, Secret, Service/routing, node and upgrade ownership.
• “Pod restart means recovery.” A restart can hide state loss, storage corruption, DB unavailability, or unresolved node prerequisites.
• “PVC means backup.” It does not create an independently restorable database backup.
• “OpenShift just needs a privileged SCC.” Current chart behavior is designed around restricted SCCv2 when configured correctly.
• “More replicas means Data Center.” DCE is a distinct commercial architecture and chart.

10. Why this matters in DevOps

Kubernetes adds automation but also adds control planes and indirection. A trustworthy deployment record must connect source/chart version, rendered values, Secret references, namespace/RBAC, storage class, database identity, network edge, security context, resource/probe state, and rollback inputs. That evidence lets an operator distinguish “the Pod is red” from the actual failed layer.

Knowledge check

Official references and version notes

• SonarQube Community Build — Kubernetes/OpenShift introduction — installation flow and platform boundary.
• Before you start — Kubernetes/OpenShift — resource, database, restricted-namespace, and production prerequisites.
• Customizing the Helm chart — OpenShift, security contexts, persistence, JDBC, ingress and TLS guidance.
• Installing the Helm chart — current Community Build install parameters and OpenShift example.
• Official SonarQube Helm chart repository — maintained chart source, values, changelog, and releases.
• SonarQube chart 2026.4.1 release — pinned released chart artifact used in this chapter.
• SonarQube chart README — edition, compatibility, Pod Security, resources, persistence, JDBC, OpenShift and upgrade guidance.
• SonarQube Data Center Helm chart — commercial Data Center topology and separate chart boundary.
• SonarQube Community Build releases — current Community Build release identity.
• Kubernetes Pod Security Standards — restricted/baseline/privileged namespace security model.
• Kubernetes Persistent Volumes — PVC, StorageClass and access-mode ownership.
• Kubernetes Gateway API — modern external-routing API discussed as a production option.