SonarQube Plugin for Ansible

A SonarQube plugin to audit and keep under control your Ansible playbooks: apply development standards to your deployment scripts and manage your DevOps technical debt.

Features

This plugin leverages the YAML SonarQube plugin and adds some additional rules dedicated to Ansible:

• Support for all standard Ansible Lint rules
• Simple extension mechanism to add your own Ansible Lint rules with (very) limited knowledge of Java and Maven

Installation and execution

Requirements

• SonarQube 6.7 LTS, 7.9 LTS, 8.0+ (including 8.9 LTS), 9.0 or 9.1 with the SonarQube plugin for YAML (the exact required version is detailed in the release page of the Ansible plugin). Be aware that the YAML plugin has its own restrictions and compatibility (e.g. the version 1.6.0 and before are not compatible with SonarQube 9.1+).
• On the machine that will audit the code:
  • ansible-lint version 3.4+ must be installed
  • Sonar scanner configured to point to your Sonar server

Tested on Linux.

Installation

1. Download the YAML and Ansible SonarQube plugins
2. Copy them into the extensions/plugins directory of SonarQube and restart SonarQube
3. Log in SonarQube
4. Create a new quality profile for YAML and enable the Ansible rules (search with the tag "ansible")
5. Install Ansible Lint and the Sonar scanner on a Linux machine. If needed, you can set the path to the ansible-lint executable in the general settings of SonarQube (see below).

Configuration

The plugin supports different parameters that you can set in at the general or project level:

• Path to the ansible-lint executable. If not set, ansible-lint is expected to be available in the path (which should be the case for standard ansible-lint installations)
• As of version 2.2.0, path to an ansible-lint configuration file. If set, a -c option is passed to ansible-lint with the indicated configuration file path; if not set, no -c option is passed and ansible-lint will look at a .ansible-lint located in the same directory as the sonar-project.properties file.

Paths can be absolute or relative. Paths are relative to the root of the project.

Execution

1. Prior to executing a code audit, you must create a file sonar-project.properties that will contain some details about your project (this is a requirement from the Sonar scanner):

   # must be unique in a given SonarQube instance
   sonar.projectKey=com.mycompany:my-playbook
   # this is the name and version displayed in the SonarQube UI. Was mandatory prior to SonarQube 6.1.
   sonar.projectName=A Name
   sonar.projectVersion=1.0-SNAPSHOT
   
   # Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
   # This property is optional if sonar.modules is set.
   sonar.sources=.
   
   # Encoding of the source code. Default is default system encoding
   #sonar.sourceEncoding=UTF-8

   You just have to do that once. Ideally, add this file along with your playbooks in your preferred SCM.

2. Run the Sonar scanner from the playbook directory:

   sonar-scanner

3. Go to SonarQube and check the result

Subsequent scans will just require the last step to be executed. It can easily be integrated into a continuous integration pipeline.

Severity levels mapping

As of version 3.5, Ansible Lint defines severities. Here is the mapping with SonarQube's severity levels:

Standard and extended rules

The default Ansible Lint rules are available by default (but not activated). So far:

Tags have been added to help identify the rules depending on the ansible-lint version installed on your system.

The Exxx rules are only available as of version 2.0.0 of this plugin and with ansible-lint version 3.5+. See the Ansible documentation.

As this plugin extends the YAML plugin, you can also enable and configure any other YAML rule.

Besides, you can easily add your own Ansible Lint rules: see the sonar-ansible-extras-plugin documentation.

Known issues

Plugin version 1.x.x not compatible with ansible-lint 3.5+

The version 1 of this plugin is not compatible with ansible-lint 3.5+. Please use ansible-lint version 3.4 with this first release of the plugin. Be aware that this may also apply to custom rules packaged into the extras plugin.

License

Copyright 2018-2021 Sylvain BAUDOIN

Licensed under the Apache License, Version 2.0