# 代码质量检测策略配置
# 1. 提交前检测（Pre-commit）
# 2. 构建时检测（Build-time）
# 3. 部署前检测（Pre-deployment）
# 4. 定期检测（Scheduled）

# 代码质量标准定义
# 代码覆盖率：≥ 80%
# 代码复杂度：≤ 15
# 代码重复率：≤ 3%
# 安全漏洞：0个高危漏洞
# 代码规范：100%符合规范

# 权限模型设计
# 1. 平台管理员（Platform Admin）
# 2. 企业空间管理员（Workspace Admin）
# 3. 项目管理员（Project Admin）
# 4. 开发者（Developer）
# 5. 只读用户（Viewer）
# 6. 审计员（Auditor）

# 安全策略配置
# 1. 最小权限原则
# 2. 职责分离原则
# 3. 定期审计原则
# 4. 多因素认证原则
# 5. 定期密码更新原则

# 部署SonarQube
helm repo add sonarqube https://charts.sonarqube.org
helm repo update

# 创建命名空间
kubectl create namespace sonarqube

# 部署SonarQube
helm install sonarqube sonarqube/sonarqube \
–namespace sonarqube \
–set persistence.enabled=true \
–set persistence.storageClass=standard \
–set persistence.size=10Gi
NAME: sonarqube
LAST DEPLOYED: Thu Jan 15 10:00:00 2026
NAMESPACE: sonarqube
STATUS: deployed
REVISION: 1
NOTES:
1. Get the SonarQube URL:
export POD_NAME=$(kubectl get pods –namespace sonarqube -l app=sonarqube -o jsonpath=”{.items[0].metadata.name}”)
echo http://127.0.0.1:9000
kubectl –namespace sonarqube port-forward $POD_NAME 9000:9000

# 部署Trivy
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo update

# 创建命名空间
kubectl create namespace trivy

# 部署Trivy
helm install trivy aqua/trivy \
–namespace trivy \
–set image.repository=aquasec/trivy \
–set image.tag=latest
NAME: trivy
LAST DEPLOYED: Thu Jan 15 10:05:00 2026
NAMESPACE: trivy
STATUS: deployed
REVISION: 1

# 获取SonarQube管理员密码
kubectl get secret –namespace sonarqube sonarqube -o jsonpath=”{.data.admin-password}” | base64 –decode
admin123

# 访问SonarQube
，
kubectl port-forward -n sonarqube svc/sonarqube-sonarqube 9000:9000
Forwarding from 127.0.0.1:9000 -> 9000
Forwarding from [::1]:9000 -> 9000

# 使用SonarQube API创建项目
curl -u admin:admin123 \
-X POST \
“http://localhost:9000/api/projects/create?name=my-project&projectKey=my-project”
{“project”:{“key”:”my-project”,”name”:”my-project”,”qualifier”:”TRK”,”visibility”:”public”}}

# 创建令牌
curl -u admin:admin123 \
-X POST \
“http://localhost:9000/api/user_tokens/generate?name=my-token”
{“login”:”admin”,”name”:”my-token”,”token”:”squ_1234567890abcdef”,”createdAt”:”2026-01-15T10:10:00+0000″}

# 安装SonarQube Scanner插件
# 在Jenkins中安装SonarQube Scanner插件

# 配置SonarQube服务器
# Jenkins -> 系统管理 -> 系统配置 -> SonarQube servers
# 添加SonarQube服务器配置
# Name: sonarqube
# Server URL: http://sonarqube.sonarqube.svc.cluster.local:9000
# Server authentication token: squ_1234567890abcdef

# Jenkinsfile配置
pipeline {
agent any

tools {
maven ‘Maven 3.8.6’
jdk ‘JDK 11’
}

stages {
stage(‘Checkout’) {
steps {
git branch: ‘main’, url: ‘https://github.com/example/my-project.git’
}
}

stage(‘Build’) {
steps {
sh ‘mvn clean package’
}
}

stage(‘SonarQube Analysis’) {
steps {
withSonarQubeEnv(‘sonarqube’) {
sh ‘mvn sonar:sonar \
-Dsonar.projectKey=my-project \
-Dsonar.host.url=http://sonarqube.sonarqube.svc.cluster.local:9000 \
-Dsonar.login=squ_1234567890abcdef’
}
}
}

stage(‘Quality Gate’) {
steps {
timeout(time: 5, unit: ‘MINUTES’) {
waitForQualityGate abortPipeline: true
}
}
}
}
}

# 扫描Docker镜像
trivy image nginx:latest
2026-01-15T10:15:00.000Z INFO Need to update DB
2026-01-15T10:15:05.000Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db
2026-01-15T10:15:10.000Z INFO Downloading DB…
2026-01-15T10:15:20.000Z INFO Vulnerability scanning is complete
Total: 50 (UNKNOWN: 0, LOW: 10, MEDIUM: 30, HIGH: 8, CRITICAL: 2)

# 扫描并输出JSON格式
trivy image –format json –output trivy-report.json nginx:latest
Report saved to trivy-report.json

# 在Jenkinsfile中添加Trivy扫描
pipeline {
agent any

stages {
stage(‘Build Docker Image’) {
steps {
sh “docker build -t myapp:${BUILD_NUMBER} .”
}
}

stage(‘Trivy Scan’) {
steps {
sh “trivy image –severity HIGH,CRITICAL –exit-code 1 myapp:${BUILD_NUMBER}”
}
}

stage(‘Push Image’) {
steps {
sh “docker tag myapp:${BUILD_NUMBER} registry.example.com/myapp:${BUILD_NUMBER}”
sh “docker push registry.example.com/myapp:${BUILD_NUMBER}”
}
}
}
}

# 创建命名空间
kubectl create namespace myapp
namespace/myapp created

# 创建ServiceAccount
cat <<EOF | kubectl apply -f –
apiVersion: v1
，
kind: ServiceAccount
metadata:
name: myapp-sa
namespace: myapp
EOF
serviceaccount/myapp-sa created

# 创建Role
cat <<EOF | kubectl apply -f –
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: myapp-role
namespace: myapp
rules:
– apiGroups: [“”]
resources: [“pods”, “services”, “configmaps”]
verbs: [“get”, “list”, “watch”, “create”, “update”, “patch”]
– apiGroups: [“apps”]
resources: [“deployments”]
verbs: [“get”, “list”, “watch”, “create”, “update”, “patch”]
EOF
role.rbac.authorization.k8s.io/myapp-role created

# 创建RoleBinding
cat <<EOF | kubectl apply -f –
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: myapp-rolebinding
namespace: myapp
subjects:
– kind: ServiceAccount
name: myapp-sa
namespace: myapp
roleRef:
kind: Role
name: myapp-role
apiGroup: rbac.authorization.k8s.io
EOF
rolebinding.rbac.authorization.k8s.io/myapp-rolebinding created

# 创建网络策略
cat <<EOF | kubectl apply -f –
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: myapp-network-policy
namespace: myapp
spec:
podSelector:
matchLabels:
app: myapp
policyTypes:
– Ingress
– Egress
ingress:
– from:
– namespaceSelector:
matchLabels:
name: ingress-nginx
ports:
– protocol: TCP
port: 8080
egress:
– to:
– namespaceSelector:
matchLabels:
name: database
ports:
– protocol: TCP
port: 5432
– to:
– namespaceSelector: {}
ports:
– protocol: TCP
port: 53
EOF
networkpolicy.networking.k8s.io/myapp-network-policy created

# 创建Pod安全策略
cat <<EOF | kubectl apply -f –
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: myapp-psp
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
– ALL
volumes:
– ‘configMap’
– ’emptyDir’
– ‘projected’
– ‘secret’
– ‘downwardAPI’
– ‘persistentVolumeClaim’
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: ‘MustRunAsNonRoot’
seLinux:
rule: ‘RunAsAny’
fsGroup:
rule: ‘MustRunAs’
ranges:
– min: 1
max: 65535
supplementalGroups:
rule: ‘MustRunAs’
ranges:
– min: 1
max: 65535
readOnlyRootFilesystem: false
EOF
podsecuritypolicy.policy/myapp-psp created

# 创建RoleBinding绑定PodSecurityPolicy
cat <<EOF | kubectl apply -f –
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: myapp-psp-binding
namespace: myapp
roleRef:
kind: ClusterRole
name: psp:myapp-psp
apiGroup: rbac.authorization.k8s.io
，
subjects:
– kind: ServiceAccount
name: myapp-sa
namespace: myapp
EOF
rolebinding.rbac.authorization.k8s.io/myapp-psp-binding created

# 创建Secret
kubectl create secret generic myapp-secret \
–from-literal=username=admin \
–from-literal=password=admin123 \
-n myapp
secret/myapp-secret created

# 创建TLS Secret
kubectl create secret tls myapp-tls \
–cert=tls.crt \
–key=tls.key \
-n myapp
secret/myapp-tls created

# 创建Docker Registry Secret
kubectl create secret docker-registry myapp-registry \
–docker-server=registry.example.com \
–docker-username=admin \
–docker-password=admin123 \
–docker-email=admin@example.com \
-n myapp
secret/myapp-registry created

# 完整的CI/CD流水线Jenkinsfile
pipeline {
agent any

environment {
DOCKER_REGISTRY = ‘registry.example.com’
DOCKER_IMAGE = ‘myapp’
SONARQUBE_SERVER = ‘sonarqube’
SONARQUBE_TOKEN = credentials(‘sonarqube-token’)
}

tools {
maven ‘Maven 3.8.6’
jdk ‘JDK 11’
}

stages {
stage(‘Checkout’) {
steps {
git branch: ‘main’, url: ‘https://github.com/example/my-project.git’
}
}

stage(‘Unit Tests’) {
steps {
sh ‘mvn test’
junit ‘target/surefire-reports/*.xml’
}
}

stage(‘Code Coverage’) {
steps {
sh ‘mvn jacoco:report’
}
}

stage(‘SonarQube Analysis’) {
steps {
withSonarQubeEnv(env.SONARQUBE_SERVER) {
sh ‘mvn sonar:sonar \
-Dsonar.projectKey=my-project \
-Dsonar.host.url=http://sonarqube.sonarqube.svc.cluster.local:9000 \
-Dsonar.login=${SONARQUBE_TOKEN}’
}
}
}

stage(‘Quality Gate’) {
steps {
timeout(time: 5, unit: ‘MINUTES’) {
waitForQualityGate abortPipeline: true
}
}
}

stage(‘Build’) {
steps {
sh ‘mvn clean package -DskipTests’
}
}

stage(‘Build Docker Image’) {
steps {
sh “docker build -t ${DOCKER_IMAGE}:${BUILD_NUMBER} .”
}
}

stage(‘Trivy Scan’) {
steps {
sh “trivy image –severity HIGH,CRITICAL –exit-code 1 ${DOCKER_IMAGE}:${BUILD_NUMBER}”
}
}

stage(‘Push Image’) {
steps {
withCredentials([usernamePassword(credentialsId: ‘docker-registry’, usernameVariable: ‘DOCKER_USER’, passwordVariable: ‘DOCKER_PASS’)]) {
sh “docker login ${DOCKER_REGISTRY} -u ${DOCKER_USER} -p ${DOCKER_PASS}”
sh “docker tag ${DOCKER_IMAGE}:${BUILD_NUMBER} ${DOCKER_REGISTRY}/${DOCKER_IMAGE}:${BUILD_NUMBER}”
sh “docker push ${DOCKER_REGISTRY}/${DOCKER_IMAGE}:${BUILD_NUMBER}”
}
}
}

stage(‘Deploy to Staging’) {
steps {
withKubeConfig([
credentialsId: ‘kubeconfig-staging’,
serverUrl: ‘https://k8s-staging.example.com’
]) {
sh “kubectl set image deployment/myapp myapp=${DOCKER_REGISTRY}/${DOCKER_IMAGE}:${BUILD_NUMBER} -n myapp-staging”
sh “kubectl rollout status deployment/myapp -n myapp-staging”
}
}
}

，
stage(‘Integration Tests’) {
steps {
sh ‘mvn verify -DskipUnitTests’
}
}

stage(‘Deploy to Production’) {
when {
branch ‘main’
}
steps {
input message: ‘Deploy to production?’, ok: ‘Deploy’
withKubeConfig([
credentialsId: ‘kubeconfig-production’,
serverUrl: ‘https://k8s-production.example.com’
]) {
sh “kubectl set image deployment/myapp myapp=${DOCKER_REGISTRY}/${DOCKER_IMAGE}:${BUILD_NUMBER} -n myapp-production”
sh “kubectl rollout status deployment/myapp -n myapp-production”
}
}
}
}

post {
always {
cleanWs()
}
success {
echo ‘Pipeline succeeded!’
}
failure {
echo ‘Pipeline failed!’
}
}
}

# 触发Jenkins流水线
# 在Jenkins界面中点击”Build Now”

# 查看流水线执行日志
[Pipeline] Start of Pipeline
[Pipeline] node
Running on Jenkins in /var/jenkins_home/workspace/my-project
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Checkout)
[Pipeline] git
Cloning the remote Git repository
Cloning repository https://github.com/example/my-project.git
> git init /var/jenkins_home/workspace/my-project # timeout=10
Fetching upstream changes from https://github.com/example/my-project.git
> git –version # timeout=10
> git –version
using GIT_SSH to set credentials
> git fetch –tags –force –progress — https://github.com/example/my-project.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://github.com/example/my-project.git # timeout=10
> git config –add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://github.com/example/my-project.git # timeout=10
Checking out Revision abc123 (main)
> git config core.sparsecheckout # timeout=10
> git checkout -f abc123
Commit message: “Add new feature”
First time build. Skipping changelog.
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Unit Tests)
[Pipeline] sh
+ mvn test
[INFO] Scanning for projects…
[INFO] ————————————————————————
[INFO] BUILD SUCCESS
[INFO] ————————————————————————
[Pipeline] junit
Recording test results
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Code Coverage)
[Pipeline] sh
+ mvn jacoco:report
[INFO] ————————————————————————
[INFO] BUILD SUCCESS
[INFO] ————————————————————————
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (SonarQube Analysis)
[Pipeline] withSonarQubeEnv
Injecting SonarQube environment variables using the configuration: sonarqube
[Pipeline] {
[Pipeline] sh
+ mvn sonar:sonar -Dsonar.projectKey=my-project -Dsonar.host.url=http://sonarqube.sonarqube.svc.cluster.local:9000 -Dsonar.login=****
[INFO] ————————————————————————
[INFO] BUILD SUCCESS
[INFO] ————————————————————————
[Pipeline] }
[Pipeline] // withSonarQubeEnv
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Quality Gate)
[Pipeline] waitForQualityGate
Checking status of SonarQube task ‘AXXXXXXXXXXXXXXXXXXXXXX’ on server ‘sonarqube’
SonarQube task ‘AXXXXXXXXXXXXXXXXXXXXXX’ status is ‘IN_PROGRESS’
SonarQube task ‘AXXXXXXXXXXXXXXXXXXXXXX’ status is ‘SUCCESS’
Quality Gate passed
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Build)
[Pipeline] sh
+ mvn clean package -DskipTests
[INFO] ————————————————————————
[INFO] BUILD SUCCESS
[INFO] ————————————————————————
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Build Docker Image)
[Pipeline] sh
+ docker build -t myapp:123 .
Sending build context to Docker daemon 45.1MB
Step 1/8 : FROM openjdk:11-jre-slim
—> abc123def456
Step 2/8 : WORKDIR /app
—> Using cache
—> 789012ghi345
Step 3/8 : COPY target/myapp.jar /app/myapp.jar
—> 678901jkl234
Step 4/8 : EXPOSE 8080
—> Running in 567890mno567
Removing intermediate container 567890mno567
，
—> 456789pqr890
Step 5/8 : CMD [“java”, “-jar”, “myapp.jar”]
—> Running in 345678stu123
Removing intermediate container 345678stu123
—> 234567vwx890
Successfully built 234567vwx890
Successfully tagged myapp:123
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Trivy Scan)
[Pipeline] sh
+ trivy image –severity HIGH,CRITICAL –exit-code 1 myapp:123
2026-01-15T10:30:00.000Z INFO Need to update DB
2026-01-15T10:30:05.000Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db
2026-01-15T10:30:10.000Z INFO Downloading DB…
2026-01-15T10:30:20.000Z INFO Vulnerability scanning is complete
Total: 5 (UNKNOWN: 0, LOW: 2, MEDIUM: 2, HIGH: 1, CRITICAL: 0)
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Push Image)
[Pipeline] withCredentials
Masking supported pattern matches of $DOCKER_USER or $DOCKER_PASS
[Pipeline] {
[Pipeline] sh
+ docker login registry.example.com -u **** -p ****
WARNING! Using –password via the CLI is insecure. Use –password-stdin.
Login Succeeded
+ docker tag myapp:123 registry.example.com/myapp:123
+ docker push registry.example.com/myapp:123
The push refers to repository [registry.example.com/myapp]
1234567890ab: Pushed
abcdef123456: Pushed
123: digest: sha256:1234567890abcdef size: 1234
[Pipeline] }
[Pipeline] // withCredentials
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Deploy to Staging)
[Pipeline] withKubeConfig
[Pipeline] {
[Pipeline] sh
+ kubectl set image deployment/myapp myapp=registry.example.com/myapp:123 -n myapp-staging
deployment.apps/myapp image updated
+ kubectl rollout status deployment/myapp -n myapp-staging
deployment “myapp” successfully rolled out
[Pipeline] }
[Pipeline] // withKubeConfig
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Integration Tests)
[Pipeline] sh
+ mvn verify -DskipUnitTests
[INFO] ————————————————————————
[INFO] BUILD SUCCESS
[INFO] ————————————————————————
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Deploy to Production)
[Pipeline] input
Deploy to production?
Approved by admin
[Pipeline] withKubeConfig
[Pipeline] {
[Pipeline] sh
+ kubectl set image deployment/myapp myapp=registry.example.com/myapp:123 -n myapp-production
deployment.apps/myapp image updated
+ kubectl rollout status deployment/myapp -n myapp-production
deployment “myapp” successfully rolled out
[Pipeline] }
[Pipeline] // withKubeConfig
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
[Pipeline] cleanWs
[WS-CLEANUP] Deleting project workspace…
[WS-CLEANUP] Deferred wipeout is used…
[WS-CLEANUP] done
[Pipeline] }
[Pipeline] // ansiColor
[Pipeline] End of Pipeline
Finished: SUCCESS

# 查看Kubernetes审计日志
kubectl get events -n myapp –sort-by=’.lastTimestamp’
LAST SEEN TYPE REASON OBJECT MESSAGE
10m Normal Scheduled pod/myapp-7d6f8b9c5d-abc123 Successfully assigned myapp/myapp-7d6f8b9c5d-abc123 to node-1
10m Normal Pulling pod/myapp-7d6f8b9c5d-abc123 Pulling image “registry.example.com/myapp:123”
9m Normal Pulled pod/myapp-7d6f8b9c5d-abc123 Successfully pulled image “registry.example.com/myapp:123”
9m Normal Created pod/myapp-7d6f8b9c5d-abc123 Created container myapp
9m Normal Started pod/myapp-7d6f8b9c5d-abc123 Started container myapp
5m Normal Scaling deployment/myapp Scaled up replica set myapp-7d6f8b9c5d to 3

# 查看Pod日志
kubectl logs -n myapp deployment/myapp –tail=100
2026-01-15 10:00:00.000 INFO 12345 — [main] c.e.myapp.MyApplication : Starting MyApplication v1.0.0
2026-01-15 10:00:01.000 INFO 12345 — [main] c.e.myapp.MyApplication : The following profiles are active: production
2026-01-15 10:00:02.000 INFO 12345 — [main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8080 (http)
2026-01-15 10:00:02.000 INFO 12345 — [main] c.e.myapp.MyApplication : Started MyApplication in 2.345 seconds

# 使用SonarQube API获取项目状态
curl -u admin:admin123 \
“http://localhost:9000/api/measures/component?component=my-project&metricKeys=coverage,vulnerabilities,bugs,code_smells,duplicated_lines_density”
{
“component”: {
“id”: “AXXXXXXXXXXXXXXXXXXXXXX”,
“key”: “my-project”,
“name”: “My Project”,
“qualifier”: “TRK”,
“measures”: [
{
“metric”: “coverage”,
“value”: “85.5”
},
{
“metric”: “vulnerabilities”,
“value”: “0”
},
{
“metric”: “bugs”,
“value”: “2”
},
，
{
“metric”: “code_smells”,
“value”: “15”
},
{
“metric”: “duplicated_lines_density”,
“value”: “2.5”
}
]
}
}

# 查看Trivy扫描报告
cat trivy-report.json | jq ‘.Results[0].Vulnerabilities[] | select(.Severity == “HIGH” or .Severity == “CRITICAL”)’
{
“VulnerabilityID”: “CVE-2023-1234”,
“PkgName”: “openssl”,
“InstalledVersion”: “1.1.1”,
“FixedVersion”: “1.1.1k”,
“Severity”: “HIGH”,
“Title”: “OpenSSL: X.509 certificate verification bypass”,
“Description”: “OpenSSL before 1.1.1k allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted certificate.”,
“References”: [
“https://nvd.nist.gov/vuln/detail/CVE-2023-1234”
]
}