​
Prerequisites

Before proceeding, ensure you have the following prerequisites in place:

  1. Create two kubernetes node groups (for application & analysis workloads) and label the nodes in the node groups (eg: workload: deepsource-application & workload: deepsource-analysis)

    1. The minimum specifications for the nodes are as follows:

      1. Application Node group

        1. CPU: 16 Cores
        2. Memory:32 GiB
        3. Disk:128 GiB

      2. Analysis Node group

        1. CPU:16 Cores
        2. Memory:32 GiB
        3. Disk:256 GiB

  2. Create two namespaces

    1. deepsource-application - kubectl create ns deepsource-application
    2. deepsource-analysis - kubectl create ns deepsource-analysis

  3. Create an external database using the following guide: /docs/enterprise-server-configuration#bring-your-own-database. You can skip this step for pilot installation.

  4. Obtain a license by reaching out to sales@deepsource.io

  5. Make sure to use at least helm v3.8.0, prior versions require HELM_EXPERIMENTAL_OCI=1environment variable to be set.

​
Install

  1. Login to the helm registry using the obtained credentials
  2. Obtain the default values.yaml file from the chart and write to a file
  3. Make the necessary changes to the newly created values.yaml file by following the configuration guide.
  4. Install DeepSource Enterprise Server

​
Upgrade

  1. Login to the registry using the obtained credential

  2. Upgrade DeepSource Enterprise Server using your existing values.yaml

    Go through the changelog.md in the helm package to make sure there aren’t any breaking changes.

​
Configuration

  • All the values with changeme as the default value must be changed and are considered a security risk if left unchanged.
  • Wherever applicable, If you have a value that contains newlines (for example, a private key), use a multi-line literal style yaml string (starts with |).
  • The Persistent Volumes (PVs) don’t get cleaned up automatically when the chart is uninstalled. You need to manually delete the PVs if you want to clean up the data.

​
Global configuration creation parameters

NameDescriptionValue
global.secret.createDetermines whether to create a secret. Set to true to create. Set to false if you want to manage secrets yourself (using the external-secrets operator, for example).true
global.cm.createDetermines whether to create a configuration map. Set to true to create. Do not set it to false unless you really know what you are doing.true

​
Cluster Settings configuration parameters

​
Analysis node group configuration parameters

NameDescriptionValue
global.clusterSettings.analysis.namespaceNamespace for analysis jobsdeepsource-analysis
global.clusterSettings.analysis.nodeSelectorNode selector for analysis nodes{}
global.clusterSettings.analysis.tolerationsTolerations for analysis nodes{}
global.clusterSettings.analysis.affinityAffinity settings for analysis nodes{}

​
Application node group configuration parameters

NameDescriptionValue
global.clusterSettings.application.namespaceNamespace for applicationdeepsource-application
global.clusterSettings.application.nodeSelectorNode selector for application nodes{}
global.clusterSettings.application.tolerationsTolerations for application nodes{}
global.clusterSettings.application.affinityAffinity settings for application nodes{}

​
Version Control System (VCS) configuration parameters

​
Github configuration parameters

NameDescriptionValue
global.vcs.github.enabledDetermines whether GitHub integration is enabled. Learn how to configure the application here.false
global.vcs.github.secret.appIdThe App ID for your GitHub App. You can find this in your GitHub App settings.""
global.vcs.github.secret.appSlugGitHub generates a slug for each app based on its name. It is the last part of the public link of your app.""
global.vcs.github.secret.clientIdThe Client ID for your GitHub App.""
global.vcs.github.secret.secretKeyThe client secret for your GitHub App.""
global.vcs.github.secret.webhookSecretEnter the webhook secret you supplied while creating the app.""
global.vcs.github.secret.privateKeyAfter creating the app, generate a private key for token requests and paste it here as a multi-line literal style yaml string""

​
Github Enterprise configuration parameters

NameDescriptionValue
global.vcs.githubEnterprise.enabledDetermines whether GitHub Enterprise integration is enabled. Learn how to configure the application here.false
global.vcs.githubEnterprise.secret.hostDomainEnter the hostname of your GitHub instance, e.g., github.example.com.""
global.vcs.githubEnterprise.secret.appIdThe App ID for your GitHub Enterprise App.""
global.vcs.githubEnterprise.secret.appSlugGitHub generates a slug for each app based on its name. It is the last part of the public link of your app.""
global.vcs.githubEnterprise.secret.clientIdThe Client ID for your GitHub Enterprise App.""
global.vcs.githubEnterprise.secret.secretKeyThe client secret for your GitHub Enterprise App.""
global.vcs.githubEnterprise.secret.webhookSecretEnter the webhook secret you supplied while creating the app.""
global.vcs.githubEnterprise.secret.privateKeyAfter creating the app, generate a private key for token requests and paste it here as a multi-line literal style yaml string""

​
Gitlab configuration parameters

NameDescriptionValue
global.vcs.gitlab.enabledDetermines whether GitLab integration is enabled. Learn how to configure the application here.false
global.vcs.gitlab.cm.versionSet the Gitlab Server version you are currently using, if it is the self-hosted version.""
global.vcs.gitlab.secret.hostDomainEnter the hostname of your GitLab instance, e.g., gitlab.example.com.""
global.vcs.gitlab.secret.appIdEnter the generated Application ID for your GitLab App.""
global.vcs.gitlab.secret.appNameThe name of your GitLab App.""
global.vcs.gitlab.secret.appSecretSecret generated by GitLab on creation of the app.""
global.vcs.gitlab.secret.webhookSecretEnter a desired webhook secret for GitLab. Ensure that the secret matches the value you configured here.changeme

​
Bitbucket configuration parameters

NameDescriptionValue
global.vcs.bitbucket.enabledDetermines whether Bitbucket integration is enabled. Learn how to configure the application here.false
global.vcs.bitbucket.secret.addonClientIdThe client ID of your Bitbucket app.""
global.vcs.bitbucket.secret.addonSecretThe secret of your Bitbucket app.""
global.vcs.bitbucket.secret.oAuthClientIdThe Bitbucket OAuth consumer key.""
global.vcs.bitbucket.secret.oAuthSecretThe Bitbucket OAuth consumer secret.""

​
Bitbucket Data Center configuration parameters

NameDescriptionValue
global.vcs.bitbucketDataCenter.enabledDetermines whether Bitbucket Data Center integration is enabled. Learn how to configure the application here.false
global.vcs.bitbucketDataCenter.cm.hostSchemeHTTP scheme of your Bitbucket Data Center instance (options: http or https).https
global.vcs.bitbucketDataCenter.cm.hostDomainhostname of your Bitbucket Data Center instance (e.g. bitbucket.acme.com).""
global.vcs.bitbucketDataCenter.secret.oAuth2KeyClient ID generated by Bitbucket Data Center on creation of the OAuth2 app.""
global.vcs.bitbucketDataCenter.secret.oAuth2SecretClient secret generated by Bitbucket Data Center on creation of the OAuth2 app.""
global.vcs.bitbucketDataCenter.secret.webhookSecretA desired webhook secret for Bitbucket Data Center.changeme

​
AzureDevOps configuration parameters

NameDescriptionValue
global.vcs.azureDevOps.enabledDetermines whether Azure DevOps integration is enabled. Learn how to configure the application here.false
global.vcs.azureDevOps.secret.hostDomainThe domain of your Azure DevOps instance.""
global.vcs.azureDevOps.secret.authorityHostThe authority host for Azure DevOps.""
global.vcs.azureDevOps.secret.applicationIdThe Application ID for Azure DevOps.""
global.vcs.azureDevOps.secret.applicationSecretThe Application Secret for Azure DevOps.""
global.vcs.azureDevOps.secret.webhookSecretEnter the webhook secret for Azure DevOps.""

​
GSR configuration parameters

NameDescriptionValue
global.vcs.gsr.enabledDetermines whether GSR integration is enabled. Learn how to configure the application here.false
global.vcs.gsr.secret.cliendIdGSR Client ID.""
global.vcs.gsr.secret.clientSecretGSR Client Secret.""
global.vcs.gsr.secret.webhookAudienceString entered in the Audience section for authentication of webhooks.""

​
Backend Services/Dependencies configuration parameters

​
RabbitMQ configuration parameters

NameDescriptionValue
global.backendServices.rabbitmq.embedded.deploySet to true if RabbitMQ should be deployed.true
global.backendServices.rabbitmq.secret.hostHostname for RabbitMQ.rabbitmq.deepsource-application
global.backendServices.rabbitmq.secret.portPort for RabbitMQ.5672
global.backendServices.rabbitmq.secret.protocolProtocol for RabbitMQ.amqp
global.backendServices.rabbitmq.secret.erlangCookieErlang Cookie for RabbitMQ.changeme
global.backendServices.rabbitmq.secret.services.atlas.usernameUsername for the Atlas RabbitMQ user.atlas
global.backendServices.rabbitmq.secret.services.atlas.passwordPassword for the Atlas RabbitMQ user.changeme
global.backendServices.rabbitmq.secret.services.asgard.usernameUsername for the Asgard RabbitMQ user.asgard
global.backendServices.rabbitmq.secret.services.asgard.passwordPassword for the Asgard RabbitMQ user.changeme
global.backendServices.rabbitmq.secret.services.janus.usernameUsername for the Janus RabbitMQ user.janus
global.backendServices.rabbitmq.secret.services.janus.passwordPassword for the Janus RabbitMQ user.changeme
global.backendServices.rabbitmq.secret.services.mater.usernameUsername for the Mater RabbitMQ user.mater
global.backendServices.rabbitmq.secret.services.mater.passwordPassword for the Mater RabbitMQ user.changeme
global.backendServices.rabbitmq.secret.services.admin.usernameUsername for the Admin RabbitMQ user.admin
global.backendServices.rabbitmq.secret.services.admin.passwordPassword for the Admin RabbitMQ user.changeme

​
Redis configuration parameters

NameDescriptionValue
global.backendServices.redis.embedded.deploySet to true if Redis should be deployed.true
global.backendServices.redis.secret.hostHostname for Redis. (Change the Host if namespace is different from deepsource-application)redis-haproxy.deepsource-application
global.backendServices.redis.secret.portPort for Redis.6379
global.backendServices.redis.secret.protocolProtocol for Redis.redis
global.backendServices.redis.services.atlas.machinery.databaseDatabase for the Atlas Redis user.3
global.backendServices.redis.services.atlas.publish.databaseDatabase for the Atlas Redis publish user.0
global.backendServices.redis.services.asgard.databaseDatabase for the Asgard Redis user.0
global.backendServices.redis.services.janus.machinery.databaseDatabase for the Janus Redis machinery user.3
global.backendServices.redis.services.janus.hub.databaseDatabase for the Janus Redis hub user.4
global.backendServices.redis.services.janus.auth.databaseDatabase for the Janus Redis auth user.1
global.backendServices.redis.services.janus.auth.keyPrefixKey prefix for the Janus Redis auth user.:1:contrib.sessions.custom_cached_db

​
PostgreSQL configuration parameters

  • When using embedded PostgreSQL, the values once set are not changed. If you want to change the values, you need to delete the PostgreSQL PVCs & PVs and then change the values.
  • To configure your PostgreSQL database, follow the guide.
NameDescriptionValue
global.backendServices.postgresql.embedded.deploySet to true if PostgreSQL should be deployed.true
global.backendServices.postgresql.connectionPooler.deployDetermines whether to deploy the connection pooler (PgBouncer).true
global.backendServices.postgresql.secret.hostHostname for PostgreSQL. (Change the Host if namespace is different from deepsource-application OR if you are bringing your own database)postgresql.deepsource-application
global.backendServices.postgresql.secret.portPort for PostgreSQL.5432
global.backendServices.postgresql.secret.databaseName for the PostgreSQL database.asgard
global.backendServices.postgresql.secret.userUser for PostgreSQL database.asgard
global.backendServices.postgresql.secret.passwordPassword for the PostgreSQL database.changeme

​
Minio/S3 Compatible Storage configuration parameters

NameDescriptionValue
global.backendServices.minio.embedded.deploySet to true if Minio should be deployed.true
global.backendServices.minio.secret.accessKeyAccess key for Minio/S3.deepsource
global.backendServices.minio.secret.secretKeySecret key for Minio/S3.changeme
global.backendServices.minio.secret.endpointEndpoint for Minio/S3. (Change the Host if namespace is different from deepsource-application)minio.deepsource-application:9000
global.backendServices.minio.secret.signatureSignature type for Minio/S3.s3v2
global.backendServices.minio.secret.useSSLDetermines whether to use SSL for Minio. (If bringing your own minio)false
global.backendServices.minio.cm.buckets.artifacts.nameName for the Minio artifacts bucket.asgard-artifacts
global.backendServices.minio.cm.buckets.staticFiles.nameName for the Minio static files bucket.prod-asgard-static
global.backendServices.minio.cm.buckets.codeCache.nameName for the Minio code cache bucket.analysis-code-cache
global.backendServices.minio.cm.buckets.logs.nameName for the Minio logs bucket.deepsource-logs

​
Auth configuration parameters

NameDescriptionValue
global.auth.adminsComma separated emails of users who should be promoted to “Enterprise Admins” and will have access to the Enterprise Control Panel which will allow them to manage other users and view installation-wide audit logs and reports.[admin@example.org]

​
SAML configuration parameters

NameDescriptionValue
global.auth.saml.enabledDetermines whether SAML authentication is enabled.false
global.auth.saml.idpMetadataUrlIdP metadata URL, follow the guide for your respective Identity Provider to get this value.""

​
SCIM configuration parameters

NameDescriptionValue
global.auth.scim.enabledEnable SCIM provisioning.false
global.auth.scim.authTokenEnter a strong secret for SCIM provisioning.""
global.auth.socialAuth.enabledDetermines whether social authentication is enabled.false

​
Networking configuration parameters

NameDescriptionValue
global.networking.primaryDomainHostname at which the DeepSource dashboard would be accessible, e.g. deepsource.example.comdeepsource.example.com
global.networking.customAllowedHostsComma-separated list of internal hostnames/IPs that will access the DeepSource Dashboard (other than the “Primary Domain” already set above).""
global.networking.redirectUriHostnameCustom hostname to use for OAuth redirect URIs""

​
Ingress configuration parameters

Controller configuration parameters
NameDescriptionValue
global.networking.ingress.controller.embedded.deploySet to true if there is no Ingress controller in your cluster or false if your cluster already has an existing ingress controllerfalse
global.networking.ingress.controller.classNameClass name of the Ingress controllernginx
global.networking.ingress.controller.annotationsAnnotations for the Ingress controller. Add your own annotations if you are bringing your own Ingress controller, otherwise use the annotations from the values.yaml file given.{}
TLS configuration parameters
NameDescriptionValue
global.networking.ingress.tls.enabledEnable TLS for Ingresstrue
global.networking.ingress.tls.certManager.deploySet to true if cert-manager should be deployed for certificate managementfalse
global.networking.ingress.tls.secret.tlsCrtSecret containing the TLS certificate""
global.networking.ingress.tls.secret.tlsKeySecret containing the TLS private key""
global.networking.ingress.tls.secret.tlsEmailEmail used for registering TLS certificate (if using cert-manager)""
CustomCA configuration parameters
NameDescriptionValue
global.networking.customCA.uploadSet to true if using a custom CA for TLSfalse
global.networking.customCA.secret.caBundleSecret containing the custom CA bundle, make sure it is in PEM format and full chain""

​
Integrations configuration parameters

​
Slack integration configuration parameters

NameDescriptionValue
global.integrations.slack.enabledEnable Slack integrationfalse
global.integrations.slack.secret.clientIdClient ID for Slack integration""
global.integrations.slack.secret.clientSecretClient Secret for Slack integration""
global.integrations.slack.secret.signingSecretSigning Secret for Slack integration""

​
Jira integration configuration parameters

NameDescriptionValue
global.integrations.jira.enabledEnable Jira integrationfalse
global.integrations.jira.secret.clientIdClient ID for Jira integration""
global.integrations.jira.secret.clientSecretClient Secret for Jira integration""

​
Deployment Settings configuration parameters

NameDescriptionValue
global.deploymentSettings.image.repositoryOCI image repositoryregistry.deepsource.com/images/deepsource-production
global.deploymentSettings.image.pullPolicyImage pull policyIfNotPresent
global.deploymentSettings.imagePullSecretsImage pull secretsundefined
global.deploymentSettings.logging.verbose.enabledEnable verbose loggingfalse
global.deploymentSettings.beta.enabledEnable beta featuresfalse
global.deploymentSettings.airgap.enabledEnable airgap deploymentfalse
global.deploymentSettings.secret.cacheMasterKeySecret for cache master keychangeme
global.deploymentSettings.secret.accessTokenSaltSalt for access token generation, should be 22 characters long with no ’$’ symbolchangeme
global.deploymentSettings.podAnnotationsCommon annotations for podsundefined

​
External Registry configuration parameters

Currently we support Sonatype Nexus as an external registry.

NameDescriptionValue
global.deploymentSettings.externalRegistry.sonatypeNexus.secret.usernameUsername for external registry""
global.deploymentSettings.externalRegistry.sonatypeNexus.secret.hostHost for external registry""
global.deploymentSettings.externalRegistry.sonatypeNexus.secret.passwordPassword for external registry""
global.deploymentSettings.externalRegistry.sonatypeNexus.secret.protocolProtocol for external registry (e.g., https)http
global.deploymentSettings.externalRegistry.sonatypeNexus.languageRegistry.python.pathPath for Python packages in the external registry""
global.deploymentSettings.externalRegistry.sonatypeNexus.languageRegistry.go.pathPath for Go packages in the external registry""
global.deploymentSettings.externalRegistry.sonatypeNexus.languageRegistry.kotlin.pathPath for Kotlin packages in the external registry""

​
Reporting configuration parameters

NameDescriptionValue
global.reporting.error.enabledEnable error reportingfalse

​
License configuration parameters

NameDescriptionValue
global.license.tokenLicense token as a string""

​
Troubleshooting

​
Generate support-bundle

  1. Make sure yq is installed on your system. To Install. yq follow the installation guide: https://mikefarah.gitbook.io/yq/v/v3.x/

  2. We use kubectl support-bundle plugin from troubleshoot.sh. To install support-bundle follow this guide:

    1. Install krew for your system from https://krew.sigs.k8s.io/docs/user-guide/setup/install/
    2. Once krew is installed and working run the following command

  3. Generate the support-bundle by running the following command:

​
Admin permission issues during initial setup

If you are having permission issues despite your email being in the global.auth.admins block in values file, run the following command after making sure all the DeepSource application pods are up and running.

APP_NAMESPACE="<deepsource-application-namespace>"; kubectl exec $(kubectl get pods -l app.kubernetes.io/name=asgard-main -n $APP_NAMESPACE -o jsonpath="{.items[0].metadata.name}") -n $APP_NAMESPACE -- python manage.py update_superusers

​
Manually running the migration

During installation or upgrade, the migrate job that runs post-install might fail due to various reasons after the backoff-limit is reached. To manually trigger the migration process run the following command

APP_NAMESPACE="<deepsource-application-namespace>"; kubectl exec $(kubectl get pods -l app.kubernetes.io/name=asgard-celery-serveanlytics -n $APP_NAMESPACE -o jsonpath="{.items[0].metadata.name}") -n $APP_NAMESPACE -- make bucket compress migrate
Airgapped InstallationOverview