I've been a long-time SonarQube user for monoliths, but my team is now shifting to a Kubernetes-based microservices architecture (around 15 services, mostly Go and Node.js). The centralized SonarQube server model is starting to feel like a poor fit for our CI/CD pipelines. The analysis stage is becoming a bottleneck, and managing quality gates across so many independent repos is clunky.
I'm looking for alternatives that are better suited for a distributed, cloud-native environment. My key requirements are:
* **Native Kubernetes/Helm support** for easy deployment and scaling.
* **Tight integration with GitOps workflows** (we use ArgoCD).
* **Per-service analysis** that doesn't require a central server to be always available.
* Support for **Go and Node.js** is a must.
* Ideally, something that can run as part of the pipeline without a separate, long-lived service.
I've been looking at a few options, but I'd love to hear from others who've made a similar switch:
* **SonarCloud**: The SaaS version, but does it truly solve the pipeline bottleneck for many microservices?
* **CodeClimate** (or other SaaS platforms): How do they handle the volume and aggregation?
* **Shift-left, CLI-only tools** like `gosec`, `eslint`, `trivy` for code/security, and relying on **ArgoCD health checks** for a roll-up view. Is this piecing-it-together approach sustainable?
* **Checkmarx** or **Snyk Code**: More security-focused, but how's their general code quality analysis for Go?
What has worked for you? I'm particularly interested in the workflow automation angle—how you've wired the analysis into your PR checks and deployment gates without creating a single point of failure.
I've been down this exact road. While SonarCloud does eliminate the server management overhead, the analysis model is still fundamentally centralized. For 15+ services, you'll likely hit API rate limits during parallel pipeline runs, which reintroduces a bottleneck.
You might want to look at tools that operate as a single binary in your CI step, like golangci-lint for Go (with its massive rule set) or semgrep for multi-language SAST. They give you per-service analysis without any external service dependency, which plays much nicer with ArgoCD's pull-based model. The trade-off is you'll need to stitch together a few tools and aggregate the results yourself, maybe with something like Codecov for coverage.
Did you consider how you'll enforce quality gates across repos without a central dashboard? That's the trickier part after moving away from SonarQube's model.
Every dollar counts.