diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index 9f8ad6c40..4a9de7b9c 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -18,6 +18,7 @@ Use `**BREAKING**:` to denote a breaking change - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence. - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. +- Set `readOnlyRootFilesystem: true` by default on the `blobstore`, `cadvisor`, `otel-agent`, and `otel-collector` containers, and on the `pgsql-exporter` sidecar of `pgsql`, `codeintel-db`, and `codeinsights-db`. `blobstore` gets an `emptyDir` at `/tmp`. Added `postgresExporter.containerSecurityContext`, which the templates already read but `values.yaml` did not define, so the sidecar rendered `securityContext: null`; it sets no user, so the sidecar still runs as its database pod's user. Set `.containerSecurityContext.readOnlyRootFilesystem: false` to revert. ## 8.1.0 diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index 31e0d10fb..2760c7b60 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -93,7 +93,7 @@ In addition to the documented values, all services also support the following va | alpine.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `alpine` image | | alpine.image.name | string | `"alpine-3.14"` | Docker image name for the `alpine` image | | alpine.resources | object | `{"limits":{"cpu":"10m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}` | Resource requests & limits for the `alpine` initContainer, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | -| blobstore.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"runAsGroup":101,"runAsUser":100}` | Security context for the `blobstore` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| blobstore.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `blobstore` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | blobstore.enabled | bool | `true` | Enable `blobstore` (S3 compatible storage) | | blobstore.env | object | the chart will add some default environment values | Environment variables for the `blobstore` container | | blobstore.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `blobstore` image | @@ -106,7 +106,7 @@ In addition to the documented values, all services also support the following va | blobstore.storageAnnotations | object | `{}` | Optional annotations to add to the `blobstore` PVC | | blobstore.storageSize | string | `"100Gi"` | PVC Storage Request for `blobstore` data volume | | blobstore.storageSubPath | string | `""` | Optional subPath for the `blobstore` primary data volume mount | -| cadvisor.containerSecurityContext | object | `{"privileged":true}` | Security context for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| cadvisor.containerSecurityContext | object | `{"privileged":true,"readOnlyRootFilesystem":true}` | Security context for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | cadvisor.enabled | bool | `true` | Enable `cadvisor` | | cadvisor.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `cadvisor` image | | cadvisor.image.name | string | `"cadvisor"` | Docker image name for the `cadvisor` image | @@ -281,6 +281,7 @@ In addition to the documented values, all services also support the following va | nodeExporter.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `node-exporter` | | nodeExporter.serviceAccount.name | string | `"node-exporter"` | Name of the ServiceAccount to be created or an existing ServiceAccount | | openTelemetry.agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| openTelemetry.agent.containerSecurityContext.readOnlyRootFilesystem | bool | `true` | | | openTelemetry.agent.containerSecurityContext.runAsGroup | int | `101` | | | openTelemetry.agent.containerSecurityContext.runAsUser | int | `100` | | | openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318,"httpZpages":55679}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | @@ -298,6 +299,7 @@ In addition to the documented values, all services also support the following va | openTelemetry.gateway.config.traces.processors | object | `{}` | Define trace processors. Read how to configure sampling in the [OpenTelemetry documentation](https://docs.sourcegraph.com/admin/observability/opentelemetry#sampling-traces) | | openTelemetry.gateway.config.traces.tracePipelineProcessors | list | `[]` | Define the order in which processors are applied in the traces pipeline. When set, this takes precedence over the iteration order of `processors` (which cannot be relied on to preserve insertion order). Must contain exactly the same processor names as the keys of `processors`. | | openTelemetry.gateway.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| openTelemetry.gateway.containerSecurityContext.readOnlyRootFilesystem | bool | `true` | | | openTelemetry.gateway.containerSecurityContext.runAsGroup | int | `101` | | | openTelemetry.gateway.containerSecurityContext.runAsUser | int | `100` | | | openTelemetry.gateway.name | string | `"otel-collector"` | Name used by resources. Does not affect service names or PVCs. | @@ -328,6 +330,7 @@ In addition to the documented values, all services also support the following va | pgsql.storageAnnotations | object | `{}` | Optional annotations to add to the `pgsql` PVC | | pgsql.storageSize | string | `"200Gi"` | PVC Storage Request for `pgsql` data volume | | pgsql.storageSubPath | string | `""` | Optional subPath for the `pgsql` primary data volume mount | +| postgresExporter.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true}` | Security context for the `pgsql-exporter` sidecar container, which runs as the user of its database pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | postgresExporter.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `pgsql-exporter` image | | postgresExporter.image.name | string | `"postgres_exporter"` | Docker image name for the `pgsql-exporter` image | | postgresExporter.resources | object | `{"limits":{"cpu":"10m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}` | Resource requests & limits for the `pgsql-exporter` sidecar container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml index 8a1bd9273..e564ba490 100644 --- a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml +++ b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml @@ -89,6 +89,8 @@ spec: {{- end }} - name: blobstore mountPath: /blobstore + - name: tmpdir + mountPath: /tmp {{- if .Values.blobstore.extraVolumeMounts }} {{- toYaml .Values.blobstore.extraVolumeMounts | nindent 8 }} {{- end }} @@ -112,6 +114,8 @@ spec: claimName: blobstore - name: blobstore emptyDir: {} + - name: tmpdir + emptyDir: {} {{- if .Values.blobstore.extraVolumes }} {{- toYaml .Values.blobstore.extraVolumes | nindent 6 }} {{- end }} diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index dc02477c1..2ed24aeea 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -166,6 +166,7 @@ cadvisor: # You may also run `cadvisor` with reduced privileges by setting # `cadvisor.containerSecurityContext.privileged=false` in your override file privileged: true + readOnlyRootFilesystem: true codeInsightsDB: # -- Enable `codeinsights-db` PostgreSQL server @@ -682,6 +683,7 @@ blobstore: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 + readOnlyRootFilesystem: true # -- Name used by resources. Does not affect service names or PVCs. name: "blobstore" # -- Resource requests & limits for the `blobstore` container, @@ -757,6 +759,7 @@ openTelemetry: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 + readOnlyRootFilesystem: true agent: # -- Name used by resources. Does not affect service names or PVCs. @@ -788,6 +791,7 @@ openTelemetry: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 + readOnlyRootFilesystem: true nodeExporter: # -- Enable `node-exporter` @@ -914,6 +918,11 @@ postgresExporter: defaultTag: 8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d # -- Docker image name for the `pgsql-exporter` image name: "postgres_exporter" + # -- Security context for the `pgsql-exporter` sidecar container, which runs as the user of its database pod, + # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) + containerSecurityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true # -- Resource requests & limits for the `pgsql-exporter` sidecar container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) resources: