From 8baa4fe2b2b3a03e7a9faf7a8c62c356016854c8 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:11:17 +0000
Subject: [PATCH 01/16] sourcegraph: add labels to PVCs, ServiceAccounts, and
 RBAC objects

Render sourcegraph.labels on the standalone PersistentVolumeClaims, every
ServiceAccount, and the prometheus RBAC objects, and add per-component
storageLabels and serviceAccount.labels values, so a release that takes over
objects created outside the chart can keep the labels they already have.

Also fix the jaeger ServiceAccount, which read its name and annotations from
a tracing value that does not exist and failed to render.

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md               |   2 +
 charts/sourcegraph/README.md                  |  33 ++
 charts/sourcegraph/README.md.gotmpl           |  26 ++
 charts/sourcegraph/templates/_helpers.tpl     |  18 ++
 .../blobstore.PersistentVolumeClaim.yaml      |   4 +
 .../blobstore/blobstore.ServiceAccount.yaml   |   4 +
 .../cadvisor/cadvisor.ServiceAccount.yaml     |   4 +
 ...codeinsights-db.PersistentVolumeClaim.yaml |   4 +
 .../codeinsights-db.ServiceAccount.yaml       |   4 +
 .../codeintel-db.PersistentVolumeClaim.yaml   |   4 +
 .../codeintel-db.ServiceAccount.yaml          |   4 +
 .../frontend/sourcegraph-frontend.Role.yaml   |   3 +
 .../sourcegraph-frontend.RoleBinding.yaml     |   3 +
 .../sourcegraph-frontend.ServiceAccount.yaml  |   4 +
 .../gitserver/gitserver.ServiceAccount.yaml   |   4 +
 .../grafana/grafana.ServiceAccount.yaml       |   4 +
 .../indexed-search.ServiceAccount.yaml        |   4 +
 .../jaeger/jaeger.ServiceAccount.yaml         |   8 +-
 .../node-exporter.ServiceAccount.yaml         |   4 +
 .../otel-agent.ServiceAccount.yaml            |   4 +
 .../otel-collector.ServiceAccount.yaml        |   4 +
 .../pgsql/pgsql.PersistentVolumeClaim.yaml    |   4 +
 .../templates/pgsql/pgsql.ServiceAccount.yaml |   4 +
 .../worker.ServiceAccount.yaml                |   4 +
 .../prometheus/prometheus.ClusterRole.yaml    |   4 +
 .../prometheus.ClusterRoleBinding.yaml        |   4 +
 .../prometheus.PersistentVolumeClaim.yaml     |   4 +
 .../prometheus/prometheus.RoleBinding.yaml    |   4 +
 .../prometheus/prometheus.ServiceAccount.yaml |   4 +
 .../redis-cache.PersistentVolumeClaim.yaml    |   4 +
 .../redis/redis-cache.ServiceAccount.yaml     |   4 +
 .../redis-store.PersistentVolumeClaim.yaml    |   4 +
 .../redis/redis-store.ServiceAccount.yaml     |   4 +
 .../searcher/searcher.ServiceAccount.yaml     |   4 +
 .../worker.ServiceAccount.yaml                |   4 +
 .../syntect-server.ServiceAccount.yaml        |   4 +
 .../worker/worker.ServiceAccount.yaml         |   4 +
 .../serviceAccountAnnotations_test.yaml.snap  |  15 +
 .../serviceAccounts_test.yaml.snap            |  10 +
 .../sourcegraph/tests/objectLabels_test.yaml  | 283 ++++++++++++++++++
 .../tests/serviceAccountAnnotations_test.yaml |   4 +
 .../tests/serviceAccounts_test.yaml           |   4 +
 charts/sourcegraph/values.yaml                |  16 +
 43 files changed, 543 insertions(+), 2 deletions(-)
 create mode 100644 charts/sourcegraph/tests/objectLabels_test.yaml

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index a8b444320..e65281048 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,6 +9,8 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
+- Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
+- Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed `frontend.command` and `migrator.command` rendering a list as a single element, e.g. `["sh", "-c", "<script>"]` became `[sh -c <script>]`, so the container failed to start. Both are now rendered as YAML lists and documented in `values.yaml`. A string holding a YAML list, the only form that worked before, still renders unchanged.
 - Added `openTelemetry.gateway.command` to replace the `otel-collector` container's command, e.g. with a shell wrapper that exports an exporter API key read from a mounted file
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 23c93e059..69870cd2d 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -101,6 +101,31 @@ Set these values on the first install and never change them on an installed
 release: Kubernetes rejects the upgrade. Before installing, compare the
 `helm template` output with `kubectl get -o yaml` for each workload.
 
+Labels on other objects can be changed, so they never block an upgrade, but
+Helm only manages the labels the chart renders. To render the labels that the
+existing PersistentVolumeClaims, ServiceAccounts, and RBAC objects have:
+
+- `sourcegraph.labels` adds labels to all of them, on every component.
+- `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
+  `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`,
+  `redisCache`, or `redisStore`.
+- `<serviceName>.serviceAccount.labels` adds labels to one component's
+  ServiceAccount, and to the Role, RoleBinding, ClusterRole, and
+  ClusterRoleBinding of `frontend` and `prometheus`.
+
+```yaml
+sourcegraph:
+  labels:
+    example.com/project: sourcegraph
+blobstore:
+  storageLabels:
+    example.com/service: blobstore
+frontend:
+  serviceAccount:
+    labels:
+      example.com/service: frontend
+```
+
 Helm only takes over an existing object that has the
 `app.kubernetes.io/managed-by: Helm` label and the `meta.helm.sh/release-name`
 and `meta.helm.sh/release-namespace` annotations, or when installing with
@@ -129,6 +154,7 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.extraSelectorLabels` - add labels to the service's workload selector, pod labels, and Service and PodDisruptionBudget selectors. See [Adopting existing workloads](#adopting-existing-workloads)
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
+- `<serviceName>.serviceAccount.labels` - Labels for the service-specific service account, and for the Role, RoleBinding, ClusterRole, and ClusterRoleBinding of `frontend` and `prometheus`, in addition to `sourcegraph.labels`
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.
 
 | Key | Type | Default | Description |
@@ -146,6 +172,7 @@ In addition to the documented values, all services also support the following va
 | blobstore.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `blobstore` |
 | blobstore.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | blobstore.storageAnnotations | object | `{}` | Optional annotations to add to the `blobstore` PVC |
+| blobstore.storageLabels | object | `{}` | Optional labels to add to the `blobstore` PVC, in addition to `sourcegraph.labels` |
 | blobstore.storageSize | string | `"100Gi"` | PVC Storage Request for `blobstore` data volume |
 | blobstore.storageSubPath | string | `""` | Optional subPath for the `blobstore` primary data volume mount |
 | cadvisor.containerSecurityContext | object | `{"privileged":true}` | Security context for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
@@ -178,6 +205,7 @@ In addition to the documented values, all services also support the following va
 | codeInsightsDB.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `codeinsights-db` |
 | codeInsightsDB.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | codeInsightsDB.storageAnnotations | object | `{}` | Optional annotations to add to the `codeinsights-db` PVC |
+| codeInsightsDB.storageLabels | object | `{}` | Optional labels to add to the `codeinsights-db` PVC, in addition to `sourcegraph.labels` |
 | codeInsightsDB.storageSize | string | `"200Gi"` | PVC Storage Request for `codeinsights-db` data volume |
 | codeInsightsDB.storageSubPath | string | `""` | Optional subPath for the `codeinsights-db` primary data volume mount |
 | codeIntelDB.additionalConfig | string | `""` | Additional PostgreSQL configuration. This will override or extend our default configuration. Notes: This is expecting a multiline string. Learn more from our [recommended PostgreSQL configuration](https://docs.sourcegraph.com/admin/config/postgres-conf) and [PostgreSQL documentation](https://www.postgresql.org/docs/12/config-setting.html) |
@@ -200,6 +228,7 @@ In addition to the documented values, all services also support the following va
 | codeIntelDB.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `codeintel-db` |
 | codeIntelDB.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | codeIntelDB.storageAnnotations | object | `{}` | Optional annotations to add to the `codeintel-db` PVC |
+| codeIntelDB.storageLabels | object | `{}` | Optional labels to add to the `codeintel-db` PVC, in addition to `sourcegraph.labels` |
 | codeIntelDB.storageSize | string | `"200Gi"` | PVC Storage Request for `codeintel-db` data volume |
 | codeIntelDB.storageSubPath | string | `""` | Optional subPath for the `codeintel-db` primary data volume mount |
 | extraResources | list | `[]` | Additional resources to include in the rendered manifest. Templates are supported. |
@@ -374,6 +403,7 @@ In addition to the documented values, all services also support the following va
 | pgsql.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `pgsql` |
 | pgsql.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | pgsql.storageAnnotations | object | `{}` | Optional annotations to add to the `pgsql` PVC |
+| pgsql.storageLabels | object | `{}` | Optional labels to add to the `pgsql` PVC, in addition to `sourcegraph.labels` |
 | pgsql.storageSize | string | `"200Gi"` | PVC Storage Request for `pgsql` data volume |
 | pgsql.storageSubPath | string | `""` | Optional subPath for the `pgsql` primary data volume mount |
 | postgresExporter.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `pgsql-exporter` image |
@@ -407,6 +437,7 @@ In addition to the documented values, all services also support the following va
 | prometheus.serviceAccount.create | bool | `true` | Enable creation of ServiceAccount |
 | prometheus.serviceAccount.name | string | `"prometheus"` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | prometheus.storageAnnotations | object | `{}` | Optional annotations to add to the `prometheus` PVC |
+| prometheus.storageLabels | object | `{}` | Optional labels to add to the `prometheus` PVC, in addition to `sourcegraph.labels` |
 | prometheus.storageSize | string | `"200Gi"` | PVC Storage Request for `prometheus` data volume |
 | prometheus.storageSubPath | string | `""` | Optional subPath for the `prometheus` primary data volume mount |
 | redisCache.config.additionalConfig | string | `""` | Additional raw redis directives appended to the vendored `redis-cache` config. Notes: This is expecting a multiline string. It renders into a ConfigMap in plaintext, so do not put secrets such as `requirepass` here or in `existingConfig` (also a ConfigMap). For secrets, set `config.enabled: false` and mount a Secret using `extraVolumeMounts`. |
@@ -428,6 +459,7 @@ In addition to the documented values, all services also support the following va
 | redisCache.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `redis-cache` |
 | redisCache.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | redisCache.storageAnnotations | object | `{}` | Optional annotations to add to the `redis-cache` PVC |
+| redisCache.storageLabels | object | `{}` | Optional labels to add to the `redis-cache` PVC, in addition to `sourcegraph.labels` |
 | redisCache.storageSize | string | `"100Gi"` | PVC Storage Request for `redis-cache` data volume |
 | redisCache.storageSubPath | string | `""` | Optional subPath for the `redis-cache` primary data volume mount |
 | redisExporter.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Security context for the `redis-exporter` sidecar container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
@@ -453,6 +485,7 @@ In addition to the documented values, all services also support the following va
 | redisStore.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `redis-store` |
 | redisStore.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | redisStore.storageAnnotations | object | `{}` | Optional annotations to add to the `redis-store` PVC |
+| redisStore.storageLabels | object | `{}` | Optional labels to add to the `redis-store` PVC, in addition to `sourcegraph.labels` |
 | redisStore.storageSize | string | `"100Gi"` | PVC Storage Request for `redis-store` data volume |
 | redisStore.storageSubPath | string | `""` | Optional subPath for the `redis-store` primary data volume mount |
 | searcher.autoCacheSize | bool | `false` | When enabled, omit the `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB` env vars so `searcher` auto-sizes its cache to ~45% of the live cache volume. This tracks PVC expansion automatically, whereas the hardcoded env vars are frozen to the initial `storageSize` and do not follow later disk growth. |
diff --git a/charts/sourcegraph/README.md.gotmpl b/charts/sourcegraph/README.md.gotmpl
index af095bb94..d8fb65ea1 100644
--- a/charts/sourcegraph/README.md.gotmpl
+++ b/charts/sourcegraph/README.md.gotmpl
@@ -101,6 +101,31 @@ Set these values on the first install and never change them on an installed
 release: Kubernetes rejects the upgrade. Before installing, compare the
 `helm template` output with `kubectl get -o yaml` for each workload.
 
+Labels on other objects can be changed, so they never block an upgrade, but
+Helm only manages the labels the chart renders. To render the labels that the
+existing PersistentVolumeClaims, ServiceAccounts, and RBAC objects have:
+
+- `sourcegraph.labels` adds labels to all of them, on every component.
+- `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
+  `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`,
+  `redisCache`, or `redisStore`.
+- `<serviceName>.serviceAccount.labels` adds labels to one component's
+  ServiceAccount, and to the Role, RoleBinding, ClusterRole, and
+  ClusterRoleBinding of `frontend` and `prometheus`.
+
+```yaml
+sourcegraph:
+  labels:
+    example.com/project: sourcegraph
+blobstore:
+  storageLabels:
+    example.com/service: blobstore
+frontend:
+  serviceAccount:
+    labels:
+      example.com/service: frontend
+```
+
 Helm only takes over an existing object that has the
 `app.kubernetes.io/managed-by: Helm` label and the `meta.helm.sh/release-name`
 and `meta.helm.sh/release-namespace` annotations, or when installing with
@@ -129,6 +154,7 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.extraSelectorLabels` - add labels to the service's workload selector, pod labels, and Service and PodDisruptionBudget selectors. See [Adopting existing workloads](#adopting-existing-workloads)
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
+- `<serviceName>.serviceAccount.labels` - Labels for the service-specific service account, and for the Role, RoleBinding, ClusterRole, and ClusterRoleBinding of `frontend` and `prometheus`, in addition to `sourcegraph.labels`
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.
 
 {{ template "chart.valuesTable" . }}
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index 368e956fc..4b847139a 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -126,6 +126,24 @@ annotations:
 {{- end }}
 {{- end }}
 
+{{/*
+The labels set in <serviceName>.serviceAccount.labels, rendered on the
+component's ServiceAccount and on its Role, RoleBinding, ClusterRole, and
+ClusterRoleBinding, if it has any. Empty by default.
+
+Takes the same arguments as "sourcegraph.serviceAccountName".
+*/}}
+{{- define "sourcegraph.serviceAccountLabels" -}}
+{{- $top := index . 0 }}
+{{- if hasKey $top "Values" -}}
+{{- $top = index $top "Values" -}}
+{{- end -}}
+{{- $service := index . 1 }}
+{{- with (index $top $service "serviceAccount" "labels") }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
 {{/*
 Create the docker image reference and allow it to be overridden on a per-service basis
 Default tags are toggled between a global and service-specific setting by the
diff --git a/charts/sourcegraph/templates/blobstore/blobstore.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/blobstore/blobstore.PersistentVolumeClaim.yaml
index 4b241dc3a..52c26e290 100644
--- a/charts/sourcegraph/templates/blobstore/blobstore.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/blobstore/blobstore.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.blobstore.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: blobstore
   {{- if .Values.blobstore.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/blobstore/blobstore.ServiceAccount.yaml b/charts/sourcegraph/templates/blobstore/blobstore.ServiceAccount.yaml
index 35ea8e0ef..d30e7b42c 100644
--- a/charts/sourcegraph/templates/blobstore/blobstore.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/blobstore/blobstore.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "blobstore") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: blobstore
diff --git a/charts/sourcegraph/templates/cadvisor/cadvisor.ServiceAccount.yaml b/charts/sourcegraph/templates/cadvisor/cadvisor.ServiceAccount.yaml
index 43e8e2b7b..316576772 100644
--- a/charts/sourcegraph/templates/cadvisor/cadvisor.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/cadvisor/cadvisor.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "cadvisor") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     app: cadvisor
     category: rbac
     deploy: sourcegraph
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.PersistentVolumeClaim.yaml
index 566c8140a..16ee1fb62 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.codeInsightsDB.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     app.kubernetes.io/component: codeinsights-db
     deploy: sourcegraph
   {{- if .Values.codeInsightsDB.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ServiceAccount.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ServiceAccount.yaml
index faba460ec..533cb4b1e 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "codeInsightsDB") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: codeinsights-db
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.PersistentVolumeClaim.yaml
index fe496da4f..8f2f5d324 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.codeIntelDB.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     app.kubernetes.io/component: codeintel-db
     deploy: sourcegraph
   {{- if .Values.codeIntelDB.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.ServiceAccount.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.ServiceAccount.yaml
index d19e5abee..d23309681 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "codeIntelDB") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: codeintel-db
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Role.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Role.yaml
index aa3a20898..4772aa714 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Role.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Role.yaml
@@ -4,6 +4,9 @@ kind: Role
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "frontend") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: frontend
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.RoleBinding.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.RoleBinding.yaml
index 4bdbc1c25..99e2e6848 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.RoleBinding.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.RoleBinding.yaml
@@ -4,6 +4,9 @@ kind: RoleBinding
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "frontend") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: frontend
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.ServiceAccount.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.ServiceAccount.yaml
index 8dfbc2c6f..d3bf12522 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.ServiceAccount.yaml
@@ -7,6 +7,10 @@ imagePullSecrets:
 {{- end }}
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "frontend") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: frontend
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.ServiceAccount.yaml b/charts/sourcegraph/templates/gitserver/gitserver.ServiceAccount.yaml
index cbc894987..7d6c5afd9 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "gitserver") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: gitserver
diff --git a/charts/sourcegraph/templates/grafana/grafana.ServiceAccount.yaml b/charts/sourcegraph/templates/grafana/grafana.ServiceAccount.yaml
index f5fccab8b..5ffac53a8 100644
--- a/charts/sourcegraph/templates/grafana/grafana.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.ServiceAccount.yaml
@@ -7,6 +7,10 @@ imagePullSecrets:
 {{- end }}
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "grafana") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: grafana
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.ServiceAccount.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.ServiceAccount.yaml
index 01bc6a1b7..6e9b601af 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "indexedSearch") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: indexed-search
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.ServiceAccount.yaml b/charts/sourcegraph/templates/jaeger/jaeger.ServiceAccount.yaml
index 1832c6b4c..e6467ab5d 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.ServiceAccount.yaml
@@ -3,9 +3,13 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "jaeger") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: tracing
-  {{- include "sourcegraph.serviceAccountAnnotations" (list . "tracing") | trim | nindent 2 }}
-  name: {{ include "sourcegraph.serviceAccountName" (list . "tracing") }}
+  {{- include "sourcegraph.serviceAccountAnnotations" (list . "jaeger") | trim | nindent 2 }}
+  name: {{ include "sourcegraph.serviceAccountName" (list . "jaeger") }}
 {{- end }}
diff --git a/charts/sourcegraph/templates/node-exporter/node-exporter.ServiceAccount.yaml b/charts/sourcegraph/templates/node-exporter/node-exporter.ServiceAccount.yaml
index 0d0cf7b53..f3954dace 100644
--- a/charts/sourcegraph/templates/node-exporter/node-exporter.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/node-exporter/node-exporter.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "nodeExporter") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     app: node-exporter
     category: rbac
     deploy: sourcegraph
diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.ServiceAccount.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.ServiceAccount.yaml
index 00dde11c6..7b66d3549 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-agent.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-agent.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list .Values.openTelemetry "agent") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: otel-collector
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.ServiceAccount.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.ServiceAccount.yaml
index d8aeb7b2a..586dd2c13 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list .Values.openTelemetry "gateway") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: otel-collector
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/pgsql/pgsql.PersistentVolumeClaim.yaml
index 9e4db93aa..6a1bb063e 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.pgsql.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
   {{- if .Values.pgsql.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.ServiceAccount.yaml b/charts/sourcegraph/templates/pgsql/pgsql.ServiceAccount.yaml
index 8255446b8..23adf928a 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "pgsql") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.ServiceAccount.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.ServiceAccount.yaml
index 60448ca2b..ec22e9772 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "preciseCodeIntel") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: precise-code-intel
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ClusterRole.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ClusterRole.yaml
index 383623b40..f0b49182d 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ClusterRole.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ClusterRole.yaml
@@ -3,6 +3,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "prometheus") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ClusterRoleBinding.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ClusterRoleBinding.yaml
index 67017b7c0..f83c1ad3b 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ClusterRoleBinding.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ClusterRoleBinding.yaml
@@ -3,6 +3,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "prometheus") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/prometheus/prometheus.PersistentVolumeClaim.yaml
index d79efa8b3..cb6f6751b 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.prometheus.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
   {{- if .Values.prometheus.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.RoleBinding.yaml b/charts/sourcegraph/templates/prometheus/prometheus.RoleBinding.yaml
index e28e94ceb..2075b4ac8 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.RoleBinding.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.RoleBinding.yaml
@@ -3,6 +3,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "prometheus") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ServiceAccount.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ServiceAccount.yaml
index ba0586448..5ad177878 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "prometheus") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
diff --git a/charts/sourcegraph/templates/redis/redis-cache.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/redis/redis-cache.PersistentVolumeClaim.yaml
index bac546ffa..fe457b7a7 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.redisCache.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: redis
   {{- if .Values.redisCache.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/redis/redis-cache.ServiceAccount.yaml b/charts/sourcegraph/templates/redis/redis-cache.ServiceAccount.yaml
index e7f2c88c7..869a23e9b 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "redisCache") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: redis
diff --git a/charts/sourcegraph/templates/redis/redis-store.PersistentVolumeClaim.yaml b/charts/sourcegraph/templates/redis/redis-store.PersistentVolumeClaim.yaml
index 41cb911ac..ddd47e52b 100644
--- a/charts/sourcegraph/templates/redis/redis-store.PersistentVolumeClaim.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.PersistentVolumeClaim.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.redisStore.storageLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: redis
   {{- if .Values.redisStore.storageAnnotations }}
diff --git a/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml b/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml
index 94ab30011..259207cc7 100644
--- a/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "redisStore") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: redis
diff --git a/charts/sourcegraph/templates/searcher/searcher.ServiceAccount.yaml b/charts/sourcegraph/templates/searcher/searcher.ServiceAccount.yaml
index d065a9f1d..795794006 100644
--- a/charts/sourcegraph/templates/searcher/searcher.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "searcher") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: searcher
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.ServiceAccount.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.ServiceAccount.yaml
index 10f1e741c..485ba6c27 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "syntacticCodeIntel") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: syntactic-code-intel
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.ServiceAccount.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.ServiceAccount.yaml
index 36764b58c..ac0edb374 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "syntectServer") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: syntect-server
diff --git a/charts/sourcegraph/templates/worker/worker.ServiceAccount.yaml b/charts/sourcegraph/templates/worker/worker.ServiceAccount.yaml
index 21b276c82..261677a56 100644
--- a/charts/sourcegraph/templates/worker/worker.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/worker/worker.ServiceAccount.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with include "sourcegraph.serviceAccountLabels" (list . "worker") }}
+    {{- . | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: worker
diff --git a/charts/sourcegraph/tests/__snapshot__/serviceAccountAnnotations_test.yaml.snap b/charts/sourcegraph/tests/__snapshot__/serviceAccountAnnotations_test.yaml.snap
index 8b3b9e538..2abe7153f 100644
--- a/charts/sourcegraph/tests/__snapshot__/serviceAccountAnnotations_test.yaml.snap
+++ b/charts/sourcegraph/tests/__snapshot__/serviceAccountAnnotations_test.yaml.snap
@@ -8,8 +8,13 @@ should render service account annotations when cadvisor.serviceAccount.annotatio
       labels:
         app: cadvisor
         app.kubernetes.io/component: cadvisor
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 1.2.3
         category: rbac
         deploy: sourcegraph
+        helm.sh/chart: sourcegraph-1.2.3
       name: cadvisor
 should render service account annotations when frontend.serviceAccount.annotations is defined:
   1: |
@@ -20,8 +25,13 @@ should render service account annotations when frontend.serviceAccount.annotatio
         iam.gke.io/gcp-service-account: sourcegraph@sourcegraph.iam.gserviceaccount.com
       labels:
         app.kubernetes.io/component: frontend
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 1.2.3
         category: rbac
         deploy: sourcegraph
+        helm.sh/chart: sourcegraph-1.2.3
       name: sourcegraph-frontend
 should render service account annotations when prometheus.serviceAccount.annotations is defined:
   1: |
@@ -32,6 +42,11 @@ should render service account annotations when prometheus.serviceAccount.annotat
         iam.gke.io/gcp-service-account: sourcegraph@sourcegraph.iam.gserviceaccount.com
       labels:
         app.kubernetes.io/component: prometheus
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 1.2.3
         category: rbac
         deploy: sourcegraph
+        helm.sh/chart: sourcegraph-1.2.3
       name: prometheus
diff --git a/charts/sourcegraph/tests/__snapshot__/serviceAccounts_test.yaml.snap b/charts/sourcegraph/tests/__snapshot__/serviceAccounts_test.yaml.snap
index 2cca9c17c..e3dbab8fa 100644
--- a/charts/sourcegraph/tests/__snapshot__/serviceAccounts_test.yaml.snap
+++ b/charts/sourcegraph/tests/__snapshot__/serviceAccounts_test.yaml.snap
@@ -5,8 +5,13 @@ should render service account when openTelemetry.agent.serviceAccount.create is
     metadata:
       labels:
         app.kubernetes.io/component: otel-collector
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 1.2.3
         category: rbac
         deploy: sourcegraph
+        helm.sh/chart: sourcegraph-1.2.3
       name: otel-agent
 should render service account when openTelemetry.gateway.serviceAccount.create is true:
   1: |
@@ -15,6 +20,11 @@ should render service account when openTelemetry.gateway.serviceAccount.create i
     metadata:
       labels:
         app.kubernetes.io/component: otel-collector
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 1.2.3
         category: rbac
         deploy: sourcegraph
+        helm.sh/chart: sourcegraph-1.2.3
       name: otel-collector
diff --git a/charts/sourcegraph/tests/objectLabels_test.yaml b/charts/sourcegraph/tests/objectLabels_test.yaml
new file mode 100644
index 000000000..b21dbe453
--- /dev/null
+++ b/charts/sourcegraph/tests/objectLabels_test.yaml
@@ -0,0 +1,283 @@
+suite: labels on PersistentVolumeClaims, ServiceAccounts, and RBAC objects
+release:
+  name: sourcegraph
+  namespace: sourcegraph
+# The chart version is part of the helm.sh/chart label and changes on every
+# release, so pin it to compare whole label sets.
+chart:
+  version: 1.2.3
+  appVersion: 1.2.3
+tests:
+- it: should add sourcegraph.labels and the component's storageLabels to its PersistentVolumeClaim
+  templates:
+  - blobstore/blobstore.PersistentVolumeClaim.yaml
+  - codeinsights-db/codeinsights-db.PersistentVolumeClaim.yaml
+  - codeintel-db/codeintel-db.PersistentVolumeClaim.yaml
+  - pgsql/pgsql.PersistentVolumeClaim.yaml
+  - prometheus/prometheus.PersistentVolumeClaim.yaml
+  - redis/redis-cache.PersistentVolumeClaim.yaml
+  - redis/redis-store.PersistentVolumeClaim.yaml
+  set:
+    sourcegraph.labels: &globalLabels
+      example.com/installation: production
+      example.com/project: sourcegraph
+    blobstore.storageLabels:
+      example.com/service: blobstore
+    codeInsightsDB.storageLabels:
+      example.com/service: codeinsights-db
+    codeIntelDB.storageLabels:
+      example.com/service: codeintel-db
+    pgsql.storageLabels:
+      example.com/service: pgsql
+    prometheus.storageLabels:
+      example.com/service: prometheus
+    redisCache.storageLabels:
+      example.com/service: redis-cache
+    redisStore.storageLabels:
+      example.com/service: redis-store
+  asserts:
+  - isSubset:
+      path: metadata.labels
+      content: *globalLabels
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
+        example.com/service: blobstore
+        deploy: sourcegraph
+        app.kubernetes.io/component: blobstore
+    template: blobstore/blobstore.PersistentVolumeClaim.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: codeinsights-db
+    template: codeinsights-db/codeinsights-db.PersistentVolumeClaim.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: codeintel-db
+    template: codeintel-db/codeintel-db.PersistentVolumeClaim.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: pgsql
+    template: pgsql/pgsql.PersistentVolumeClaim.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: prometheus
+    template: prometheus/prometheus.PersistentVolumeClaim.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: redis-cache
+    template: redis/redis-cache.PersistentVolumeClaim.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: redis-store
+    template: redis/redis-store.PersistentVolumeClaim.yaml
+
+- it: should not add storageLabels to a PersistentVolumeClaim when nothing is set
+  template: redis/redis-store.PersistentVolumeClaim.yaml
+  asserts:
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        deploy: sourcegraph
+        app.kubernetes.io/component: redis
+
+- it: should add sourcegraph.labels to every ServiceAccount
+  templates:
+  - blobstore/blobstore.ServiceAccount.yaml
+  - cadvisor/cadvisor.ServiceAccount.yaml
+  - codeinsights-db/codeinsights-db.ServiceAccount.yaml
+  - codeintel-db/codeintel-db.ServiceAccount.yaml
+  - frontend/sourcegraph-frontend.ServiceAccount.yaml
+  - gitserver/gitserver.ServiceAccount.yaml
+  - grafana/grafana.ServiceAccount.yaml
+  - indexed-search/indexed-search.ServiceAccount.yaml
+  - jaeger/jaeger.ServiceAccount.yaml
+  - node-exporter/node-exporter.ServiceAccount.yaml
+  - otel-collector/otel-agent.ServiceAccount.yaml
+  - otel-collector/otel-collector.ServiceAccount.yaml
+  - pgsql/pgsql.ServiceAccount.yaml
+  - precise-code-intel/worker.ServiceAccount.yaml
+  - prometheus/prometheus.ServiceAccount.yaml
+  - redis/redis-cache.ServiceAccount.yaml
+  - redis/redis-store.ServiceAccount.yaml
+  - searcher/searcher.ServiceAccount.yaml
+  - syntactic-code-intel/worker.ServiceAccount.yaml
+  - syntect-server/syntect-server.ServiceAccount.yaml
+  - worker/worker.ServiceAccount.yaml
+  set:
+    sourcegraph.labels: *globalLabels
+    jaeger.enabled: true
+    syntacticCodeIntel.enabled: true
+    blobstore.serviceAccount.create: true
+    cadvisor.serviceAccount.create: true
+    codeInsightsDB.serviceAccount.create: true
+    codeIntelDB.serviceAccount.create: true
+    frontend.serviceAccount.create: true
+    gitserver.serviceAccount.create: true
+    grafana.serviceAccount.create: true
+    indexedSearch.serviceAccount.create: true
+    jaeger.serviceAccount.create: true
+    nodeExporter.serviceAccount.create: true
+    openTelemetry.agent.serviceAccount.create: true
+    openTelemetry.gateway.serviceAccount.create: true
+    pgsql.serviceAccount.create: true
+    preciseCodeIntel.serviceAccount.create: true
+    prometheus.serviceAccount.create: true
+    redisCache.serviceAccount.create: true
+    redisStore.serviceAccount.create: true
+    searcher.serviceAccount.create: true
+    syntacticCodeIntel.serviceAccount.create: true
+    syntectServer.serviceAccount.create: true
+    worker.serviceAccount.create: true
+  asserts:
+  - isKind:
+      of: ServiceAccount
+  - isSubset:
+      path: metadata.labels
+      content:
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        example.com/installation: production
+        example.com/project: sourcegraph
+        category: rbac
+        deploy: sourcegraph
+  - notExists:
+      path: metadata.labels["example.com/service"]
+
+- it: should add serviceAccount.labels to the ServiceAccount of its own component
+  templates:
+  - frontend/sourcegraph-frontend.ServiceAccount.yaml
+  - jaeger/jaeger.ServiceAccount.yaml
+  - otel-collector/otel-agent.ServiceAccount.yaml
+  - otel-collector/otel-collector.ServiceAccount.yaml
+  - redis/redis-cache.ServiceAccount.yaml
+  - redis/redis-store.ServiceAccount.yaml
+  set:
+    jaeger.enabled: true
+    frontend.serviceAccount.labels:
+      example.com/service: frontend
+    jaeger.serviceAccount:
+      create: true
+      labels:
+        example.com/service: jaeger
+    openTelemetry.agent.serviceAccount:
+      create: true
+      labels:
+        example.com/service: otel-agent
+    openTelemetry.gateway.serviceAccount:
+      create: true
+      labels:
+        example.com/service: otel-collector
+    redisCache.serviceAccount:
+      create: true
+    redisStore.serviceAccount:
+      create: true
+      labels:
+        example.com/service: redis-store
+  asserts:
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/service: frontend
+        category: rbac
+        deploy: sourcegraph
+        app.kubernetes.io/component: frontend
+    template: frontend/sourcegraph-frontend.ServiceAccount.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: jaeger
+    template: jaeger/jaeger.ServiceAccount.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: otel-agent
+    template: otel-collector/otel-agent.ServiceAccount.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: otel-collector
+    template: otel-collector/otel-collector.ServiceAccount.yaml
+  - notExists:
+      path: metadata.labels["example.com/service"]
+    template: redis/redis-cache.ServiceAccount.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: redis-store
+    template: redis/redis-store.ServiceAccount.yaml
+
+- it: should add sourcegraph.labels and frontend.serviceAccount.labels to the frontend Role and RoleBinding
+  templates:
+  - frontend/sourcegraph-frontend.Role.yaml
+  - frontend/sourcegraph-frontend.RoleBinding.yaml
+  set:
+    sourcegraph.labels: *globalLabels
+    frontend.serviceAccount.labels:
+      example.com/service: frontend
+    prometheus.serviceAccount.labels:
+      example.com/service: prometheus
+  asserts:
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
+        example.com/service: frontend
+        category: rbac
+        deploy: sourcegraph
+        app.kubernetes.io/component: frontend
+
+- it: should add sourcegraph.labels and prometheus.serviceAccount.labels to the prometheus ClusterRole and ClusterRoleBinding
+  templates:
+  - prometheus/prometheus.ClusterRole.yaml
+  - prometheus/prometheus.ClusterRoleBinding.yaml
+  set:
+    sourcegraph.labels: *globalLabels
+    frontend.serviceAccount.labels:
+      example.com/service: frontend
+    prometheus.serviceAccount.labels: &prometheusLabels
+      example.com/service: prometheus
+  asserts:
+  - equal:
+      path: metadata.labels
+      value: &prometheusRBACLabels
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
+        example.com/service: prometheus
+        category: rbac
+        deploy: sourcegraph
+        app.kubernetes.io/component: prometheus
+
+- it: should add sourcegraph.labels and prometheus.serviceAccount.labels to the prometheus RoleBinding
+  template: prometheus/prometheus.RoleBinding.yaml
+  set:
+    sourcegraph.labels: *globalLabels
+    prometheus.privileged: false
+    prometheus.serviceAccount.labels: *prometheusLabels
+  asserts:
+  - equal:
+      path: metadata.labels
+      value: *prometheusRBACLabels
diff --git a/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml b/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml
index 1d4606334..db5418647 100644
--- a/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml
+++ b/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml
@@ -2,6 +2,10 @@ suite: serviceAccountAnnotations
 release:
   name: sourcegraph
   namespace: sourcegraph
+# The snapshots include the helm.sh/chart label, which changes on every release.
+chart:
+  version: 1.2.3
+  appVersion: 1.2.3
 tests:
 - it: should render service account annotations when frontend.serviceAccount.annotations is defined
   set:
diff --git a/charts/sourcegraph/tests/serviceAccounts_test.yaml b/charts/sourcegraph/tests/serviceAccounts_test.yaml
index 17ec4aed1..d271f450a 100644
--- a/charts/sourcegraph/tests/serviceAccounts_test.yaml
+++ b/charts/sourcegraph/tests/serviceAccounts_test.yaml
@@ -2,6 +2,10 @@ suite: serviceAccount
 release:
   name: sourcegraph
   namespace: sourcegraph
+# The snapshots include the helm.sh/chart label, which changes on every release.
+chart:
+  version: 1.2.3
+  appVersion: 1.2.3
 tests:
 - it: should render service account when openTelemetry.gateway.serviceAccount.create is true
   set:
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index ff4b04e02..cf0e0ca7a 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -102,6 +102,8 @@ sourcegraph:
 #   serviceAccount.create: true
 #   # Customize service account name
 #   serviceAccount.name: ""
+#   # Add labels to the service account, and to the component's Role, RoleBinding, ClusterRole, and ClusterRoleBinding
+#   serviceAccount.labels: {}
 #   # Override service type (defaults to ClusterIP)
 #   serviceType: ""
 #   # Set disk size on PVC's for stateful deployments
@@ -249,6 +251,8 @@ codeInsightsDB:
   storageSubPath: ""
   # -- Optional annotations to add to the `codeinsights-db` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `codeinsights-db` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
 
 codeIntelDB:
   # -- Enable `codeintel-db` PostgreSQL server
@@ -319,6 +323,8 @@ codeIntelDB:
   storageSubPath: ""
   # -- Optional annotations to add to the `codeintel-db` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `codeintel-db` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
 
 frontend:
   # -- Command for the `frontend` container, as a list, replacing the image's entrypoint,
@@ -730,6 +736,8 @@ blobstore:
   storageSubPath: ""
   # -- Optional annotations to add to the `blobstore` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `blobstore` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
 
 openTelemetry:
   enabled: true
@@ -930,6 +938,8 @@ pgsql:
   storageSubPath: ""
   # -- Optional annotations to add to the `pgsql` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `pgsql` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
 
 postgresExporter:
   image:
@@ -1127,6 +1137,8 @@ prometheus:
   storageSubPath: ""
   # -- Optional annotations to add to the `prometheus` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `prometheus` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
 
 redisCache:
   # -- Enable `redis-cache` Redis server
@@ -1180,6 +1192,8 @@ redisCache:
   storageSubPath: ""
   # -- Optional annotations to add to the `redis-cache` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `redis-cache` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
   config:
     # -- Opt in to a chart-managed Redis config and automatic memory sizing.
     # Disabled by default to preserve image-baked configuration and custom
@@ -1283,6 +1297,8 @@ redisStore:
   storageSubPath: ""
   # -- Optional annotations to add to the `redis-store` PVC
   storageAnnotations: {}
+  # -- Optional labels to add to the `redis-store` PVC, in addition to `sourcegraph.labels`
+  storageLabels: {}
   config:
     # -- Opt in to a chart-managed Redis config and automatic memory sizing.
     # Disabled by default to preserve image-baked configuration and custom

From 87b395fee058e90ce02d4381dcf15745f7d9e0a7 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 18:59:45 +0000
Subject: [PATCH 02/16] Render sourcegraph.labels on every object in all four
 charts

Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets,
PriorityClasses, and extraResources of the sourcegraph chart did not render
sourcegraph.labels. Neither did any object of the sourcegraph-executor-k8s
chart, nor the docker-config ConfigMap and private-docker-registry Service of
the sourcegraph-executor-dind chart.

Prometheus copies Service labels to the metrics it scrapes, so its bundled
configuration now drops the chart's standard labels: helm.sh/chart and
app.kubernetes.io/version change on every upgrade.

Each chart gets a test that renders every template and checks the labels, so
a template added later is covered too.

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph-executor/CHANGELOG.md      |   2 +
 .../executor/docker-daemon.ConfigMap.yaml     |   1 +
 .../private-docker-registry.Service.yaml      |   1 +
 .../dind/tests/labels_test.yaml               |  22 ++
 .../k8s/templates/executor.ConfigMap.yaml     |   1 +
 .../k8s/templates/executor.Deployment.yaml    |   1 +
 .../k8s/templates/executor.Role.yaml          |   1 +
 .../k8s/templates/executor.RoleBinding.yaml   |   1 +
 .../k8s/templates/executor.Secret.yaml        |   2 +
 .../k8s/templates/executor.Service.yaml       |   1 +
 .../templates/executor.ServiceAccount.yaml    |   1 +
 .../k8s/tests/labels_test.yaml                |  21 ++
 .../tests/labels_test.yaml                    |  18 ++
 charts/sourcegraph/CHANGELOG.md               |   1 +
 charts/sourcegraph/README.md                  |  11 +-
 charts/sourcegraph/README.md.gotmpl           |   7 +-
 .../prometheus-override-k3s.ConfigMap.yaml    |   8 +
 .../blobstore/blobstore.Service.yaml          |   1 +
 .../codeinsights-db.ConfigMap.yaml            |   1 +
 .../codeinsights-db.Secret.yaml               |   1 +
 .../codeinsights-db.Service.yaml              |   1 +
 .../codeintel-db/codeintel-db.ConfigMap.yaml  |   1 +
 .../codeintel-db/codeintel-db.Secret.yaml     |   1 +
 .../codeintel-db/codeintel-db.Service.yaml    |   1 +
 .../sourcegraph/templates/extraResources.yaml |  15 +-
 ...sourcegraph-frontend-internal.Service.yaml |   1 +
 .../sourcegraph-frontend.Ingress.yaml         |   1 +
 ...rcegraph-frontend.PodDisruptionBudget.yaml |   2 +
 .../sourcegraph-frontend.Service.yaml         |   1 +
 .../gitserver.PodDisruptionBudget.yaml        |   2 +
 .../gitserver/gitserver.Service.yaml          |   1 +
 .../templates/grafana/grafana.ConfigMap.yaml  |   1 +
 .../templates/grafana/grafana.Service.yaml    |   1 +
 .../grafana/grafana.pgsql.Secret.yaml         |   1 +
 .../indexed-search.IndexerService.yaml        |   1 +
 .../indexed-search.PodDisruptionBudget.yaml   |   2 +
 .../indexed-search.Service.yaml               |   1 +
 .../jaeger/jaeger-collector.Service.yaml      |   2 +-
 .../jaeger/jaeger-query.Service.yaml          |   2 +-
 .../node-exporter/node-exporter.Service.yaml  |   1 +
 .../otel-collector/otel-agent.ConfigMap.yaml  |   1 +
 .../otel-collector.ConfigMap.yaml             |   1 +
 .../templates/pgsql/pgsql.ConfigMap.yaml      |   1 +
 .../templates/pgsql/pgsql.Secret.yaml         |   1 +
 .../templates/pgsql/pgsql.Service.yaml        |   1 +
 .../worker.PodDisruptionBudget.yaml           |   2 +
 .../precise-code-intel/worker.Service.yaml    |   1 +
 .../sourcegraph/templates/priorityClass.yaml  |   2 +
 .../prometheus/prometheus.ConfigMap.yaml      |   9 +
 .../prometheus/prometheus.Service.yaml        |   1 +
 .../redis-cache.PodDisruptionBudget.yaml      |   2 +
 .../templates/redis/redis-cache.Secret.yaml   |   1 +
 .../templates/redis/redis-cache.Service.yaml  |   1 +
 .../redis-store.PodDisruptionBudget.yaml      |   2 +
 .../templates/redis/redis-store.Secret.yaml   |   1 +
 .../templates/redis/redis-store.Service.yaml  |   1 +
 .../searcher.PodDisruptionBudget.yaml         |   2 +
 .../templates/searcher/searcher.Service.yaml  |   1 +
 .../worker.PodDisruptionBudget.yaml           |   2 +
 .../syntactic-code-intel/worker.Service.yaml  |   1 +
 .../syntect-server.PodDisruptionBudget.yaml   |   2 +
 .../syntect-server.Service.yaml               |   1 +
 .../worker/worker-executors.Service.yaml      |   1 +
 .../worker/worker.PodDisruptionBudget.yaml    |   2 +
 .../templates/worker/worker.Service.yaml      |   1 +
 .../tests/allObjectLabels_test.yaml           | 196 ++++++++++++++++++
 charts/sourcegraph/values.yaml                |   6 +-
 67 files changed, 374 insertions(+), 11 deletions(-)
 create mode 100644 charts/sourcegraph-executor/dind/tests/labels_test.yaml
 create mode 100644 charts/sourcegraph-executor/k8s/tests/labels_test.yaml
 create mode 100644 charts/sourcegraph-migrator/tests/labels_test.yaml
 create mode 100644 charts/sourcegraph/tests/allObjectLabels_test.yaml

diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md
index 5e2f4fb18..da22083bf 100644
--- a/charts/sourcegraph-executor/CHANGELOG.md
+++ b/charts/sourcegraph-executor/CHANGELOG.md
@@ -3,6 +3,8 @@
 <!-- START CHANGELOG -->
 ## Unreleased
 
+- `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted.
+
 ## 8.0.0
 
 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API.
diff --git a/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml b/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
index ecd96f99b..d91dbdcb3 100644
--- a/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
+++ b/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: executor
     deploy: sourcegraph
     app.kubernetes.io/component: executor
diff --git a/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml b/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
index 356293ca8..b2227b484 100644
--- a/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
+++ b/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
@@ -7,6 +7,7 @@ metadata:
     {{- toYaml .Values.privateDockerRegistry.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: private-docker-registry
     deploy: sourcegraph
     app.kubernetes.io/component: private-docker-registry
diff --git a/charts/sourcegraph-executor/dind/tests/labels_test.yaml b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
new file mode 100644
index 000000000..56c29a4ce
--- /dev/null
+++ b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
@@ -0,0 +1,22 @@
+suite: sourcegraph.labels on every object
+# No `templates` list, so every template in the chart is rendered, including
+# ones added later. The test fails with "no manifest found" for a template that
+# renders nothing, so enable a new optional template here.
+tests:
+  - it: should add sourcegraph.labels to every object the chart renders
+    set:
+      sourcegraph:
+        labels:
+          example.com/installation: production
+          example.com/project: sourcegraph
+      executor:
+        queueName: batches
+      privateDockerRegistry:
+        enabled: true
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            app.kubernetes.io/managed-by: Helm
+            example.com/installation: production
+            example.com/project: sourcegraph
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
index 6e773607b..cfd074819 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
@@ -3,6 +3,7 @@ kind: ConfigMap
 metadata:
   name: {{ include "executor.name" . }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
 {{- include "executor.labels" . | nindent 4 }}
 data:
   EXECUTOR_USE_FIRECRACKER: "false"
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml
index 1cb35d2c4..9978038b0 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml
@@ -6,6 +6,7 @@ metadata:
     description: Runs a sourcegraph executor
     kubectl.kubernetes.io/default-container: executor
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     {{- include "executor.labels" . | nindent 4 }}
     {{- if .Values.executor.labels }}
       {{- toYaml .Values.executor.labels | nindent 4 }}
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml
index 7a3d1ef4d..36107636e 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml
@@ -4,6 +4,7 @@ kind: Role
 metadata:
   name: sg-executor-role
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     category: rbac
     deploy: sourcegraph
     sourcegraph-resource-requires: cluster-admin
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml b/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml
index f13311c5f..df5814537 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml
@@ -4,6 +4,7 @@ kind: RoleBinding
 metadata:
   name: sg-executor-role-binding
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     category: rbac
     deploy: sourcegraph
     sourcegraph-resource-requires: cluster-admin
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml
index 669afae55..01fd6e810 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml
@@ -2,6 +2,8 @@
 apiVersion: v1
 kind: Secret
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ include "executor.name" . }}
 type: Opaque
 data:
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml
index 33d841b3b..ed865c0cb 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml
@@ -6,6 +6,7 @@ metadata:
     {{- toYaml .Values.executor.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
 {{ include "executor.labels" . | indent 4 }}
     {{- if .Values.executor.serviceLabels }}
     {{- toYaml .Values.executor.serviceLabels | nindent 4 }}
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml
index 6a0f44627..1b8d16bd3 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml
@@ -4,6 +4,7 @@ kind: ServiceAccount
 metadata:
   name: sg-executor
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     category: rbac
     deploy: sourcegraph
     sourcegraph-resource-requires: cluster-admin
diff --git a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
new file mode 100644
index 000000000..c0140b3c3
--- /dev/null
+++ b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
@@ -0,0 +1,21 @@
+suite: sourcegraph.labels on every object
+# No `templates` list, so every template in the chart is rendered, including
+# ones added later. The test fails with "no manifest found" for a template that
+# renders nothing, so enable a new optional template here.
+tests:
+  - it: should add sourcegraph.labels to every object the chart renders
+    set:
+      sourcegraph:
+        labels:
+          example.com/installation: production
+          example.com/project: sourcegraph
+      executor:
+        queueName: batches
+        configureRbac: true
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            app.kubernetes.io/managed-by: Helm
+            example.com/installation: production
+            example.com/project: sourcegraph
diff --git a/charts/sourcegraph-migrator/tests/labels_test.yaml b/charts/sourcegraph-migrator/tests/labels_test.yaml
new file mode 100644
index 000000000..57f3df51e
--- /dev/null
+++ b/charts/sourcegraph-migrator/tests/labels_test.yaml
@@ -0,0 +1,18 @@
+suite: sourcegraph.labels on every object
+# No `templates` list, so every template in the chart is rendered, including
+# ones added later. The test fails with "no manifest found" for a template that
+# renders nothing, so enable a new optional template here.
+tests:
+  - it: should add sourcegraph.labels to every object the chart renders
+    set:
+      sourcegraph:
+        labels:
+          example.com/installation: production
+          example.com/project: sourcegraph
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            app.kubernetes.io/managed-by: Helm
+            example.com/installation: production
+            example.com/project: sourcegraph
diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index e65281048..84eaa5f81 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,6 +9,7 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
+- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so labels set in `sourcegraph.labels` now appear on those metrics, as `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` already do. The bundled Prometheus configuration drops the chart's standard labels instead, because `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade; the `otel-collector` metrics, the only ones that had them, lose them. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml).
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 69870cd2d..0af76ab12 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -103,9 +103,12 @@ release: Kubernetes rejects the upgrade. Before installing, compare the
 
 Labels on other objects can be changed, so they never block an upgrade, but
 Helm only manages the labels the chart renders. To render the labels that the
-existing PersistentVolumeClaims, ServiceAccounts, and RBAC objects have:
+existing objects have:
 
-- `sourcegraph.labels` adds labels to all of them, on every component.
+- `sourcegraph.labels` adds labels to every object the chart renders, on every
+  component.
+- `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` add labels to
+  every Service, or to one component's Services.
 - `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
   `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`,
   `redisCache`, or `redisStore`.
@@ -231,7 +234,7 @@ In addition to the documented values, all services also support the following va
 | codeIntelDB.storageLabels | object | `{}` | Optional labels to add to the `codeintel-db` PVC, in addition to `sourcegraph.labels` |
 | codeIntelDB.storageSize | string | `"200Gi"` | PVC Storage Request for `codeintel-db` data volume |
 | codeIntelDB.storageSubPath | string | `""` | Optional subPath for the `codeintel-db` primary data volume mount |
-| extraResources | list | `[]` | Additional resources to include in the rendered manifest. Templates are supported. |
+| extraResources | list | `[]` | Additional resources to include in the rendered manifest. Templates are supported. `sourcegraph.labels` and the chart's standard labels are added to each resource; labels the resource sets itself take precedence. |
 | frontend.command | list | `[]` | Command for the `frontend` container, as a list, replacing the image's entrypoint, e.g. a shell wrapper that exports credentials read from mounted files before starting `frontend`. `frontend.args` (default `["serve"]`) is still passed as the arguments. |
 | frontend.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `frontend` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | frontend.createRoleBinding | bool | `true` | Disable the roleBinding resource for deployment environments blocking RBAC, ex. OpenShift's default "secure" SCC |
@@ -513,7 +516,7 @@ In addition to the documented values, all services also support the following va
 | sourcegraph.image.repository | string | Sourcegraph's public Docker Hub registry | Global docker image registry or prefix |
 | sourcegraph.image.useGlobalTagAsDefault | bool | `false` | When set to true, sourcegraph.image.defaultTag is used as the default defaultTag for all services, instead of service-specific default defaultTags |
 | sourcegraph.imagePullSecrets | list | `[]` | Mount named secrets containing docker credentials |
-| sourcegraph.labels | object | `{}` | Add extra labels to all resources |
+| sourcegraph.labels | object | `{}` | Add extra labels to every object the chart renders, including `extraResources`. Prometheus copies the labels of a Service to the metrics it scrapes from it, so these labels also appear on those metrics. |
 | sourcegraph.localDevMode | bool | `false` | When true, remove all resource stanzas, allowing the scheduler to best-fit pods. Intended for local development with limited resources. |
 | sourcegraph.nameOverride | string | `""` | Set a custom name for the app.kubernetes.io/name annotation |
 | sourcegraph.nodeSelector | object | `{}` | Global NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) |
diff --git a/charts/sourcegraph/README.md.gotmpl b/charts/sourcegraph/README.md.gotmpl
index d8fb65ea1..38cc5f1de 100644
--- a/charts/sourcegraph/README.md.gotmpl
+++ b/charts/sourcegraph/README.md.gotmpl
@@ -103,9 +103,12 @@ release: Kubernetes rejects the upgrade. Before installing, compare the
 
 Labels on other objects can be changed, so they never block an upgrade, but
 Helm only manages the labels the chart renders. To render the labels that the
-existing PersistentVolumeClaims, ServiceAccounts, and RBAC objects have:
+existing objects have:
 
-- `sourcegraph.labels` adds labels to all of them, on every component.
+- `sourcegraph.labels` adds labels to every object the chart renders, on every
+  component.
+- `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` add labels to
+  every Service, or to one component's Services.
 - `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
   `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`,
   `redisCache`, or `redisStore`.
diff --git a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
index 5343dee1d..552b5ef93 100644
--- a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
+++ b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
@@ -98,6 +98,10 @@ data:
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
+      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      - action: labeldrop
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_namespace]
         action: replace
         target_label: ns
@@ -131,6 +135,10 @@ data:
         target_label: instance
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
+      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      - action: labeldrop
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_service_namespace]
         target_label: ns
       - source_labels: [__meta_kubernetes_service_name]
diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
index c3c180c4d..5641170ba 100644
--- a/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
+++ b/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
@@ -7,6 +7,7 @@ metadata:
     {{- toYaml .Values.blobstore.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: blobstore
     deploy: sourcegraph
     app.kubernetes.io/component: blobstore
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml
index 428fdf24e..64f2ef3df 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml
@@ -8,6 +8,7 @@ metadata:
   annotations:
     description: Configuration for Code Insights
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app.kubernetes.io/component: codeinsights-db
     deploy: sourcegraph
   name: {{ .Values.codeInsightsDB.name }}-conf
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml
index 650c58e82..946b5c8c8 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml
@@ -4,6 +4,7 @@ kind: Secret
 metadata:
   name: {{ .Values.codeInsightsDB.name }}-auth
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: codeinsights-db
     deploy: sourcegraph
     app.kubernetes.io/component: codeinsights-db
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml
index 45ff67b0e..4a0a7d0be 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml
@@ -9,6 +9,7 @@ metadata:
     {{- toYaml .Values.codeInsightsDB.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app.kubernetes.io/component: codeinsights-db
     app: codeinsights-db
     deploy: sourcegraph
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml
index d70ffd650..8929204a3 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml
@@ -8,6 +8,7 @@ metadata:
   annotations:
     description: Configuration for PostgreSQL
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app.kubernetes.io/component: codeintel-db
     deploy: sourcegraph
   name: {{ .Values.codeIntelDB.name }}-conf
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml
index 021a54f0a..47743ab5f 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml
@@ -4,6 +4,7 @@ kind: Secret
 metadata:
   name: {{ .Values.codeIntelDB.name }}-auth
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: codeintel-db
     deploy: sourcegraph
     app.kubernetes.io/component: codeintel-db
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml
index a283d4712..79a9698cc 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml
@@ -9,6 +9,7 @@ metadata:
     {{- toYaml .Values.codeIntelDB.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app.kubernetes.io/component: codeintel-db
     app: codeintel-db
     deploy: sourcegraph
diff --git a/charts/sourcegraph/templates/extraResources.yaml b/charts/sourcegraph/templates/extraResources.yaml
index 00b404d00..a17aa5feb 100644
--- a/charts/sourcegraph/templates/extraResources.yaml
+++ b/charts/sourcegraph/templates/extraResources.yaml
@@ -1,4 +1,17 @@
+{{- $labels := include "sourcegraph.labels" $ | fromYaml }}
 {{- range .Values.extraResources }}
+{{- $resource := . }}
+{{- if kindIs "map" . }}
+  {{- /* Labels the resource sets itself take precedence over the common labels. */}}
+  {{- $resource = deepCopy . }}
+  {{- $metadata := get $resource "metadata" | default dict }}
+  {{- $resourceLabels := deepCopy $labels }}
+  {{- range $key, $value := get $metadata "labels" | default dict }}
+    {{- $_ := set $resourceLabels $key $value }}
+  {{- end }}
+  {{- $_ := set $metadata "labels" $resourceLabels }}
+  {{- $_ := set $resource "metadata" $metadata }}
+{{- end }}
 ---
-{{ tpl (. | toYaml) $ }}
+{{ tpl ($resource | toYaml) $ }}
 {{- end }}
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend-internal.Service.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend-internal.Service.yaml
index 1cf3290a5..67de4b053 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend-internal.Service.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend-internal.Service.yaml
@@ -6,6 +6,7 @@ metadata:
     {{- toYaml .Values.frontend.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: sourcegraph-frontend
     deploy: sourcegraph
     app.kubernetes.io/component: frontend
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Ingress.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Ingress.yaml
index 10a9c357e..5c1adbb46 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Ingress.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Ingress.yaml
@@ -13,6 +13,7 @@ metadata:
     {{- toYaml .Values.frontend.ingress.annotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: sourcegraph-frontend
     deploy: sourcegraph
     app.kubernetes.io/component: frontend
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
index 140088ea8..967599941 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: sourcegraph-frontend
 spec:
   {{- toYaml .Values.frontend.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml
index d03e1c555..08494c85b 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml
@@ -8,6 +8,7 @@ metadata:
     {{- toYaml .Values.frontend.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: sourcegraph-frontend
     deploy: sourcegraph
     app.kubernetes.io/component: frontend
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml
index 2a62dcd29..45187f5b1 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.gitserver.name }}
 spec:
   {{- toYaml .Values.gitserver.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml b/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml
index 9f8a4ca1c..42466e308 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml
@@ -10,6 +10,7 @@ metadata:
     {{- toYaml .Values.gitserver.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: gitserver
     type: gitserver
diff --git a/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml b/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml
index bcca1df13..82b1047d3 100644
--- a/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml
@@ -28,6 +28,7 @@ data:
 kind: ConfigMap
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: grafana
   name: {{ .Values.grafana.name }}
diff --git a/charts/sourcegraph/templates/grafana/grafana.Service.yaml b/charts/sourcegraph/templates/grafana/grafana.Service.yaml
index 0768f7ff6..9f32b9f46 100644
--- a/charts/sourcegraph/templates/grafana/grafana.Service.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.Service.yaml
@@ -7,6 +7,7 @@ metadata:
   {{- toYaml .Values.grafana.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: grafana
     deploy: sourcegraph
     app.kubernetes.io/component: grafana
diff --git a/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml b/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml
index ddefc5921..fe5d189e2 100644
--- a/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: grafana
     deploy: sourcegraph
     app.kubernetes.io/component: grafana
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.IndexerService.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.IndexerService.yaml
index edfed32b8..4f3da7d86 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.IndexerService.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.IndexerService.yaml
@@ -10,6 +10,7 @@ metadata:
     {{- toYaml .Values.indexedSearch.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: indexed-search-indexer
     deploy: sourcegraph
     app.kubernetes.io/component: indexed-search
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml
index 7ec274581..6cab4253f 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.indexedSearch.name }}
 spec:
   {{- toYaml .Values.indexedSearch.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml
index 5edffe2a9..e69855f6c 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml
@@ -10,6 +10,7 @@ metadata:
     {{- toYaml .Values.indexedSearch.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: indexed-search
     deploy: sourcegraph
     app.kubernetes.io/component: indexed-search
diff --git a/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml b/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml
index 3665df98e..588601d89 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml
@@ -7,10 +7,10 @@ metadata:
   {{- toYaml .Values.jaeger.collector.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.jaeger.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: all-in-one
     app: jaeger
-    app.kubernetes.io/name: jaeger
     {{- if .Values.jaeger.collector.serviceLabels }}
       {{- toYaml .Values.jaeger.collector.serviceLabels | nindent 4 }}
     {{- end }}
diff --git a/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml b/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml
index cfc9464b2..dfb7e2ef2 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml
@@ -7,10 +7,10 @@ metadata:
   {{- toYaml .Values.jaeger.query.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.jaeger.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: all-in-one
     app: jaeger
-    app.kubernetes.io/name: jaeger
     {{- if .Values.jaeger.query.serviceLabels }}
       {{- toYaml .Values.jaeger.query.serviceLabels | nindent 4 }}
     {{- end }}
diff --git a/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml b/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml
index b2dd5dabe..8d1297ccc 100644
--- a/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml
+++ b/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml
@@ -11,6 +11,7 @@ metadata:
     {{- toYaml .Values.nodeExporter.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app.kubernetes.io/component: node-exporter
     app: node-exporter
     deploy: sourcegraph
diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml
index e4b103289..62234a958 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml
@@ -5,6 +5,7 @@ kind: ConfigMap
 metadata:
   name: {{ .Values.openTelemetry.agent.name }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: otel-collector
 data:
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
index b236ee0bb..b73b64048 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
@@ -7,6 +7,7 @@ kind: ConfigMap
 metadata:
   name: {{ .Values.openTelemetry.gateway.name }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: otel-collector
 data:
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml b/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml
index 580849390..4b44ca8bf 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml
@@ -8,6 +8,7 @@ metadata:
   annotations:
     description: Configuration for PostgreSQL
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
   name: {{ .Values.pgsql.name }}-conf
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml b/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml
index 63ec30eb5..4a1b868f6 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: pgsql
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml b/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml
index eed8b3074..cb8a64165 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml
@@ -9,6 +9,7 @@ metadata:
     {{- toYaml .Values.pgsql.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: pgsql
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml
index 535f7f187..daf8d759a 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.preciseCodeIntel.name }}
 spec:
   {{- toYaml .Values.preciseCodeIntel.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml
index 59f9ed7aa..0f94bd041 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml
@@ -8,6 +8,7 @@ metadata:
     {{- toYaml .Values.preciseCodeIntel.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: precise-code-intel-worker
     deploy: sourcegraph
     app.kubernetes.io/component: precise-code-intel
diff --git a/charts/sourcegraph/templates/priorityClass.yaml b/charts/sourcegraph/templates/priorityClass.yaml
index 50d5e3829..fb52d5066 100644
--- a/charts/sourcegraph/templates/priorityClass.yaml
+++ b/charts/sourcegraph/templates/priorityClass.yaml
@@ -2,6 +2,8 @@
 apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" $ | nindent 4 }}
   name: {{ $class.name }}
 value: {{ $class.value }}
 preemptionPolicy: {{ $class.preemptionPolicy }}
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
index 9d5f789b8..18ff6679b 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
   name: {{ .Values.prometheus.name }}
@@ -160,6 +161,10 @@ data:
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
+      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      - action: labeldrop
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_namespace]
         action: replace
         # Sourcegraph specific customization. We want a more convenient to type label.
@@ -214,6 +219,10 @@ data:
         target_label: instance
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
+      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      - action: labeldrop
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_service_namespace]
         # Sourcegraph specific customization. We want a more convenient to type label.
         # target_label: kubernetes_namespace
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml b/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml
index 45b7367ac..8b30dd7a5 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml
@@ -7,6 +7,7 @@ metadata:
     {{- toYaml .Values.prometheus.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: prometheus
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
diff --git a/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml
index 0668eac6c..2630e233e 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.redisCache.name }}
 spec:
   {{- toYaml .Values.redisCache.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml b/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml
index 3e2129d22..f6d1db18c 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: redis-cache
     deploy: sourcegraph
     app.kubernetes.io/component: redis-cache
diff --git a/charts/sourcegraph/templates/redis/redis-cache.Service.yaml b/charts/sourcegraph/templates/redis/redis-cache.Service.yaml
index a5c7433e7..e9fec4011 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.Service.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.Service.yaml
@@ -9,6 +9,7 @@ metadata:
     {{- toYaml .Values.redisCache.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: redis-cache
     deploy: sourcegraph
     app.kubernetes.io/component: redis
diff --git a/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml
index 99cf9f58b..84e4792e0 100644
--- a/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.redisStore.name }}
 spec:
   {{- toYaml .Values.redisStore.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/redis/redis-store.Secret.yaml b/charts/sourcegraph/templates/redis/redis-store.Secret.yaml
index 534fc3779..4fc2ee3b7 100644
--- a/charts/sourcegraph/templates/redis/redis-store.Secret.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.Secret.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: redis-store
     deploy: sourcegraph
     app.kubernetes.io/component: redis-store
diff --git a/charts/sourcegraph/templates/redis/redis-store.Service.yaml b/charts/sourcegraph/templates/redis/redis-store.Service.yaml
index 120724ead..57a3be48a 100644
--- a/charts/sourcegraph/templates/redis/redis-store.Service.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.Service.yaml
@@ -9,6 +9,7 @@ metadata:
     {{- toYaml .Values.redisStore.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: redis-store
     deploy: sourcegraph
     app.kubernetes.io/component: redis
diff --git a/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml
index 2683b028c..462428391 100644
--- a/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.searcher.name }}
 spec:
   {{- toYaml .Values.searcher.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/searcher/searcher.Service.yaml b/charts/sourcegraph/templates/searcher/searcher.Service.yaml
index 6fc01a7cd..5783ca42f 100644
--- a/charts/sourcegraph/templates/searcher/searcher.Service.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.Service.yaml
@@ -8,6 +8,7 @@ metadata:
     {{- toYaml .Values.searcher.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: searcher
     deploy: sourcegraph
     app.kubernetes.io/component: searcher
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml
index 9f62342ad..b6d39710d 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.syntacticCodeIntel.name }}
 spec:
   {{- toYaml .Values.syntacticCodeIntel.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml
index 9a8d54260..e0547a761 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml
@@ -9,6 +9,7 @@ metadata:
     {{- toYaml .Values.syntacticCodeIntel.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: syntactic-code-intel-worker
     deploy: sourcegraph
     app.kubernetes.io/component: syntactic-code-intel
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml
index d34cf4bee..006224328 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml
@@ -2,6 +2,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
   name: {{ .Values.syntectServer.name }}
 spec:
   {{- toYaml .Values.syntectServer.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml
index dc5eccc7d..a506da44e 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml
@@ -8,6 +8,7 @@ metadata:
     {{- toYaml .Values.syntectServer.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: syntect-server
     deploy: sourcegraph
     app.kubernetes.io/component: syntect-server
diff --git a/charts/sourcegraph/templates/worker/worker-executors.Service.yaml b/charts/sourcegraph/templates/worker/worker-executors.Service.yaml
index a12d9e122..cca238ba1 100644
--- a/charts/sourcegraph/templates/worker/worker-executors.Service.yaml
+++ b/charts/sourcegraph/templates/worker/worker-executors.Service.yaml
@@ -8,6 +8,7 @@ metadata:
     {{- toYaml .Values.worker.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: worker
     deploy: sourcegraph
     app.kubernetes.io/component: worker
diff --git a/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml
index cd52d3c6d..a58d99308 100644
--- a/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml
@@ -8,6 +8,8 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
+  labels:
+    {{- include "sourcegraph.labels" $top | nindent 4 }}
   name: {{ $name }}
 spec:
   {{- toYaml $top.Values.worker.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/worker/worker.Service.yaml b/charts/sourcegraph/templates/worker/worker.Service.yaml
index b5a5ffb12..237cc7d9b 100644
--- a/charts/sourcegraph/templates/worker/worker.Service.yaml
+++ b/charts/sourcegraph/templates/worker/worker.Service.yaml
@@ -8,6 +8,7 @@ metadata:
     {{- toYaml .Values.worker.serviceAnnotations | nindent 4 }}
     {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: worker
     deploy: sourcegraph
     app.kubernetes.io/component: worker
diff --git a/charts/sourcegraph/tests/allObjectLabels_test.yaml b/charts/sourcegraph/tests/allObjectLabels_test.yaml
new file mode 100644
index 000000000..b6b2da085
--- /dev/null
+++ b/charts/sourcegraph/tests/allObjectLabels_test.yaml
@@ -0,0 +1,196 @@
+suite: sourcegraph.labels on every object
+release:
+  name: sourcegraph
+  namespace: sourcegraph
+# The chart version is part of the helm.sh/chart label and changes on every
+# release, so pin it to compare whole label sets.
+chart:
+  version: 1.2.3
+  appVersion: 1.2.3
+# No `templates` list, so every template in the chart is rendered, including
+# ones added later. The two excluded manifests are not rendered together with
+# the rest and are tested in the second suite of this file.
+excludeTemplates:
+- NOTES.txt
+- otel-collector/otel-collector.ConfigMap.yaml
+- prometheus/prometheus.RoleBinding.yaml
+tests:
+# This test fails with "no manifest found" for a template that renders nothing,
+# so enable a new optional template here.
+- it: should add sourcegraph.labels to every object the chart renders
+  set:
+    sourcegraph.labels: &globalLabels
+      example.com/installation: production
+      example.com/project: sourcegraph
+    storageClass.create: true
+    sgTestConnection.enabled: true
+    jaeger.enabled: true
+    nodeExporter.enabled: true
+    syntacticCodeIntel.enabled: true
+    frontend.ingress.enabled: true
+    redisCache.config.enabled: true
+    redisStore.config.enabled: true
+    grafana.auth:
+      database: grafana
+      host: pgsql
+      password: password
+      port: "5432"
+      sslmode: disable
+      user: grafana
+    worker.replicas:
+    - jobs: [codeintel-upload-janitor]
+    frontend.podDisruptionBudget: &podDisruptionBudget
+      maxUnavailable: 1
+    gitserver.podDisruptionBudget: *podDisruptionBudget
+    indexedSearch.podDisruptionBudget: *podDisruptionBudget
+    preciseCodeIntel.podDisruptionBudget: *podDisruptionBudget
+    redisCache.podDisruptionBudget: *podDisruptionBudget
+    redisStore.podDisruptionBudget: *podDisruptionBudget
+    searcher.podDisruptionBudget: *podDisruptionBudget
+    syntacticCodeIntel.podDisruptionBudget: *podDisruptionBudget
+    syntectServer.podDisruptionBudget: *podDisruptionBudget
+    worker.podDisruptionBudget: *podDisruptionBudget
+    blobstore.serviceAccount.create: true
+    cadvisor.serviceAccount.create: true
+    codeInsightsDB.serviceAccount.create: true
+    codeIntelDB.serviceAccount.create: true
+    frontend.serviceAccount.create: true
+    gitserver.serviceAccount.create: true
+    grafana.serviceAccount.create: true
+    indexedSearch.serviceAccount.create: true
+    jaeger.serviceAccount.create: true
+    nodeExporter.serviceAccount.create: true
+    openTelemetry.agent.serviceAccount.create: true
+    openTelemetry.gateway.serviceAccount.create: true
+    pgsql.serviceAccount.create: true
+    preciseCodeIntel.serviceAccount.create: true
+    prometheus.serviceAccount.create: true
+    redisCache.serviceAccount.create: true
+    redisStore.serviceAccount.create: true
+    searcher.serviceAccount.create: true
+    syntacticCodeIntel.serviceAccount.create: true
+    syntectServer.serviceAccount.create: true
+    worker.serviceAccount.create: true
+    priorityClasses:
+    - name: gitserver-class
+      value: 1000000
+    extraResources:
+    - apiVersion: networking.k8s.io/v1
+      kind: NetworkPolicy
+      metadata:
+        name: deny-all
+      spec:
+        podSelector: {}
+  asserts:
+  - isSubset:
+      path: metadata.labels
+      content: &allLabels
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
+
+- it: should keep the labels a Service already has
+  templates:
+  - frontend/sourcegraph-frontend.Service.yaml
+  - jaeger/jaeger-query.Service.yaml
+  set:
+    sourcegraph.labels: *globalLabels
+    jaeger.enabled: true
+    frontend.serviceLabels:
+      example.com/service: frontend
+  asserts:
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
+        example.com/service: frontend
+        app: sourcegraph-frontend
+        deploy: sourcegraph
+        app.kubernetes.io/component: frontend
+    template: frontend/sourcegraph-frontend.Service.yaml
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: jaeger
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
+        app: jaeger
+        deploy: sourcegraph
+        app.kubernetes.io/component: all-in-one
+    template: jaeger/jaeger-query.Service.yaml
+
+- it: should let an extra resource override sourcegraph.labels with its own labels
+  template: extraResources.yaml
+  set:
+    sourcegraph.labels: *globalLabels
+    extraResources:
+    - apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: extra
+        labels:
+          example.com/project: extra
+          example.com/release: "{{ .Release.Name }}"
+      data:
+        maxBytes: "1048576"
+  asserts:
+  - equal:
+      path: metadata.labels
+      value:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: extra
+        example.com/release: sourcegraph
+
+- it: should not copy the chart's version labels from Services to metrics
+  template: prometheus/prometheus.ConfigMap.yaml
+  asserts:
+  - matchRegex:
+      path: data["prometheus.yml"]
+      # Both jobs that map Service labels to metric labels drop the chart's labels afterwards.
+      pattern: (?s)(regex. __meta_kubernetes_service_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\n.*){2}
+---
+suite: sourcegraph.labels on the objects that replace others
+release:
+  name: sourcegraph
+  namespace: sourcegraph
+chart:
+  version: 1.2.3
+  appVersion: 1.2.3
+templates:
+- otel-collector/otel-collector.ConfigMap.yaml
+- prometheus/prometheus.RoleBinding.yaml
+tests:
+- it: should add sourcegraph.labels to the objects that replace others
+  set:
+    sourcegraph.labels:
+      example.com/installation: production
+      example.com/project: sourcegraph
+    prometheus.privileged: false
+    openTelemetry.gateway.config.traces.exporters:
+      otlp:
+        endpoint: collector.example.com:4317
+  asserts:
+  - isSubset:
+      path: metadata.labels
+      content:
+        helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/version: 1.2.3
+        app.kubernetes.io/managed-by: Helm
+        example.com/installation: production
+        example.com/project: sourcegraph
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index cf0e0ca7a..15bc538cc 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -15,7 +15,8 @@ sourcegraph:
     useGlobalTagAsDefault: false
   # -- Mount named secrets containing docker credentials
   imagePullSecrets: []
-  # -- Add extra labels to all resources
+  # -- Add extra labels to every object the chart renders, including `extraResources`. Prometheus copies the labels of
+  # a Service to the metrics it scrapes from it, so these labels also appear on those metrics.
   labels: {}
   # -- When true, remove all resource stanzas, allowing the scheduler to best-fit pods. Intended for local development with limited resources.
   localDevMode: false
@@ -1593,7 +1594,8 @@ worker:
     # -- Name of the ServiceAccount to be created or an existing ServiceAccount
     name: ""
 
-# -- Additional resources to include in the rendered manifest. Templates are supported.
+# -- Additional resources to include in the rendered manifest. Templates are supported. `sourcegraph.labels` and the
+# chart's standard labels are added to each resource; labels the resource sets itself take precedence.
 extraResources: []
 
 # -- Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class.

From da922939bbd357335632227b5abe1088f28109a7 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 19:13:03 +0000
Subject: [PATCH 03/16] sourcegraph: render
 redisStore.serviceAccount.annotations

The redis-store ServiceAccount was the only one that did not include the
annotations helper, so redisStore.serviceAccount.annotations was silently
dropped.

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md                    |  1 +
 .../redis/redis-store.ServiceAccount.yaml          |  1 +
 .../tests/serviceAccountAnnotations_test.yaml      | 14 ++++++++++++++
 3 files changed, 16 insertions(+)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 84eaa5f81..012be46d0 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,6 +9,7 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
+- Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
 - `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so labels set in `sourcegraph.labels` now appear on those metrics, as `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` already do. The bundled Prometheus configuration drops the chart's standard labels instead, because `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade; the `otel-collector` metrics, the only ones that had them, lose them. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml).
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
diff --git a/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml b/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml
index 259207cc7..dd5a2e6be 100644
--- a/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.ServiceAccount.yaml
@@ -10,5 +10,6 @@ metadata:
     category: rbac
     deploy: sourcegraph
     app.kubernetes.io/component: redis
+  {{- include "sourcegraph.serviceAccountAnnotations" (list . "redisStore") | trim | nindent 2 }}
   name: {{ include "sourcegraph.serviceAccountName" (list . "redisStore") }}
 {{- end }}
diff --git a/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml b/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml
index db5418647..19f2768e9 100644
--- a/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml
+++ b/charts/sourcegraph/tests/serviceAccountAnnotations_test.yaml
@@ -48,3 +48,17 @@ tests:
       value:
         iam.gke.io/gcp-service-account: sourcegraph@sourcegraph.iam.gserviceaccount.com
   - matchSnapshot: {}
+
+- it: should render service account annotations when redisStore.serviceAccount.annotations is defined
+  set:
+    redisStore:
+      serviceAccount:
+        create: true
+        annotations:
+          iam.gke.io/gcp-service-account: sourcegraph@sourcegraph.iam.gserviceaccount.com
+  template: redis/redis-store.ServiceAccount.yaml
+  asserts:
+  - equal:
+      path: metadata.annotations
+      value:
+        iam.gke.io/gcp-service-account: sourcegraph@sourcegraph.iam.gserviceaccount.com

From 545cfebc199461b56ff9d19d14319f5cf0af831f Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 19:29:14 +0000
Subject: [PATCH 04/16] Add deploy, component, and per-component labels to
 every object

PodDisruptionBudgets, PriorityClasses, the StorageClass, the test Pod, and
the k8s executor Secret now have deploy and app.kubernetes.io/component
labels, and the jaeger objects have app.kubernetes.io/instance.
<serviceName>.labels and executor.labels are also rendered on a component's
ConfigMaps, Secrets, and PodDisruptionBudget. Adds storageClass.labels,
priorityClasses[].labels, and privateDockerRegistry.serviceLabels (dind).

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph-executor/CHANGELOG.md      |   1 +
 charts/sourcegraph-executor/dind/README.md    |   1 +
 .../executor/docker-daemon.ConfigMap.yaml     |   3 +
 .../private-docker-registry.Service.yaml      |   3 +
 .../dind/tests/labels_test.yaml               |  27 +++
 charts/sourcegraph-executor/dind/values.yaml  |   2 +
 .../k8s/templates/executor.ConfigMap.yaml     |   5 +-
 .../k8s/templates/executor.Role.yaml          |   3 +
 .../k8s/templates/executor.RoleBinding.yaml   |   3 +
 .../k8s/templates/executor.Secret.yaml        |   4 +
 .../templates/executor.ServiceAccount.yaml    |   3 +
 .../k8s/tests/labels_test.yaml                |  24 +++
 .../tests/labels_test.yaml                    |  11 ++
 charts/sourcegraph/CHANGELOG.md               |   2 +
 charts/sourcegraph/README.md                  |   7 +-
 charts/sourcegraph/README.md.gotmpl           |   2 +
 charts/sourcegraph/templates/_helpers.tpl     |   1 +
 .../codeinsights-db.ConfigMap.yaml            |   3 +
 .../codeinsights-db.Secret.yaml               |   3 +
 .../codeintel-db/codeintel-db.ConfigMap.yaml  |   3 +
 .../codeintel-db/codeintel-db.Secret.yaml     |   3 +
 .../sourcegraph/templates/extraResources.yaml |   1 +
 ...rcegraph-frontend.PodDisruptionBudget.yaml |   5 +
 .../gitserver.PodDisruptionBudget.yaml        |   5 +
 .../templates/grafana/grafana.ConfigMap.yaml  |   3 +
 .../grafana/grafana.pgsql.Secret.yaml         |   3 +
 .../indexed-search.PodDisruptionBudget.yaml   |   5 +
 .../templates/jaeger/jaeger.ConfigMap.yaml    |   3 +
 .../otel-collector/otel-agent.ConfigMap.yaml  |   3 +
 .../otel-collector.ConfigMap.yaml             |   3 +
 .../templates/pgsql/pgsql.ConfigMap.yaml      |   3 +
 .../templates/pgsql/pgsql.Secret.yaml         |   3 +
 .../worker.PodDisruptionBudget.yaml           |   5 +
 .../sourcegraph/templates/priorityClass.yaml  |   5 +
 .../prometheus/prometheus.ConfigMap.yaml      |   3 +
 .../redis-cache.PodDisruptionBudget.yaml      |   5 +
 .../templates/redis/redis-cache.Secret.yaml   |   3 +
 .../redis-store.PodDisruptionBudget.yaml      |   5 +
 .../templates/redis/redis-store.Secret.yaml   |   3 +
 .../searcher.PodDisruptionBudget.yaml         |   5 +
 .../sourcegraph/templates/storageclass.yaml   |   4 +
 .../worker.PodDisruptionBudget.yaml           |   5 +
 .../syntect-server.PodDisruptionBudget.yaml   |   5 +
 .../templates/tests/test-connection.yaml      |   2 +
 .../worker/worker.PodDisruptionBudget.yaml    |   5 +
 .../tests/allObjectLabels_test.yaml           | 154 +++++++++++++++++-
 charts/sourcegraph/values.yaml                |  11 +-
 47 files changed, 363 insertions(+), 8 deletions(-)

diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md
index da22083bf..5cc26836d 100644
--- a/charts/sourcegraph-executor/CHANGELOG.md
+++ b/charts/sourcegraph-executor/CHANGELOG.md
@@ -3,6 +3,7 @@
 <!-- START CHANGELOG -->
 ## Unreleased
 
+- Every object the charts create now has the `deploy` and `app.kubernetes.io/component` labels: the `sourcegraph-executor-k8s` Secret did not have them. `executor.labels` is now also rendered on the `sourcegraph-executor-k8s` ConfigMap, Secret, ServiceAccount, Role, and RoleBinding, and on the `sourcegraph-executor-dind` `docker-config` ConfigMap, not only on the Deployment. Added `privateDockerRegistry.serviceLabels` to the `sourcegraph-executor-dind` chart to label the `private-docker-registry` Service.
 - `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted.
 
 ## 8.0.0
diff --git a/charts/sourcegraph-executor/dind/README.md b/charts/sourcegraph-executor/dind/README.md
index 14bff60a9..29726ab31 100644
--- a/charts/sourcegraph-executor/dind/README.md
+++ b/charts/sourcegraph-executor/dind/README.md
@@ -90,6 +90,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | privateDockerRegistry.image.registry | string | `"index.docker.io"` |  |
 | privateDockerRegistry.image.repository | string | `"registry"` |  |
 | privateDockerRegistry.image.tag | int | `3` |  |
+| privateDockerRegistry.serviceLabels | object | `{}` | Add extra labels to the `private-docker-registry` Service |
 | privateDockerRegistry.storageSize | string | `"10Gi"` |  |
 | queues | list | `[]` | Optional list of queues to deploy as standalone Deployments. When set, the single executor Deployment is not rendered. Each entry supports:   name        (required) — used as the deployment name suffix (executor-<name>)   queueName   — sets EXECUTOR_QUEUE_NAME; defaults to name if omitted   queueNames  — sets EXECUTOR_QUEUE_NAMES (comma-joined); takes precedence over queueName when set   replicaCount, resources, env (merged with executor.env, queue overrides) |
 | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) |
diff --git a/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml b/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
index d91dbdcb3..6ffb86250 100644
--- a/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
+++ b/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
@@ -3,6 +3,9 @@ kind: ConfigMap
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
     app: executor
     deploy: sourcegraph
     app.kubernetes.io/component: executor
diff --git a/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml b/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
index b2227b484..cf472ab58 100644
--- a/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
+++ b/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
@@ -11,6 +11,9 @@ metadata:
     app: private-docker-registry
     deploy: sourcegraph
     app.kubernetes.io/component: private-docker-registry
+    {{- if .Values.privateDockerRegistry.serviceLabels }}
+      {{- toYaml .Values.privateDockerRegistry.serviceLabels | nindent 4 }}
+    {{- end }}
   name: private-docker-registry
 spec:
   ports:
diff --git a/charts/sourcegraph-executor/dind/tests/labels_test.yaml b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
index 56c29a4ce..236bbcd0c 100644
--- a/charts/sourcegraph-executor/dind/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
@@ -18,5 +18,32 @@ tests:
           path: metadata.labels
           content:
             app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
             example.com/installation: production
             example.com/project: sourcegraph
+      - exists:
+          path: metadata.labels["helm.sh/chart"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/instance"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/component"]
+  - it: should add the labels of a component to every object of it
+    set:
+      executor:
+        queueName: batches
+        labels:
+          example.com/service: component
+      privateDockerRegistry:
+        enabled: true
+        labels:
+          example.com/service: component
+        serviceLabels:
+          example.com/service: component
+    asserts:
+      - equal:
+          path: metadata.labels["example.com/service"]
+          value: component
diff --git a/charts/sourcegraph-executor/dind/values.yaml b/charts/sourcegraph-executor/dind/values.yaml
index 571ebe624..10b74fae0 100644
--- a/charts/sourcegraph-executor/dind/values.yaml
+++ b/charts/sourcegraph-executor/dind/values.yaml
@@ -217,6 +217,8 @@ privateDockerRegistry:
     repository: registry
     tag: 3
   storageSize: 10Gi
+  # -- Add extra labels to the `private-docker-registry` Service
+  serviceLabels: {}
   # -- Extra environment variables to set on the registry container.
   # Registry can be configured with environment variables using the pattern
   # REGISTRY_<SECTION>_<KEY> (uppercase). Full reference:
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
index cfd074819..9963cfea1 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
@@ -4,7 +4,10 @@ metadata:
   name: {{ include "executor.name" . }}
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
-{{- include "executor.labels" . | nindent 4 }}
+    {{- include "executor.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
 data:
   EXECUTOR_USE_FIRECRACKER: "false"
   EXECUTOR_FRONTEND_URL: "{{ .Values.executor.frontendUrl }}"
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml
index 36107636e..68caac8a5 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml
@@ -5,6 +5,9 @@ metadata:
   name: sg-executor-role
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     sourcegraph-resource-requires: cluster-admin
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml b/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml
index df5814537..e7e6f2df7 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.RoleBinding.yaml
@@ -5,6 +5,9 @@ metadata:
   name: sg-executor-role-binding
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     sourcegraph-resource-requires: cluster-admin
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml
index 01fd6e810..936b4ea1a 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Secret.yaml
@@ -4,6 +4,10 @@ kind: Secret
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- include "executor.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
   name: {{ include "executor.name" . }}
 type: Opaque
 data:
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml
index 1b8d16bd3..39f2a0fb7 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.ServiceAccount.yaml
@@ -5,6 +5,9 @@ metadata:
   name: sg-executor
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
     category: rbac
     deploy: sourcegraph
     sourcegraph-resource-requires: cluster-admin
diff --git a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
index c0140b3c3..a627f5f03 100644
--- a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
@@ -17,5 +17,29 @@ tests:
           path: metadata.labels
           content:
             app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
             example.com/installation: production
             example.com/project: sourcegraph
+      - exists:
+          path: metadata.labels["helm.sh/chart"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/instance"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/component"]
+  - it: should add executor.labels to every object, and serviceLabels to the Service
+    set:
+      executor:
+        queueName: batches
+        configureRbac: true
+        labels:
+          example.com/service: executor
+        serviceLabels:
+          example.com/service: executor
+    asserts:
+      - equal:
+          path: metadata.labels["example.com/service"]
+          value: executor
diff --git a/charts/sourcegraph-migrator/tests/labels_test.yaml b/charts/sourcegraph-migrator/tests/labels_test.yaml
index 57f3df51e..10fdbe013 100644
--- a/charts/sourcegraph-migrator/tests/labels_test.yaml
+++ b/charts/sourcegraph-migrator/tests/labels_test.yaml
@@ -14,5 +14,16 @@ tests:
           path: metadata.labels
           content:
             app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
             example.com/installation: production
             example.com/project: sourcegraph
+      - exists:
+          path: metadata.labels["helm.sh/chart"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/instance"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 012be46d0..0e994ccbb 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,6 +9,8 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
+- Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
+- `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
 - `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so labels set in `sourcegraph.labels` now appear on those metrics, as `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` already do. The bundled Prometheus configuration drops the chart's standard labels instead, because `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade; the `otel-collector` metrics, the only ones that had them, lose them. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml).
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 0af76ab12..9e89bef36 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -107,6 +107,8 @@ existing objects have:
 
 - `sourcegraph.labels` adds labels to every object the chart renders, on every
   component.
+- `<serviceName>.labels` adds labels to one component's workload, ConfigMaps,
+  Secrets, and PodDisruptionBudget.
 - `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` add labels to
   every Service, or to one component's Services.
 - `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
@@ -234,7 +236,7 @@ In addition to the documented values, all services also support the following va
 | codeIntelDB.storageLabels | object | `{}` | Optional labels to add to the `codeintel-db` PVC, in addition to `sourcegraph.labels` |
 | codeIntelDB.storageSize | string | `"200Gi"` | PVC Storage Request for `codeintel-db` data volume |
 | codeIntelDB.storageSubPath | string | `""` | Optional subPath for the `codeintel-db` primary data volume mount |
-| extraResources | list | `[]` | Additional resources to include in the rendered manifest. Templates are supported. `sourcegraph.labels` and the chart's standard labels are added to each resource; labels the resource sets itself take precedence. |
+| extraResources | list | `[]` | Additional resources to include in the rendered manifest. Templates are supported. `sourcegraph.labels`, the chart's standard labels, and `deploy: sourcegraph` are added to each resource; labels the resource sets itself take precedence. |
 | frontend.command | list | `[]` | Command for the `frontend` container, as a list, replacing the image's entrypoint, e.g. a shell wrapper that exports credentials read from mounted files before starting `frontend`. `frontend.args` (default `["serve"]`) is still passed as the arguments. |
 | frontend.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `frontend` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | frontend.createRoleBinding | bool | `true` | Disable the roleBinding resource for deployment environments blocking RBAC, ex. OpenShift's default "secure" SCC |
@@ -426,7 +428,7 @@ In addition to the documented values, all services also support the following va
 | preciseCodeIntel.storageClassName | string | `""` | StorageClass for the `/tmp` scratch PVC when storageType is `pvc`. Empty uses the cluster default class. The claim is per-pod and discarded with the pod, so this class must use `reclaimPolicy: Delete`; `storageClass` is `Retain` for stateful data and is not used here. |
 | preciseCodeIntel.storageSize | string | `""` | Size of the `/tmp` scratch volume. Required when storageType is `pvc`. When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty for unlimited). |
 | preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. |
-| priorityClasses | list | `[]` | Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) Sample class definition: - name: gitserver-class   value: 100   preemptionPolicy: Never   description: "gitserver priority class" |
+| priorityClasses | list | `[]` | Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) Sample class definition: - name: gitserver-class   value: 100   preemptionPolicy: Never   description: "gitserver priority class"   labels: {} |
 | prometheus.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":false,"runAsGroup":100,"runAsUser":100}` | Security context for the `prometheus` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | prometheus.createRoleBinding | bool | `true` | Disable the creation of a RoleBinding object, for customers who block all RBAC resource creation |
 | prometheus.enabled | bool | `true` | Enable `prometheus` (recommended) |
@@ -531,6 +533,7 @@ In addition to the documented values, all services also support the following va
 | sourcegraph.tolerations | list | `[]` | Global Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
 | storageClass.allowedTopologies | list | `[]` | Persistent volumes topology configuration, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies) |
 | storageClass.create | bool | `true` | Enable creation of storageClass. Disable if you have your own existing storage class |
+| storageClass.labels | object | `{}` | Add extra labels to the storageClass, in addition to `sourcegraph.labels` |
 | storageClass.name | string | `"sourcegraph"` | Name of the storageClass. Use to customize to the existing storage class name |
 | storageClass.parameters | object | `{}` | Extra parameters of storageClass, consult your cloud provider persistent storage documentation |
 | storageClass.provisioner | string | `"kubernetes.io/gce-pd"` | Name of the storageClass provisioner, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#provisioner) and consult your cloud provider persistent storage documentation |
diff --git a/charts/sourcegraph/README.md.gotmpl b/charts/sourcegraph/README.md.gotmpl
index 38cc5f1de..bc85cadb3 100644
--- a/charts/sourcegraph/README.md.gotmpl
+++ b/charts/sourcegraph/README.md.gotmpl
@@ -107,6 +107,8 @@ existing objects have:
 
 - `sourcegraph.labels` adds labels to every object the chart renders, on every
   component.
+- `<serviceName>.labels` adds labels to one component's workload, ConfigMaps,
+  Secrets, and PodDisruptionBudget.
 - `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` add labels to
   every Service, or to one component's Services.
 - `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index 4b847139a..f182a0325 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -208,6 +208,7 @@ Jaeger common labels
 {{- define "sourcegraph.jaeger.labels" -}}
 helm.sh/chart: {{ include "sourcegraph.chart" . }}
 {{ include "sourcegraph.jaeger.selectorLabels" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml
index 64f2ef3df..e36447fd7 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.ConfigMap.yaml
@@ -9,6 +9,9 @@ metadata:
     description: Configuration for Code Insights
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.codeInsightsDB.labels }}
+      {{- toYaml .Values.codeInsightsDB.labels | nindent 4 }}
+    {{- end }}
     app.kubernetes.io/component: codeinsights-db
     deploy: sourcegraph
   name: {{ .Values.codeInsightsDB.name }}-conf
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml
index 946b5c8c8..5456333e8 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Secret.yaml
@@ -5,6 +5,9 @@ metadata:
   name: {{ .Values.codeInsightsDB.name }}-auth
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.codeInsightsDB.labels }}
+      {{- toYaml .Values.codeInsightsDB.labels | nindent 4 }}
+    {{- end }}
     app: codeinsights-db
     deploy: sourcegraph
     app.kubernetes.io/component: codeinsights-db
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml
index 8929204a3..adba5ddaa 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.ConfigMap.yaml
@@ -9,6 +9,9 @@ metadata:
     description: Configuration for PostgreSQL
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.codeIntelDB.labels }}
+      {{- toYaml .Values.codeIntelDB.labels | nindent 4 }}
+    {{- end }}
     app.kubernetes.io/component: codeintel-db
     deploy: sourcegraph
   name: {{ .Values.codeIntelDB.name }}-conf
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml
index 47743ab5f..19aba9ec0 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Secret.yaml
@@ -5,6 +5,9 @@ metadata:
   name: {{ .Values.codeIntelDB.name }}-auth
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.codeIntelDB.labels }}
+      {{- toYaml .Values.codeIntelDB.labels | nindent 4 }}
+    {{- end }}
     app: codeintel-db
     deploy: sourcegraph
     app.kubernetes.io/component: codeintel-db
diff --git a/charts/sourcegraph/templates/extraResources.yaml b/charts/sourcegraph/templates/extraResources.yaml
index a17aa5feb..65b16e154 100644
--- a/charts/sourcegraph/templates/extraResources.yaml
+++ b/charts/sourcegraph/templates/extraResources.yaml
@@ -1,4 +1,5 @@
 {{- $labels := include "sourcegraph.labels" $ | fromYaml }}
+{{- $_ := set $labels "deploy" "sourcegraph" }}
 {{- range .Values.extraResources }}
 {{- $resource := . }}
 {{- if kindIs "map" . }}
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
index 967599941..4de9d3abb 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.frontend.labels }}
+      {{- toYaml .Values.frontend.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: frontend
   name: sourcegraph-frontend
 spec:
   {{- toYaml .Values.frontend.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml
index 45187f5b1..74e4f945c 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.gitserver.labels }}
+      {{- toYaml .Values.gitserver.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: gitserver
   name: {{ .Values.gitserver.name }}
 spec:
   {{- toYaml .Values.gitserver.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml b/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml
index 82b1047d3..cea554d44 100644
--- a/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml
@@ -29,6 +29,9 @@ kind: ConfigMap
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.grafana.labels }}
+      {{- toYaml .Values.grafana.labels | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: grafana
   name: {{ .Values.grafana.name }}
diff --git a/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml b/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml
index fe5d189e2..96ad14866 100644
--- a/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.pgsql.Secret.yaml
@@ -4,6 +4,9 @@ kind: Secret
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.grafana.labels }}
+      {{- toYaml .Values.grafana.labels | nindent 4 }}
+    {{- end }}
     app: grafana
     deploy: sourcegraph
     app.kubernetes.io/component: grafana
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml
index 6cab4253f..00f9d2594 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.indexedSearch.labels }}
+      {{- toYaml .Values.indexedSearch.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: indexed-search
   name: {{ .Values.indexedSearch.name }}
 spec:
   {{- toYaml .Values.indexedSearch.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
index 7e2a388cf..168d482d8 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
@@ -4,6 +4,9 @@ kind: ConfigMap
 metadata:
   labels:
     {{- include "sourcegraph.jaeger.labels" . | nindent 4 }}
+    {{- if .Values.jaeger.labels }}
+      {{- toYaml .Values.jaeger.labels | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: all-in-one
     app: jaeger
diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml
index 62234a958..4f67eb4e3 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-agent.ConfigMap.yaml
@@ -6,6 +6,9 @@ metadata:
   name: {{ .Values.openTelemetry.agent.name }}
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.openTelemetry.agent.labels }}
+      {{- toYaml .Values.openTelemetry.agent.labels | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: otel-collector
 data:
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
index b73b64048..6151ae49d 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
@@ -8,6 +8,9 @@ metadata:
   name: {{ .Values.openTelemetry.gateway.name }}
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.openTelemetry.gateway.labels }}
+      {{- toYaml .Values.openTelemetry.gateway.labels | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: otel-collector
 data:
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml b/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml
index 4b44ca8bf..f4ea8ad8d 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.ConfigMap.yaml
@@ -9,6 +9,9 @@ metadata:
     description: Configuration for PostgreSQL
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.pgsql.labels }}
+      {{- toYaml .Values.pgsql.labels | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
   name: {{ .Values.pgsql.name }}-conf
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml b/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml
index 4a1b868f6..4d6972d29 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.Secret.yaml
@@ -4,6 +4,9 @@ kind: Secret
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.pgsql.labels }}
+      {{- toYaml .Values.pgsql.labels | nindent 4 }}
+    {{- end }}
     app: pgsql
     deploy: sourcegraph
     app.kubernetes.io/component: pgsql
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml
index daf8d759a..6b5701265 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.preciseCodeIntel.labels }}
+      {{- toYaml .Values.preciseCodeIntel.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: precise-code-intel
   name: {{ .Values.preciseCodeIntel.name }}
 spec:
   {{- toYaml .Values.preciseCodeIntel.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/priorityClass.yaml b/charts/sourcegraph/templates/priorityClass.yaml
index fb52d5066..194908530 100644
--- a/charts/sourcegraph/templates/priorityClass.yaml
+++ b/charts/sourcegraph/templates/priorityClass.yaml
@@ -4,6 +4,11 @@ kind: PriorityClass
 metadata:
   labels:
     {{- include "sourcegraph.labels" $ | nindent 4 }}
+    {{- with $class.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: priority-class
   name: {{ $class.name }}
 value: {{ $class.value }}
 preemptionPolicy: {{ $class.preemptionPolicy }}
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
index 18ff6679b..1746e18df 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
@@ -4,6 +4,9 @@ kind: ConfigMap
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.prometheus.labels }}
+      {{- toYaml .Values.prometheus.labels | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph
     app.kubernetes.io/component: prometheus
   name: {{ .Values.prometheus.name }}
diff --git a/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml
index 2630e233e..d7a93ecee 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.redisCache.labels }}
+      {{- toYaml .Values.redisCache.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: redis
   name: {{ .Values.redisCache.name }}
 spec:
   {{- toYaml .Values.redisCache.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml b/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml
index f6d1db18c..d9ce1ea2f 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.Secret.yaml
@@ -4,6 +4,9 @@ kind: Secret
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.redisCache.labels }}
+      {{- toYaml .Values.redisCache.labels | nindent 4 }}
+    {{- end }}
     app: redis-cache
     deploy: sourcegraph
     app.kubernetes.io/component: redis-cache
diff --git a/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml
index 84e4792e0..cd975b958 100644
--- a/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.redisStore.labels }}
+      {{- toYaml .Values.redisStore.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: redis
   name: {{ .Values.redisStore.name }}
 spec:
   {{- toYaml .Values.redisStore.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/redis/redis-store.Secret.yaml b/charts/sourcegraph/templates/redis/redis-store.Secret.yaml
index 4fc2ee3b7..4f15cf014 100644
--- a/charts/sourcegraph/templates/redis/redis-store.Secret.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.Secret.yaml
@@ -4,6 +4,9 @@ kind: Secret
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.redisStore.labels }}
+      {{- toYaml .Values.redisStore.labels | nindent 4 }}
+    {{- end }}
     app: redis-store
     deploy: sourcegraph
     app.kubernetes.io/component: redis-store
diff --git a/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml
index 462428391..952e4e85d 100644
--- a/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.searcher.labels }}
+      {{- toYaml .Values.searcher.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: searcher
   name: {{ .Values.searcher.name }}
 spec:
   {{- toYaml .Values.searcher.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/storageclass.yaml b/charts/sourcegraph/templates/storageclass.yaml
index a3af7c53d..3c2231ac9 100644
--- a/charts/sourcegraph/templates/storageclass.yaml
+++ b/charts/sourcegraph/templates/storageclass.yaml
@@ -5,7 +5,11 @@ metadata:
   name:  {{ .Values.storageClass.name }}
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- with .Values.storageClass.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
     deploy: sourcegraph-storage
+    app.kubernetes.io/component: storage
   {{- if .Values.storageClass.annotations}}
   annotations:
     {{- toYaml .Values.storageClass.annotations | nindent 4 }}
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml
index b6d39710d..0951155aa 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.syntacticCodeIntel.labels }}
+      {{- toYaml .Values.syntacticCodeIntel.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: syntactic-code-intel
   name: {{ .Values.syntacticCodeIntel.name }}
 spec:
   {{- toYaml .Values.syntacticCodeIntel.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml
index 006224328..00e8975e3 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.PodDisruptionBudget.yaml
@@ -4,6 +4,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.syntectServer.labels }}
+      {{- toYaml .Values.syntectServer.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: syntect-server
   name: {{ .Values.syntectServer.name }}
 spec:
   {{- toYaml .Values.syntectServer.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/templates/tests/test-connection.yaml b/charts/sourcegraph/templates/tests/test-connection.yaml
index 3aafe14f7..73a24f217 100644
--- a/charts/sourcegraph/templates/tests/test-connection.yaml
+++ b/charts/sourcegraph/templates/tests/test-connection.yaml
@@ -6,6 +6,8 @@ metadata:
     "helm.sh/hook": test
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: test-connection
   name: "sg-test-connection"
 spec:
   containers:
diff --git a/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml b/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml
index a58d99308..004c65e59 100644
--- a/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml
+++ b/charts/sourcegraph/templates/worker/worker.PodDisruptionBudget.yaml
@@ -10,6 +10,11 @@ kind: PodDisruptionBudget
 metadata:
   labels:
     {{- include "sourcegraph.labels" $top | nindent 4 }}
+    {{- if $top.Values.worker.labels }}
+      {{- toYaml $top.Values.worker.labels | nindent 4 }}
+    {{- end }}
+    deploy: sourcegraph
+    app.kubernetes.io/component: worker
   name: {{ $name }}
 spec:
   {{- toYaml $top.Values.worker.podDisruptionBudget | nindent 2 }}
diff --git a/charts/sourcegraph/tests/allObjectLabels_test.yaml b/charts/sourcegraph/tests/allObjectLabels_test.yaml
index b6b2da085..0116544b7 100644
--- a/charts/sourcegraph/tests/allObjectLabels_test.yaml
+++ b/charts/sourcegraph/tests/allObjectLabels_test.yaml
@@ -1,4 +1,4 @@
-suite: sourcegraph.labels on every object
+suite: labels on every object
 release:
   name: sourcegraph
   namespace: sourcegraph
@@ -17,7 +17,7 @@ excludeTemplates:
 tests:
 # This test fails with "no manifest found" for a template that renders nothing,
 # so enable a new optional template here.
-- it: should add sourcegraph.labels to every object the chart renders
+- it: should add sourcegraph.labels and the chart's labels to every object the chart renders
   set:
     sourcegraph.labels: &globalLabels
       example.com/installation: production
@@ -79,6 +79,9 @@ tests:
       kind: NetworkPolicy
       metadata:
         name: deny-all
+        # The chart cannot know which component an extra resource belongs to.
+        labels:
+          app.kubernetes.io/component: network-policy
       spec:
         podSelector: {}
   asserts:
@@ -86,10 +89,144 @@ tests:
       path: metadata.labels
       content: &allLabels
         helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/instance: sourcegraph
         app.kubernetes.io/version: 1.2.3
         app.kubernetes.io/managed-by: Helm
         example.com/installation: production
         example.com/project: sourcegraph
+  # The values differ per object: jaeger is named `jaeger`, and the StorageClass is `deploy: sourcegraph-storage`.
+  - exists:
+      path: metadata.labels["app.kubernetes.io/name"]
+  - exists:
+      path: metadata.labels.deploy
+  - exists:
+      path: metadata.labels["app.kubernetes.io/component"]
+
+- it: should add a component's labels to its ConfigMaps, Secrets, and PodDisruptionBudget
+  templates:
+  - codeinsights-db/codeinsights-db.ConfigMap.yaml
+  - codeinsights-db/codeinsights-db.Secret.yaml
+  - codeintel-db/codeintel-db.ConfigMap.yaml
+  - codeintel-db/codeintel-db.Secret.yaml
+  - frontend/sourcegraph-frontend.PodDisruptionBudget.yaml
+  - gitserver/gitserver.PodDisruptionBudget.yaml
+  - grafana/grafana.ConfigMap.yaml
+  - grafana/grafana.pgsql.Secret.yaml
+  - indexed-search/indexed-search.PodDisruptionBudget.yaml
+  - jaeger/jaeger.ConfigMap.yaml
+  - otel-collector/otel-agent.ConfigMap.yaml
+  - pgsql/pgsql.ConfigMap.yaml
+  - pgsql/pgsql.Secret.yaml
+  - precise-code-intel/worker.PodDisruptionBudget.yaml
+  - prometheus/prometheus.ConfigMap.yaml
+  - redis/redis-cache.ConfigMap.yaml
+  - redis/redis-cache.PodDisruptionBudget.yaml
+  - redis/redis-cache.Secret.yaml
+  - redis/redis-store.ConfigMap.yaml
+  - redis/redis-store.PodDisruptionBudget.yaml
+  - redis/redis-store.Secret.yaml
+  - searcher/searcher.PodDisruptionBudget.yaml
+  - syntactic-code-intel/worker.PodDisruptionBudget.yaml
+  - syntect-server/syntect-server.PodDisruptionBudget.yaml
+  - worker/worker.PodDisruptionBudget.yaml
+  set:
+    codeInsightsDB.labels: &componentLabels
+      example.com/service: component
+    codeIntelDB.labels: *componentLabels
+    frontend.labels: *componentLabels
+    gitserver.labels: *componentLabels
+    grafana.labels: *componentLabels
+    indexedSearch.labels: *componentLabels
+    jaeger.labels: *componentLabels
+    openTelemetry.agent.labels: *componentLabels
+    pgsql.labels: *componentLabels
+    preciseCodeIntel.labels: *componentLabels
+    prometheus.labels: *componentLabels
+    redisCache.labels: *componentLabels
+    redisStore.labels: *componentLabels
+    searcher.labels: *componentLabels
+    syntacticCodeIntel.labels: *componentLabels
+    syntectServer.labels: *componentLabels
+    worker.labels: *componentLabels
+    jaeger.enabled: true
+    syntacticCodeIntel.enabled: true
+    redisCache.config.enabled: true
+    redisStore.config.enabled: true
+    grafana.auth:
+      database: grafana
+      host: pgsql
+      password: password
+      port: "5432"
+      sslmode: disable
+      user: grafana
+    worker.replicas:
+    - jobs: [codeintel-upload-janitor]
+    frontend.podDisruptionBudget: *podDisruptionBudget
+    gitserver.podDisruptionBudget: *podDisruptionBudget
+    indexedSearch.podDisruptionBudget: *podDisruptionBudget
+    preciseCodeIntel.podDisruptionBudget: *podDisruptionBudget
+    redisCache.podDisruptionBudget: *podDisruptionBudget
+    redisStore.podDisruptionBudget: *podDisruptionBudget
+    searcher.podDisruptionBudget: *podDisruptionBudget
+    syntacticCodeIntel.podDisruptionBudget: *podDisruptionBudget
+    syntectServer.podDisruptionBudget: *podDisruptionBudget
+    worker.podDisruptionBudget: *podDisruptionBudget
+  asserts:
+  - isSubset:
+      path: metadata.labels
+      content:
+        example.com/service: component
+
+- it: should label a PodDisruptionBudget with the component of its workload
+  templates:
+  - redis/redis-store.Deployment.yaml
+  - redis/redis-store.PodDisruptionBudget.yaml
+  - syntactic-code-intel/worker.Deployment.yaml
+  - syntactic-code-intel/worker.PodDisruptionBudget.yaml
+  set:
+    syntacticCodeIntel.enabled: true
+    redisStore.podDisruptionBudget: *podDisruptionBudget
+    syntacticCodeIntel.podDisruptionBudget: *podDisruptionBudget
+  asserts:
+  - equal:
+      path: metadata.labels["app.kubernetes.io/component"]
+      value: redis
+    template: redis/redis-store.Deployment.yaml
+  - equal:
+      path: metadata.labels["app.kubernetes.io/component"]
+      value: redis
+    template: redis/redis-store.PodDisruptionBudget.yaml
+  - equal:
+      path: metadata.labels["app.kubernetes.io/component"]
+      value: syntactic-code-intel
+    template: syntactic-code-intel/worker.Deployment.yaml
+  - equal:
+      path: metadata.labels["app.kubernetes.io/component"]
+      value: syntactic-code-intel
+    template: syntactic-code-intel/worker.PodDisruptionBudget.yaml
+
+- it: should add the labels of a priority class and of the storage class
+  templates:
+  - priorityClass.yaml
+  - storageclass.yaml
+  set:
+    storageClass.create: true
+    storageClass.labels:
+      example.com/service: storage
+    priorityClasses:
+    - name: gitserver-class
+      value: 1000000
+      labels:
+        example.com/service: gitserver
+  asserts:
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: gitserver
+    template: priorityClass.yaml
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: storage
+    template: storageclass.yaml
 
 - it: should keep the labels a Service already has
   templates:
@@ -121,6 +258,7 @@ tests:
       value:
         helm.sh/chart: sourcegraph-1.2.3
         app.kubernetes.io/name: jaeger
+        app.kubernetes.io/instance: sourcegraph
         app.kubernetes.io/version: 1.2.3
         app.kubernetes.io/managed-by: Helm
         example.com/installation: production
@@ -156,6 +294,7 @@ tests:
         example.com/installation: production
         example.com/project: extra
         example.com/release: sourcegraph
+        deploy: sourcegraph
 
 - it: should not copy the chart's version labels from Services to metrics
   template: prometheus/prometheus.ConfigMap.yaml
@@ -185,12 +324,23 @@ tests:
     openTelemetry.gateway.config.traces.exporters:
       otlp:
         endpoint: collector.example.com:4317
+    openTelemetry.gateway.labels:
+      example.com/service: otel-collector
   asserts:
   - isSubset:
       path: metadata.labels
       content:
         helm.sh/chart: sourcegraph-1.2.3
+        app.kubernetes.io/instance: sourcegraph
         app.kubernetes.io/version: 1.2.3
         app.kubernetes.io/managed-by: Helm
         example.com/installation: production
         example.com/project: sourcegraph
+  - exists:
+      path: metadata.labels.deploy
+  - exists:
+      path: metadata.labels["app.kubernetes.io/component"]
+  - equal:
+      path: metadata.labels["example.com/service"]
+      value: otel-collector
+    template: otel-collector/otel-collector.ConfigMap.yaml
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index 15bc538cc..5e3e8c790 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -71,7 +71,8 @@ sourcegraph:
 #     # Override the global sourcegraph.image.repository on a service-specific basis
 #     repository:
 #
-#   # Add additional labels and annotations to various resources
+#   # Add additional labels and annotations to various resources.
+#   # `labels` is added to the component's workload, ConfigMaps, Secrets, and PodDisruptionBudget
 #   labels: {}
 #   podLabels: {}
 #   podAnnotations: {}
@@ -1406,6 +1407,8 @@ storageClass:
   # -- Extra parameters of storageClass,
   # consult your cloud provider persistent storage documentation
   parameters: {}
+  # -- Add extra labels to the storageClass, in addition to `sourcegraph.labels`
+  labels: {}
   # -- Persistent volumes topology configuration,
   # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies)
   allowedTopologies: []
@@ -1594,8 +1597,9 @@ worker:
     # -- Name of the ServiceAccount to be created or an existing ServiceAccount
     name: ""
 
-# -- Additional resources to include in the rendered manifest. Templates are supported. `sourcegraph.labels` and the
-# chart's standard labels are added to each resource; labels the resource sets itself take precedence.
+# -- Additional resources to include in the rendered manifest. Templates are supported. `sourcegraph.labels`, the
+# chart's standard labels, and `deploy: sourcegraph` are added to each resource; labels the resource sets itself take
+# precedence.
 extraResources: []
 
 # -- Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class.
@@ -1605,6 +1609,7 @@ extraResources: []
 #   value: 100
 #   preemptionPolicy: Never
 #   description: "gitserver priority class"
+#   labels: {}
 priorityClasses: []
 
 # -- Enable the busybox connection test after deployment

From 89fda20041ad58d99747de4fbcf9971d8e1e6830 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 19:39:07 +0000
Subject: [PATCH 05/16] Keep sourcegraph.labels off metrics and label the
 otel-collector Service with its app

The bundled Prometheus copies Service labels to the metrics it scrapes. Now
that every Service has sourcegraph.labels, the labeldrop rule also drops
those keys, so the labels of Service-scraped metrics stay as they are on main.

The rule no longer drops app.kubernetes.io/managed-by: Helm adds that label
to every object it installs, so the metrics already had it.

The otel-collector Service had no app label, unlike every other scraped
Service, so its metrics had no app and job labels and the dashboard's
up{app=~".*otel-collector"} panel and alert had no data.

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md               |  3 +-
 charts/sourcegraph/README.md                  |  5 +--
 charts/sourcegraph/README.md.gotmpl           |  3 +-
 .../prometheus-override-k3s.ConfigMap.yaml    | 16 ++++---
 charts/sourcegraph/templates/_helpers.tpl     | 23 ++++++++++
 .../otel-collector.Service.yaml               |  1 +
 .../prometheus/prometheus.ConfigMap.yaml      | 12 +++---
 .../tests/allObjectLabels_test.yaml           | 43 ++++++++++++++++---
 charts/sourcegraph/values.yaml                |  4 +-
 9 files changed, 84 insertions(+), 26 deletions(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 0e994ccbb..de6fec164 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,10 +9,11 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
+- Fixed the `otel-collector` Service missing the `app` label that every other scraped Service has. Its metrics had no `app` and `job` labels, so the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, had no data. Its metrics now have `app="otel-collector"` and `job="otel-collector"`.
 - Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
-- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so labels set in `sourcegraph.labels` now appear on those metrics, as `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` already do. The bundled Prometheus configuration drops the chart's standard labels instead, because `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade; the `otel-collector` metrics, the only ones that had them, lose them. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml).
+- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so the bundled Prometheus configuration now drops `helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, and the keys of `sourcegraph.labels`, which keeps the labels of those metrics as they were. `app.kubernetes.io/managed-by` stays on them: Helm already added it to every Service. Only the `otel-collector` metrics lose labels, because its Service already had these. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. Prometheus reads its configuration when it starts, so restart the `prometheus` Deployment after an upgrade that does not replace its pod. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 9e89bef36..3176c7203 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -109,8 +109,7 @@ existing objects have:
   component.
 - `<serviceName>.labels` adds labels to one component's workload, ConfigMaps,
   Secrets, and PodDisruptionBudget.
-- `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` add labels to
-  every Service, or to one component's Services.
+- `<serviceName>.serviceLabels` adds labels to one component's Services.
 - `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
   `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`,
   `redisCache`, or `redisStore`.
@@ -518,7 +517,7 @@ In addition to the documented values, all services also support the following va
 | sourcegraph.image.repository | string | Sourcegraph's public Docker Hub registry | Global docker image registry or prefix |
 | sourcegraph.image.useGlobalTagAsDefault | bool | `false` | When set to true, sourcegraph.image.defaultTag is used as the default defaultTag for all services, instead of service-specific default defaultTags |
 | sourcegraph.imagePullSecrets | list | `[]` | Mount named secrets containing docker credentials |
-| sourcegraph.labels | object | `{}` | Add extra labels to every object the chart renders, including `extraResources`. Prometheus copies the labels of a Service to the metrics it scrapes from it, so these labels also appear on those metrics. |
+| sourcegraph.labels | object | `{}` | Add extra labels to every object the chart renders, including `extraResources`. The bundled Prometheus does not copy these labels from a Service to the metrics it scrapes from it; use `<serviceName>.serviceLabels` for that. |
 | sourcegraph.localDevMode | bool | `false` | When true, remove all resource stanzas, allowing the scheduler to best-fit pods. Intended for local development with limited resources. |
 | sourcegraph.nameOverride | string | `""` | Set a custom name for the app.kubernetes.io/name annotation |
 | sourcegraph.nodeSelector | object | `{}` | Global NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) |
diff --git a/charts/sourcegraph/README.md.gotmpl b/charts/sourcegraph/README.md.gotmpl
index bc85cadb3..05c95d08b 100644
--- a/charts/sourcegraph/README.md.gotmpl
+++ b/charts/sourcegraph/README.md.gotmpl
@@ -109,8 +109,7 @@ existing objects have:
   component.
 - `<serviceName>.labels` adds labels to one component's workload, ConfigMaps,
   Secrets, and PodDisruptionBudget.
-- `sourcegraph.serviceLabels` and `<serviceName>.serviceLabels` add labels to
-  every Service, or to one component's Services.
+- `<serviceName>.serviceLabels` adds labels to one component's Services.
 - `<serviceName>.storageLabels` adds labels to the PersistentVolumeClaim of
   `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`,
   `redisCache`, or `redisStore`.
diff --git a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
index 552b5ef93..45e68abe3 100644
--- a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
+++ b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
@@ -98,10 +98,12 @@ data:
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
-      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade. If you set
+      # `sourcegraph.labels`, append its keys, with `_` for every character that is not a letter, digit, or `_`,
+      # e.g. `|example_com_project` for `example.com/project`.
       - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version)
       - source_labels: [__meta_kubernetes_namespace]
         action: replace
         target_label: ns
@@ -135,10 +137,12 @@ data:
         target_label: instance
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
-      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade. If you set
+      # `sourcegraph.labels`, append its keys, with `_` for every character that is not a letter, digit, or `_`,
+      # e.g. `|example_com_project` for `example.com/project`.
       - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version)
       - source_labels: [__meta_kubernetes_service_namespace]
         target_label: ns
       - source_labels: [__meta_kubernetes_service_name]
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index f182a0325..c75aa33ef 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -28,6 +28,29 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 {{- end }}
 
+{{/*
+Regex of the Service labels that the bundled Prometheus must not copy to the
+metrics it scrapes: the labels this chart adds to every Service and the keys of
+`sourcegraph.labels`, spelled as Prometheus spells them, with `_` for every
+character outside `[a-zA-Z0-9_]`. This keeps the labels of those metrics as
+they were before the chart labelled its Services.
+
+Labels that were already on Services are kept: the ones the chart sets, such as
+`app`, which dashboards and alerts query, and `app.kubernetes.io/managed-by`,
+which Helm adds to every object it installs.
+*/}}
+{{- define "sourcegraph.prometheus.droppedServiceLabels" -}}
+{{- $names := list "helm_sh_chart" "app_kubernetes_io_(name|instance|version)" -}}
+{{- $kept := list "app" "deploy" "type" "app_kubernetes_io_component" "app_kubernetes_io_managed_by" "sourcegraph_resource_requires" -}}
+{{- range $key := keys (.Values.sourcegraph.labels | default dict) | sortAlpha -}}
+{{- $name := regexReplaceAll "[^a-zA-Z0-9_]" $key "_" -}}
+{{- if not (has $name $kept) -}}
+{{- $names = append $names $name -}}
+{{- end -}}
+{{- end -}}
+{{- $names | uniq | join "|" -}}
+{{- end }}
+
 {{/*
 Selector labels, shared by a component's workload selector, pod labels, and
 Service and PodDisruptionBudget selectors, so they cannot drift apart.
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml
index 9b5e03bc8..bb321fdf6 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml
@@ -10,6 +10,7 @@ metadata:
     {{- end }}
   labels:
     {{- include "sourcegraph.labels" . | nindent 4 }}
+    app: otel-collector
     {{- if .Values.openTelemetry.gateway.serviceLabels }}
       {{- toYaml .Values.openTelemetry.gateway.serviceLabels | nindent 4 }}
     {{- end }}
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
index 1746e18df..88e7a8821 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
@@ -164,10 +164,10 @@ data:
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
-      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service, or
+      # `sourcegraph.labels`, to every metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
       - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
+        regex: {{ include "sourcegraph.prometheus.droppedServiceLabels" . }}
       - source_labels: [__meta_kubernetes_namespace]
         action: replace
         # Sourcegraph specific customization. We want a more convenient to type label.
@@ -222,10 +222,10 @@ data:
         target_label: instance
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the chart's standard labels from the Service to every
-      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service, or
+      # `sourcegraph.labels`, to every metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
       - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
+        regex: {{ include "sourcegraph.prometheus.droppedServiceLabels" . }}
       - source_labels: [__meta_kubernetes_service_namespace]
         # Sourcegraph specific customization. We want a more convenient to type label.
         # target_label: kubernetes_namespace
diff --git a/charts/sourcegraph/tests/allObjectLabels_test.yaml b/charts/sourcegraph/tests/allObjectLabels_test.yaml
index 0116544b7..efc05cbf9 100644
--- a/charts/sourcegraph/tests/allObjectLabels_test.yaml
+++ b/charts/sourcegraph/tests/allObjectLabels_test.yaml
@@ -296,13 +296,14 @@ tests:
         example.com/release: sourcegraph
         deploy: sourcegraph
 
-- it: should not copy the chart's version labels from Services to metrics
-  template: prometheus/prometheus.ConfigMap.yaml
+# Prometheus derives the `app` and `job` labels of a Service's metrics from its
+# `app` label, and the "pods available" alert queries `up{app=~".*otel-collector"}`.
+- it: should label the otel-collector Service with its app, like every other scraped Service
+  template: otel-collector/otel-collector.Service.yaml
   asserts:
-  - matchRegex:
-      path: data["prometheus.yml"]
-      # Both jobs that map Service labels to metric labels drop the chart's labels afterwards.
-      pattern: (?s)(regex. __meta_kubernetes_service_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\n.*){2}
+  - equal:
+      path: metadata.labels.app
+      value: otel-collector
 ---
 suite: sourcegraph.labels on the objects that replace others
 release:
@@ -344,3 +345,33 @@ tests:
       path: metadata.labels["example.com/service"]
       value: otel-collector
     template: otel-collector/otel-collector.ConfigMap.yaml
+---
+suite: Service labels that Prometheus does not copy to metrics
+templates:
+- prometheus/prometheus.ConfigMap.yaml
+tests:
+# The dashboards and alerts were written for metrics without these labels, and
+# `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+- it: should not copy the labels the chart adds to every Service to metrics
+  asserts:
+  - matchRegex:
+      path: data["prometheus.yml"]
+      # Both jobs that map Service labels to metric labels drop the chart's labels afterwards.
+      # `app.kubernetes.io/managed-by` is not dropped: Helm adds it to every object it installs,
+      # so the metrics already had it.
+      pattern: (?s)(regex. __meta_kubernetes_service_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\)\n.*){2}
+
+- it: should not copy sourcegraph.labels from Services to metrics
+  set:
+    sourcegraph.labels:
+      team: platform
+      example.com/project: sourcegraph
+      cost-center: "1234"
+      # Labels the chart sets on Services stay on metrics: `job` is derived from `app`.
+      app: sourcegraph
+      type: internal
+  asserts:
+  - matchRegex:
+      path: data["prometheus.yml"]
+      # Prometheus replaces every character of a label key outside [a-zA-Z0-9_] with `_`.
+      pattern: (?s)(regex. __meta_kubernetes_service_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\)\|cost_center\|example_com_project\|team\n.*){2}
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index 5e3e8c790..5d7053ff2 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -15,8 +15,8 @@ sourcegraph:
     useGlobalTagAsDefault: false
   # -- Mount named secrets containing docker credentials
   imagePullSecrets: []
-  # -- Add extra labels to every object the chart renders, including `extraResources`. Prometheus copies the labels of
-  # a Service to the metrics it scrapes from it, so these labels also appear on those metrics.
+  # -- Add extra labels to every object the chart renders, including `extraResources`. The bundled Prometheus does not
+  # copy these labels from a Service to the metrics it scrapes from it; use `<serviceName>.serviceLabels` for that.
   labels: {}
   # -- When true, remove all resource stanzas, allowing the scheduler to best-fit pods. Intended for local development with limited resources.
   localDevMode: false

From fa3cd31b22e2e005358b80153d304aa482c6d587 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 19:59:02 +0000
Subject: [PATCH 06/16] otel-collector: serve the collector's own metrics on
 all interfaces

The image's logging.yaml, and the ConfigMap the chart renders for custom
exporters, left the collector's metrics on 127.0.0.1:8888, where Prometheus
cannot scrape them. With the app label the Service gained, up was 0 and the
pods available alert fired instead of showing no data.

Pass the telemetry readers setting as a second --config to the default
command, and add it to the rendered ConfigMap. jaeger.yaml already has it.

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md                     |  2 +-
 charts/sourcegraph/templates/_helpers.tpl           | 13 +++++++++++++
 .../otel-collector/otel-collector.ConfigMap.yaml    |  5 +++++
 .../otel-collector/otel-collector.Deployment.yaml   |  2 ++
 .../sourcegraph/tests/otelCollectorJaeger_test.yaml | 12 +++++++++++-
 5 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index de6fec164..8237e7734 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,7 +9,7 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
-- Fixed the `otel-collector` Service missing the `app` label that every other scraped Service has. Its metrics had no `app` and `job` labels, so the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, had no data. Its metrics now have `app="otel-collector"` and `job="otel-collector"`.
+- Fixed the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, having no data. The `otel-collector` Service was missing the `app` label that every other scraped Service has, so its metrics had no `app` and `job` labels. They now have `app="otel-collector"` and `job="otel-collector"`. The collector also served its own metrics on 127.0.0.1 only, unless `jaeger.enabled` was set, so Prometheus could not scrape them. It now serves them on all interfaces, port 8888: the default command passes the setting as a second `--config` argument, which restarts the `otel-collector` pod once, and the ConfigMap rendered for `openTelemetry.gateway.config.traces.exporters` includes it. The pod does not restart when only that ConfigMap changes, so restart the `otel-collector` Deployment after an upgrade that does not replace its pod. If you set `openTelemetry.gateway.command` with your own configuration file, add `service.telemetry.metrics.readers` to it, as in the chart's `otel-collector` ConfigMap. Until the metrics can be scraped, the alert fires.
 - Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index c75aa33ef..3bb19cc36 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -51,6 +51,19 @@ which Helm adds to every object it installs.
 {{- $names | uniq | join "|" -}}
 {{- end }}
 
+{{/*
+The `service.telemetry.metrics.readers` setting of `otel-collector`, as a YAML
+flow sequence. It serves the collector's own metrics on all interfaces, port
+8888, where Prometheus scrapes them. The collector defaults to 127.0.0.1, which
+other pods cannot reach. Without the type and unit suffixes the metric names are
+the ones the bundled dashboard queries, e.g. `otelcol_receiver_accepted_spans`.
+
+The image's `jaeger.yaml` already has this setting. Its `logging.yaml` does not.
+*/}}
+{{- define "sourcegraph.otelCollector.metricsReaders" -}}
+[{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]
+{{- end }}
+
 {{/*
 Selector labels, shared by a component's workload selector, pod labels, and
 Service and PodDisruptionBudget selectors, so they cannot drift apart.
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
index 6151ae49d..1e4e64812 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.ConfigMap.yaml
@@ -39,6 +39,11 @@ data:
         endpoint: "localhost:55679"
 
     service:
+      telemetry:
+        metrics:
+          # Serve the collector's own metrics on all interfaces, for Prometheus to scrape.
+          # The collector defaults to 127.0.0.1.
+          readers: {{ include "sourcegraph.otelCollector.metricsReaders" . }}
       extensions:
         - health_check
         - zpages
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
index c25b8e5cf..ef3fa6146 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
@@ -56,6 +56,8 @@ spec:
           - "/bin/otelcol-sourcegraph"
           {{- if and (not .Values.openTelemetry.gateway.config.traces.exporters) (not .Values.jaeger.enabled) }}  # default config: enable logging exporter
           - "--config=/etc/otel-collector/configs/logging.yaml"
+          # logging.yaml serves the collector's own metrics on 127.0.0.1 only, where Prometheus cannot scrape them.
+          - {{ printf "--config=yaml:service::telemetry::metrics::readers: %s" (include "sourcegraph.otelCollector.metricsReaders" .) | quote }}
           {{- else if .Values.jaeger.enabled }} # use bundled config to connect to bundled jaeger
           - "--config=/etc/otel-collector/configs/jaeger.yaml"
           {{- else }} # use config defined by customer in values.yaml
diff --git a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
index a9ae2a3c0..fddcbbba2 100644
--- a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
+++ b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
@@ -4,9 +4,14 @@ tests:
   - it: should use the logging exporter when Jaeger is disabled and no exporter has been set
     template: otel-collector/otel-collector.Deployment.yaml
     asserts:
+      # The second --config serves the collector's own metrics on all interfaces: logging.yaml
+      # leaves them on 127.0.0.1, where Prometheus cannot scrape them.
       - equal:
           path: spec.template.spec.containers[0].command
-          value: [ "/bin/otelcol-sourcegraph", "--config=/etc/otel-collector/configs/logging.yaml" ]
+          value:
+            - "/bin/otelcol-sourcegraph"
+            - "--config=/etc/otel-collector/configs/logging.yaml"
+            - '--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]'
       - isEmpty:
           path: spec.template.spec.containers[0].volumeMounts
       - isEmpty:
@@ -68,6 +73,11 @@ tests:
           path: data["config.yaml"]
           pattern: "endpoint: otlp.service.com:443" # check if element of config is substituted correctly
         template: otel-collector/otel-collector.ConfigMap.yaml
+      - matchRegex:
+          path: data["config.yaml"]
+          # the collector's own metrics are served on all interfaces, for Prometheus to scrape
+          pattern: 'service:\n  telemetry:\n    metrics:\n(\s*#.*\n)*\s*readers: \[\{pull: \{exporter: \{prometheus: \{host: "0\.0\.0\.0", port: 8888, '
+        template: otel-collector/otel-collector.ConfigMap.yaml
   - it: should fail if a configuration is provided and jaeger is enabled
     template: otel-collector/otel-collector.ConfigMap.yaml
     set:

From 113a0ac977178f84f065fa2d4b04a982895109c4 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 20:21:55 +0000
Subject: [PATCH 07/16] otel-collector: document what a replacement command
 needs for its metrics to be scraped

openTelemetry.gateway.command replaces the default command, so it does not get
the argument that serves the collector's metrics on all interfaces.

Amp-Thread-ID: https://ampcode.com/threads/T-c7c725c9-ed68-48e2-9f2d-0b8c31e76050
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md | 2 +-
 charts/sourcegraph/README.md    | 2 +-
 charts/sourcegraph/values.yaml  | 7 +++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 8237e7734..c4f2852f6 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,7 +9,7 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
-- Fixed the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, having no data. The `otel-collector` Service was missing the `app` label that every other scraped Service has, so its metrics had no `app` and `job` labels. They now have `app="otel-collector"` and `job="otel-collector"`. The collector also served its own metrics on 127.0.0.1 only, unless `jaeger.enabled` was set, so Prometheus could not scrape them. It now serves them on all interfaces, port 8888: the default command passes the setting as a second `--config` argument, which restarts the `otel-collector` pod once, and the ConfigMap rendered for `openTelemetry.gateway.config.traces.exporters` includes it. The pod does not restart when only that ConfigMap changes, so restart the `otel-collector` Deployment after an upgrade that does not replace its pod. If you set `openTelemetry.gateway.command` with your own configuration file, add `service.telemetry.metrics.readers` to it, as in the chart's `otel-collector` ConfigMap. Until the metrics can be scraped, the alert fires.
+- Fixed the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, having no data. The `otel-collector` Service was missing the `app` label that every other scraped Service has, so its metrics had no `app` and `job` labels. They now have `app="otel-collector"` and `job="otel-collector"`. The collector also served its own metrics on 127.0.0.1 only, unless `jaeger.enabled` was set, so Prometheus could not scrape them. It now serves them on all interfaces, port 8888: the default command passes the setting as a second `--config` argument, which restarts the `otel-collector` pod once, and the ConfigMap rendered for `openTelemetry.gateway.config.traces.exporters` includes it. The pod does not restart when only that ConfigMap changes, so restart the `otel-collector` Deployment after an upgrade that does not replace its pod. A command set in `openTelemetry.gateway.command` replaces the default one, so it does not get the argument. If it runs `/etc/otel-collector/config.yaml` or the image's `jaeger.yaml`, it needs no change. If it runs the image's `logging.yaml`, add the argument `--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]` after its `--config`. If it runs your own configuration file, set `service.telemetry.metrics.readers` to that list in the file. Until the metrics can be scraped, the alert fires.
 - Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 3176c7203..c900b8f80 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -373,7 +373,7 @@ In addition to the documented values, all services also support the following va
 | openTelemetry.agent.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `otel-agent` |
 | openTelemetry.agent.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | openTelemetry.enabled | bool | `true` |  |
-| openTelemetry.gateway.command | list | `[]` | Command for the `otel-collector` container, as a list, replacing the chart's `/bin/otelcol-sourcegraph --config=<file>` command, including the `--config` flag the chart selects, e.g. a shell wrapper that exports an exporter API key read from a mounted file. `openTelemetry.gateway.args` is still passed as the arguments. |
+| openTelemetry.gateway.command | list | `[]` | Command for the `otel-collector` container, as a list, replacing the chart's `/bin/otelcol-sourcegraph --config=<file>` command, including the `--config` flag the chart selects, e.g. a shell wrapper that exports an exporter API key read from a mounted file. `openTelemetry.gateway.args` is still passed as the arguments. The default command makes the collector serve its own metrics on all interfaces, where Prometheus scrapes them. A command that runs `/etc/otel-collector/config.yaml`, rendered from `config.traces.exporters`, or the image's `jaeger.yaml` does too. A command that runs the image's `logging.yaml` must also pass the second argument of the default command, `--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]`, and your own configuration file must set `service.telemetry.metrics.readers` to that list. Otherwise Prometheus cannot scrape the collector and its "pods available" alert fires. |
 | openTelemetry.gateway.config.traces.exporters | object | `{}` | Define where traces should be exported to. Read how to configure different backends in the [OpenTelemetry documentation](https://opentelemetry.io/docs/collector/configuration/#exporters) |
 | openTelemetry.gateway.config.traces.exportersTlsSecretName | string | `""` | Define the name of a preexisting secret containing TLS certificates for exporters, which will be mounted under "/tls". Read more about TLS configuration of exporters in the [OpenTelemetry Collector documentation](https://github.com/open-telemetry/opentelemetry-collector/blob/main/config/configtls/README.md) |
 | openTelemetry.gateway.config.traces.processors | object | `{}` | Define trace processors. Read how to configure sampling in the [OpenTelemetry documentation](https://docs.sourcegraph.com/admin/observability/opentelemetry#sampling-traces) |
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index 5d7053ff2..b9069b147 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -756,6 +756,13 @@ openTelemetry:
     # `/bin/otelcol-sourcegraph --config=<file>` command, including the `--config` flag the chart
     # selects, e.g. a shell wrapper that exports an exporter API key read from a mounted file.
     # `openTelemetry.gateway.args` is still passed as the arguments.
+    # The default command makes the collector serve its own metrics on all interfaces, where Prometheus
+    # scrapes them. A command that runs `/etc/otel-collector/config.yaml`, rendered from
+    # `config.traces.exporters`, or the image's `jaeger.yaml` does too. A command that runs the image's
+    # `logging.yaml` must also pass the second argument of the default command,
+    # `--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]`,
+    # and your own configuration file must set `service.telemetry.metrics.readers` to that list.
+    # Otherwise Prometheus cannot scrape the collector and its "pods available" alert fires.
     command: []
     # -- Resource requests & limits for the `otel-collector` container,
     # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)

From 774c915f8b107f7ff3e14a9e3222a8213a9aa42d Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 13:19:50 -0600
Subject: [PATCH 08/16] sourcegraph: restart prometheus when its configuration
 changes

---
 charts/sourcegraph/CHANGELOG.md               |  1 +
 .../prometheus/prometheus.Deployment.yaml     |  4 +++
 .../tests/prometheusConfigChecksum_test.yaml  | 26 +++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 charts/sourcegraph/tests/prometheusConfigChecksum_test.yaml

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index c4f2852f6..88b2782ac 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -13,6 +13,7 @@ Use `**BREAKING**:` to denote a breaking change
 - Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
+- The `prometheus` pod now restarts when an upgrade changes the chart's `prometheus.yml`, through a `checksum/prometheus-config` pod annotation. Prometheus does not reload a changed ConfigMap by itself, so such a change took effect only at the pod's next restart. The annotation is not set with `prometheus.existingConfig`: restart the pod yourself after changing your own ConfigMap.
 - `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so the bundled Prometheus configuration now drops `helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, and the keys of `sourcegraph.labels`, which keeps the labels of those metrics as they were. `app.kubernetes.io/managed-by` stays on them: Helm already added it to every Service. Only the `otel-collector` metrics lose labels, because its Service already had these. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. Prometheus reads its configuration when it starts, so restart the `prometheus` Deployment after an upgrade that does not replace its pod. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
index f9044e9e1..c7a2862ae 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
@@ -26,6 +26,10 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: prometheus
+        {{- if not .Values.prometheus.existingConfig }}
+        {{- /* Prometheus does not reload a changed ConfigMap by itself. The ConfigMap's labels are left out of the hash. */}}
+        checksum/prometheus-config: {{ (include (print $.Template.BasePath "/prometheus/prometheus.ConfigMap.yaml") . | fromYaml).data | toJson | sha256sum }}
+        {{- end }}
       {{- if .Values.sourcegraph.podAnnotations }}
       {{- toYaml .Values.sourcegraph.podAnnotations | nindent 8 }}
       {{- end }}
diff --git a/charts/sourcegraph/tests/prometheusConfigChecksum_test.yaml b/charts/sourcegraph/tests/prometheusConfigChecksum_test.yaml
new file mode 100644
index 000000000..d51af9373
--- /dev/null
+++ b/charts/sourcegraph/tests/prometheusConfigChecksum_test.yaml
@@ -0,0 +1,26 @@
+---
+suite: prometheusConfigChecksum
+# The ConfigMap template is listed so the Deployment's checksum annotation can
+# include it.
+templates:
+- prometheus/prometheus.Deployment.yaml
+- prometheus/prometheus.ConfigMap.yaml
+tests:
+- it: should restart prometheus when the chart's configuration changes
+  template: prometheus/prometheus.Deployment.yaml
+  asserts:
+  - matchRegex:
+      path: spec.template.metadata.annotations["checksum/prometheus-config"]
+      pattern: ^[0-9a-f]{64}$
+  # The hash of `null`, which is what an unreadable ConfigMap would hash to
+  - notEqual:
+      path: spec.template.metadata.annotations["checksum/prometheus-config"]
+      value: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+- it: should drop the checksum annotation with an existing ConfigMap
+  template: prometheus/prometheus.Deployment.yaml
+  set:
+    prometheus:
+      existingConfig: my-prometheus-config
+  asserts:
+  - notExists:
+      path: spec.template.metadata.annotations["checksum/prometheus-config"]

From 9147911157eae3a67dcd3048b0a183ffbf1ba1ce Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:12:13 -0600
Subject: [PATCH 09/16] Add the common labels to pods and keep them off all
 scraped metrics

Pod templates now get `sourcegraph.labels`, the chart's standard labels,
and `app.kubernetes.io/component`, as every other object does. One helper,
`sourcegraph.podLabels`, merges them with `sourcegraph.podLabels`, the
component's `podLabels`, and the selector labels, so each key is rendered
once and a selector label always wins.

The Prometheus `labeldrop` rule now also drops
`app.kubernetes.io/managed-by` and also applies to the `kubernetes-pods`
job, so Helm and `helm template | kubectl apply` installs get the same
metric labels. No bundled dashboard or alert queries the dropped labels.

The changelog no longer asks for a manual Prometheus restart: the
`checksum/prometheus-config` annotation restarts it.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1cc03-93a7-7445-8f1f-3dd7123272bf
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph-executor/CHANGELOG.md      |  2 +-
 .../dind/templates/_helpers.tpl               | 23 +++++---
 .../private-docker-registry.Statefulset.yaml  |  9 +--
 .../dind/tests/labels_test.yaml               | 58 +++++++++++++++++++
 .../k8s/templates/_helpers.tpl                | 15 +++++
 .../k8s/templates/executor.Deployment.yaml    |  8 +--
 .../k8s/tests/labels_test.yaml                | 28 +++++++++
 .../templates/_helpers.tpl                    | 15 +++++
 .../migrator/sourcegraph-migrator.Job.yaml    |  9 +--
 .../tests/labels_test.yaml                    | 26 +++++++++
 charts/sourcegraph/CHANGELOG.md               |  6 +-
 .../prometheus-override-k3s.ConfigMap.yaml    | 14 +++--
 charts/sourcegraph/templates/_helpers.tpl     | 38 ++++++++----
 charts/sourcegraph/templates/_worker.tpl      |  9 +--
 .../blobstore/blobstore.Deployment.yaml       |  9 +--
 .../cadvisor/cadvisor.DaemonSet.yaml          |  9 +--
 .../codeinsights-db.StatefulSet.yaml          |  9 +--
 .../codeintel-db.StatefulSet.yaml             |  9 +--
 .../sourcegraph-frontend.Deployment.yaml      |  9 +--
 .../gitserver/gitserver.StatefulSet.yaml      |  9 +--
 .../grafana/grafana.StatefulSet.yaml          |  9 +--
 .../indexed-search.StatefulSet.yaml           |  9 +--
 .../templates/jaeger/jaeger.Deployment.yaml   | 10 +---
 .../node-exporter.DaemonSet.yaml              |  9 +--
 .../otel-collector/otel-agent.DaemonSet.yaml  |  9 +--
 .../otel-collector.Deployment.yaml            |  9 +--
 .../templates/pgsql/pgsql.StatefulSet.yaml    |  9 +--
 .../precise-code-intel/worker.Deployment.yaml |  9 +--
 .../prometheus/prometheus.ConfigMap.yaml      | 12 ++--
 .../prometheus/prometheus.Deployment.yaml     |  9 +--
 .../redis/redis-cache.Deployment.yaml         |  9 +--
 .../redis/redis-store.Deployment.yaml         |  9 +--
 .../searcher/searcher.StatefulSet.yaml        |  9 +--
 .../worker.Deployment.yaml                    |  9 +--
 .../syntect-server.Deployment.yaml            |  9 +--
 .../tests/allObjectLabels_test.yaml           | 20 +++----
 .../tests/selectorLabels_test.yaml            | 55 ++++++++++++++++--
 37 files changed, 313 insertions(+), 215 deletions(-)

diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md
index 5cc26836d..f652c1dbf 100644
--- a/charts/sourcegraph-executor/CHANGELOG.md
+++ b/charts/sourcegraph-executor/CHANGELOG.md
@@ -4,7 +4,7 @@
 ## Unreleased
 
 - Every object the charts create now has the `deploy` and `app.kubernetes.io/component` labels: the `sourcegraph-executor-k8s` Secret did not have them. `executor.labels` is now also rendered on the `sourcegraph-executor-k8s` ConfigMap, Secret, ServiceAccount, Role, and RoleBinding, and on the `sourcegraph-executor-dind` `docker-config` ConfigMap, not only on the Deployment. Added `privateDockerRegistry.serviceLabels` to the `sourcegraph-executor-dind` chart to label the `private-docker-registry` Service.
-- `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted.
+- `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Pods get them too, and the `private-docker-registry` pod gains `app.kubernetes.io/component`. Existing releases gain these labels on upgrade. No object is recreated. Every pod restarts on this upgrade, and from now on whenever the chart version changes, because `helm.sh/chart` and `app.kubernetes.io/version` are pod labels.
 
 ## 8.0.0
 
diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
index 8b87b5d24..aec7e5345 100644
--- a/charts/sourcegraph-executor/dind/templates/_helpers.tpl
+++ b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
@@ -35,6 +35,21 @@ app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
 {{/*
 Create the name of the service account to use
 */}}
@@ -169,13 +184,7 @@ spec:
       {{- toYaml $r.Values.executor.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" $r | nindent 8 }}
-      {{- if $r.Values.sourcegraph.podLabels }}
-      {{- toYaml $r.Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if $r.Values.executor.podLabels }}
-      {{- toYaml $r.Values.executor.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list $r $r.Values.executor) | nindent 8 }}
         app: {{ .name }}
         deploy: sourcegraph
         sourcegraph-resource-requires: no-cluster-admin
diff --git a/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Statefulset.yaml b/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Statefulset.yaml
index 71f3194e8..84fcae9f3 100644
--- a/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Statefulset.yaml
+++ b/charts/sourcegraph-executor/dind/templates/private-docker-registry/private-docker-registry.Statefulset.yaml
@@ -30,15 +30,10 @@ spec:
       {{- toYaml .Values.privateDockerRegistry.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" . | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.privateDockerRegistry.podLabels }}
-      {{- toYaml .Values.privateDockerRegistry.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.privateDockerRegistry) | nindent 8 }}
         deploy: sourcegraph
         app: private-docker-registry
+        app.kubernetes.io/component: private-docker-registry
     spec:
       containers:
         - name: private-docker-registry
diff --git a/charts/sourcegraph-executor/dind/tests/labels_test.yaml b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
index 236bbcd0c..88dc1d0e5 100644
--- a/charts/sourcegraph-executor/dind/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
@@ -47,3 +47,61 @@ tests:
       - equal:
           path: metadata.labels["example.com/service"]
           value: component
+  - it: should add sourcegraph.labels and the chart's labels to the pod template, and let the selector labels win
+    template: executor/executor.Deployment.yaml
+    set:
+      sourcegraph:
+        labels:
+          example.com/project: sourcegraph
+        podLabels:
+          example.com/project: pods
+          # A selector label: a different value would stop the selector from matching the pods.
+          app.kubernetes.io/instance: other
+      executor:
+        queueName: batches
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/project: pods
+      - exists:
+          path: spec.template.metadata.labels["helm.sh/chart"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
+  - it: should add sourcegraph.labels and the chart's labels to the pod template, and let the selector labels win
+    template: private-docker-registry/private-docker-registry.Statefulset.yaml
+    set:
+      sourcegraph:
+        labels:
+          example.com/project: sourcegraph
+        podLabels:
+          example.com/project: pods
+          # A selector label: a different value would stop the selector from matching the pods.
+          app.kubernetes.io/instance: other
+      executor:
+        queueName: batches
+      privateDockerRegistry:
+        enabled: true
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/project: pods
+      - exists:
+          path: spec.template.metadata.labels["helm.sh/chart"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
index 70f75b28c..168ac8114 100644
--- a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
+++ b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
@@ -35,6 +35,21 @@ app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
 {{/*
 Create the name of the service account to use
 */}}
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml
index 9978038b0..a001db219 100644
--- a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml
+++ b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml
@@ -38,13 +38,7 @@ spec:
       {{- toYaml .Values.executor.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" . | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.executor.podLabels }}
-      {{- toYaml .Values.executor.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.executor) | nindent 8 }}
         {{- include "executor.labels" . | nindent 8 }}
     spec:
       securityContext:
diff --git a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
index a627f5f03..33d00deaf 100644
--- a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
@@ -43,3 +43,31 @@ tests:
       - equal:
           path: metadata.labels["example.com/service"]
           value: executor
+  - it: should add sourcegraph.labels and the chart's labels to the pod template, and let the selector labels win
+    template: executor.Deployment.yaml
+    set:
+      sourcegraph:
+        labels:
+          example.com/project: sourcegraph
+        podLabels:
+          example.com/project: pods
+          # A selector label: a different value would stop the selector from matching the pods.
+          app.kubernetes.io/instance: other
+      executor:
+        queueName: batches
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/project: pods
+      - exists:
+          path: spec.template.metadata.labels["helm.sh/chart"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph-migrator/templates/_helpers.tpl b/charts/sourcegraph-migrator/templates/_helpers.tpl
index f6ce9b36d..a438403b4 100644
--- a/charts/sourcegraph-migrator/templates/_helpers.tpl
+++ b/charts/sourcegraph-migrator/templates/_helpers.tpl
@@ -35,6 +35,21 @@ app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.migrator) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
 {{/*
 Create the name of the service account to use
 */}}
diff --git a/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml b/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml
index c77ec3b33..4e41b3a28 100644
--- a/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml
+++ b/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml
@@ -24,15 +24,10 @@ spec:
       {{- toYaml .Values.migrator.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" . | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.migrator.podLabels }}
-      {{- toYaml .Values.migrator.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.migrator) | nindent 8 }}
         job: migrator
         deploy: sourcegraph
+        app.kubernetes.io/component: migrator
     spec:
       containers:
       - name: migrator
diff --git a/charts/sourcegraph-migrator/tests/labels_test.yaml b/charts/sourcegraph-migrator/tests/labels_test.yaml
index 10fdbe013..dea0a7ed4 100644
--- a/charts/sourcegraph-migrator/tests/labels_test.yaml
+++ b/charts/sourcegraph-migrator/tests/labels_test.yaml
@@ -27,3 +27,29 @@ tests:
           path: metadata.labels["app.kubernetes.io/version"]
       - exists:
           path: metadata.labels["app.kubernetes.io/component"]
+  - it: should add sourcegraph.labels and the chart's labels to the pod template, and let the selector labels win
+    template: migrator/sourcegraph-migrator.Job.yaml
+    set:
+      sourcegraph:
+        labels:
+          example.com/project: sourcegraph
+        podLabels:
+          example.com/project: pods
+          # A selector label: a different value would stop the selector from matching the pods.
+          app.kubernetes.io/instance: other
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/project: pods
+      - exists:
+          path: spec.template.metadata.labels["helm.sh/chart"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 88b2782ac..08b54717d 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -13,9 +13,9 @@ Use `**BREAKING**:` to denote a breaking change
 - Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
-- The `prometheus` pod now restarts when an upgrade changes the chart's `prometheus.yml`, through a `checksum/prometheus-config` pod annotation. Prometheus does not reload a changed ConfigMap by itself, so such a change took effect only at the pod's next restart. The annotation is not set with `prometheus.existingConfig`: restart the pod yourself after changing your own ConfigMap.
-- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Labels that an `extraResources` entry or `serviceLabels` set take precedence. Labels on these objects can be changed in place, so nothing is recreated or restarted. Prometheus copies the labels of a Service to the metrics it scrapes from it, so the bundled Prometheus configuration now drops `helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, and the keys of `sourcegraph.labels`, which keeps the labels of those metrics as they were. `app.kubernetes.io/managed-by` stays on them: Helm already added it to every Service. Only the `otel-collector` metrics lose labels, because its Service already had these. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. Prometheus reads its configuration when it starts, so restart the `prometheus` Deployment after an upgrade that does not replace its pod. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
-- Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so nothing is recreated or restarted. See [Adopting existing workloads](README.md#adopting-existing-workloads).
+- The `prometheus` pod now restarts when an upgrade changes the chart's `prometheus.yml`, through a `checksum/prometheus-config` pod annotation. Prometheus does not reload a changed ConfigMap by itself, so such a change took effect only at the pod's next restart. The annotation is not set with `prometheus.existingConfig`.
+- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts on this upgrade, and from now on whenever the chart version changes, because `helm.sh/chart` and `app.kubernetes.io/version` are pod labels. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` and `jaeger` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
+- Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so none is recreated. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed `frontend.command` and `migrator.command` rendering a list as a single element, e.g. `["sh", "-c", "<script>"]` became `[sh -c <script>]`, so the container failed to start. Both are now rendered as YAML lists and documented in `values.yaml`. A string holding a YAML list, the only form that worked before, still renders unchanged.
diff --git a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
index 45e68abe3..fb0bab8a3 100644
--- a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
+++ b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
@@ -98,12 +98,12 @@ data:
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service to every
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object to every
       # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade. If you set
       # `sourcegraph.labels`, append its keys, with `_` for every character that is not a letter, digit, or `_`,
       # e.g. `|example_com_project` for `example.com/project`.
       - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version)
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_namespace]
         action: replace
         target_label: ns
@@ -137,12 +137,12 @@ data:
         target_label: instance
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service to every
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object to every
       # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade. If you set
       # `sourcegraph.labels`, append its keys, with `_` for every character that is not a letter, digit, or `_`,
       # e.g. `|example_com_project` for `example.com/project`.
       - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version)
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_service_namespace]
         target_label: ns
       - source_labels: [__meta_kubernetes_service_name]
@@ -167,6 +167,12 @@ data:
         target_label: __address__
       - action: labelmap
         regex: __meta_kubernetes_pod_label_(.+)
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object to every
+      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade. If you set
+      # `sourcegraph.labels`, append its keys, with `_` for every character that is not a letter, digit, or `_`,
+      # e.g. `|example_com_project` for `example.com/project`.
+      - action: labeldrop
+        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
       - source_labels: [__meta_kubernetes_pod_name]
         action: replace
         target_label: kubernetes_pod_name
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index 3bb19cc36..ae8760c13 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -29,19 +29,18 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 
 {{/*
-Regex of the Service labels that the bundled Prometheus must not copy to the
-metrics it scrapes: the labels this chart adds to every Service and the keys of
-`sourcegraph.labels`, spelled as Prometheus spells them, with `_` for every
-character outside `[a-zA-Z0-9_]`. This keeps the labels of those metrics as
-they were before the chart labelled its Services.
-
-Labels that were already on Services are kept: the ones the chart sets, such as
-`app`, which dashboards and alerts query, and `app.kubernetes.io/managed-by`,
-which Helm adds to every object it installs.
+Regex of the Service and pod labels that the bundled Prometheus must not copy to
+the metrics it scrapes: the common labels and the keys of `sourcegraph.labels`,
+spelled as Prometheus spells them, with `_` for every character outside
+`[a-zA-Z0-9_]`. No bundled dashboard or alert queries them, and `helm.sh/chart`
+and `app.kubernetes.io/version` change on every upgrade.
+
+A key of `sourcegraph.labels` that the chart also sets itself, such as `app`,
+is kept: the chart's value wins on the object, and dashboards and alerts query it.
 */}}
-{{- define "sourcegraph.prometheus.droppedServiceLabels" -}}
-{{- $names := list "helm_sh_chart" "app_kubernetes_io_(name|instance|version)" -}}
-{{- $kept := list "app" "deploy" "type" "app_kubernetes_io_component" "app_kubernetes_io_managed_by" "sourcegraph_resource_requires" -}}
+{{- define "sourcegraph.prometheus.droppedLabels" -}}
+{{- $names := list "helm_sh_chart" "app_kubernetes_io_(name|instance|version|managed_by)" -}}
+{{- $kept := list "app" "deploy" "group" "type" "worker_replica" "app_kubernetes_io_component" "sourcegraph_resource_requires" -}}
 {{- range $key := keys (.Values.sourcegraph.labels | default dict) | sortAlpha -}}
 {{- $name := regexReplaceAll "[^a-zA-Z0-9_]" $key "_" -}}
 {{- if not (has $name $kept) -}}
@@ -83,6 +82,21 @@ app.kubernetes.io/instance: {{ $top.Release.Name }}
 {{- end }}
 {{- end }}
 
+{{/*
+Labels of a component's pod template: the common labels, then
+sourcegraph.podLabels, then the component's podLabels, then its selector labels.
+The later one wins when a key is set more than once, so each key is rendered
+once and the selector always matches the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.frontend) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" . | fromYaml) | toYaml -}}
+{{- end }}
+
 {{/*
 The selector labels set in values: sourcegraph.selectorLabelsOverride, which
 replaces the default selector labels on every component, merged with the
diff --git a/charts/sourcegraph/templates/_worker.tpl b/charts/sourcegraph/templates/_worker.tpl
index db47f88aa..f64fcd150 100644
--- a/charts/sourcegraph/templates/_worker.tpl
+++ b/charts/sourcegraph/templates/_worker.tpl
@@ -51,18 +51,13 @@ spec:
       {{- toYaml $top.Values.worker.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list $top $top.Values.worker) | nindent 8 }}
-      {{- if $top.Values.sourcegraph.podLabels }}
-      {{- toYaml $top.Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if $top.Values.worker.podLabels }}
-      {{- toYaml $top.Values.worker.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list $top $top.Values.worker) | nindent 8 }}
         deploy: sourcegraph
         app: worker
         {{- if $suffix }}
         worker-replica: {{ $name | quote }}
         {{- end }}
+        app.kubernetes.io/component: worker
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list $top "worker") | nindent 6 }}
       {{- with $top.Values.worker.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
index 20575d846..04dec8e62 100644
--- a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
+++ b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
@@ -33,15 +33,10 @@ spec:
       {{- toYaml .Values.blobstore.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.blobstore) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.blobstore.podLabels }}
-      {{- toYaml .Values.blobstore.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.blobstore) | nindent 8 }}
         deploy: sourcegraph
         app: blobstore
+        app.kubernetes.io/component: blobstore
     spec:
       {{- with .Values.blobstore.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml b/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml
index 86d82f837..47de60178 100644
--- a/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml
+++ b/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml
@@ -32,15 +32,10 @@ spec:
       {{- toYaml .Values.cadvisor.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.cadvisor) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.cadvisor.podLabels }}
-      {{- toYaml .Values.cadvisor.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.cadvisor) | nindent 8 }}
         deploy: sourcegraph
         app: cadvisor
+        app.kubernetes.io/component: cadvisor
     spec:
       {{- include "sourcegraph.renderServiceAccountName" (list . "cadvisor") | trim | nindent 6 }}
       {{- with .Values.cadvisor.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml
index a38dd53cd..02e413a24 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml
@@ -32,16 +32,11 @@ spec:
       {{- toYaml .Values.codeInsightsDB.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.codeInsightsDB) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.codeInsightsDB.podLabels }}
-      {{- toYaml .Values.codeInsightsDB.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.codeInsightsDB) | nindent 8 }}
         deploy: sourcegraph
         app: codeinsights-db
         group: backend
+        app.kubernetes.io/component: codeinsights-db
     spec:
       initContainers:
       {{- with .Values.codeInsightsDB.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml
index 60141fb1f..f305d36fc 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml
@@ -32,16 +32,11 @@ spec:
       {{- toYaml .Values.codeIntelDB.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.codeIntelDB) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.codeIntelDB.podLabels }}
-      {{- toYaml .Values.codeIntelDB.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.codeIntelDB) | nindent 8 }}
         deploy: sourcegraph
         app: codeintel-db
         group: backend
+        app.kubernetes.io/component: codeintel-db
     spec:
       initContainers:
       {{- with .Values.codeIntelDB.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml
index ecfcd1038..cc1dd7810 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml
@@ -37,15 +37,10 @@ spec:
       {{- toYaml .Values.frontend.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.frontend) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.frontend.podLabels }}
-      {{- toYaml .Values.frontend.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.frontend) | nindent 8 }}
         app: sourcegraph-frontend
         deploy: sourcegraph
+        app.kubernetes.io/component: frontend
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "frontend") | nindent 6 }}
       initContainers:
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml
index cec311f55..480c2b666 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml
@@ -31,17 +31,12 @@ spec:
       {{- toYaml .Values.gitserver.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.gitserver) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.gitserver.podLabels }}
-      {{- toYaml .Values.gitserver.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.gitserver) | nindent 8 }}
         app: gitserver
         group: backend
         type: gitserver
         deploy: sourcegraph
+        app.kubernetes.io/component: gitserver
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "gitserver") | nindent 6 }}
       {{- with .Values.gitserver.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
index 968ce16bb..8dddfedbc 100644
--- a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
@@ -35,15 +35,10 @@ spec:
       {{- toYaml .Values.grafana.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.grafana) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.grafana.podLabels }}
-      {{- toYaml .Values.grafana.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.grafana) | nindent 8 }}
         app: grafana
         deploy: sourcegraph
+        app.kubernetes.io/component: grafana
     spec:
       {{- with .Values.grafana.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml
index 1c7742885..ef6a8ddbe 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml
@@ -31,15 +31,10 @@ spec:
         {{- end }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.indexedSearch) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.indexedSearch.podLabels }}
-      {{- toYaml .Values.indexedSearch.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.indexedSearch) | nindent 8 }}
         app: indexed-search
         deploy: sourcegraph
+        app.kubernetes.io/component: indexed-search
     spec:
       {{- with .Values.indexedSearch.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
index 856233e29..8e2eb1646 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
@@ -40,14 +40,8 @@ spec:
       {{- toYaml .Values.jaeger.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.jaeger.selectorLabels" . | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.jaeger.podLabels }}
-      {{- toYaml .Values.jaeger.podLabels | nindent 8 }}
-      {{- end }}
-        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- /* As sourcegraph.podLabels, with the jaeger common and selector labels */}}
+        {{- mergeOverwrite (include "sourcegraph.jaeger.labels" . | fromYaml) (.Values.sourcegraph.podLabels | default dict) (.Values.jaeger.podLabels | default dict) (include "sourcegraph.jaeger.selectorLabels" . | fromYaml) | toYaml | nindent 8 }}
         app: jaeger
         deploy: sourcegraph
         app.kubernetes.io/component: all-in-one
diff --git a/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml b/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml
index df74ab081..6657b6012 100644
--- a/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml
+++ b/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml
@@ -31,15 +31,10 @@ spec:
       {{- toYaml .Values.nodeExporter.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.nodeExporter) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.nodeExporter.podLabels }}
-      {{- toYaml .Values.nodeExporter.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.nodeExporter) | nindent 8 }}
         deploy: sourcegraph
         app: node-exporter
+        app.kubernetes.io/component: node-exporter
     spec:
       {{- if .Values.nodeExporter.serviceAccount.create }}
       {{- include "sourcegraph.renderServiceAccountName" (list . "nodeExporter") | trim | nindent 6 }}
diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml
index 6a2f9446c..e70e42f2c 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml
@@ -29,15 +29,10 @@ spec:
       {{- toYaml .Values.openTelemetry.agent.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.openTelemetry.agent) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.openTelemetry.agent.podLabels }}
-      {{- toYaml .Values.openTelemetry.agent.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.openTelemetry.agent) | nindent 8 }}
         deploy: sourcegraph
         app: otel-agent
+        app.kubernetes.io/component: otel-collector
     spec:
       {{- with .Values.openTelemetry.agent.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
index ef3fa6146..3db8c44ab 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
@@ -31,15 +31,10 @@ spec:
       {{- toYaml .Values.openTelemetry.gateway.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.openTelemetry.gateway) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.openTelemetry.gateway.podLabels }}
-      {{- toYaml .Values.openTelemetry.gateway.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.openTelemetry.gateway) | nindent 8 }}
         deploy: sourcegraph
         app: otel-collector
+        app.kubernetes.io/component: otel-collector
     spec:
       {{- with .Values.openTelemetry.gateway.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml b/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml
index 594ed6a99..7dbf7e1e5 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml
@@ -32,16 +32,11 @@ spec:
       {{- toYaml .Values.pgsql.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.pgsql) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.pgsql.podLabels }}
-      {{- toYaml .Values.pgsql.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.pgsql) | nindent 8 }}
         deploy: sourcegraph
         app: pgsql
         group: backend
+        app.kubernetes.io/component: pgsql
     spec:
       initContainers:
       {{- with .Values.pgsql.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml
index eaedb63a0..14c0d0236 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml
@@ -36,15 +36,10 @@ spec:
       {{- toYaml .Values.preciseCodeIntel.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.preciseCodeIntel) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.preciseCodeIntel.podLabels }}
-      {{- toYaml .Values.preciseCodeIntel.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.preciseCodeIntel) | nindent 8 }}
         deploy: sourcegraph
         app: precise-code-intel-worker
+        app.kubernetes.io/component: precise-code-intel
     spec:
       {{- $storageType := .Values.preciseCodeIntel.storageType | default "emptyDir" }}
       {{- if not (has $storageType (list "emptyDir" "pvc")) }}
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
index 88e7a8821..c7fd6eda7 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
@@ -164,10 +164,10 @@ data:
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service, or
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object, or
       # `sourcegraph.labels`, to every metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
       - action: labeldrop
-        regex: {{ include "sourcegraph.prometheus.droppedServiceLabels" . }}
+        regex: {{ include "sourcegraph.prometheus.droppedLabels" . }}
       - source_labels: [__meta_kubernetes_namespace]
         action: replace
         # Sourcegraph specific customization. We want a more convenient to type label.
@@ -222,10 +222,10 @@ data:
         target_label: instance
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the labels the chart adds to every Service, or
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object, or
       # `sourcegraph.labels`, to every metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
       - action: labeldrop
-        regex: {{ include "sourcegraph.prometheus.droppedServiceLabels" . }}
+        regex: {{ include "sourcegraph.prometheus.droppedLabels" . }}
       - source_labels: [__meta_kubernetes_service_namespace]
         # Sourcegraph specific customization. We want a more convenient to type label.
         # target_label: kubernetes_namespace
@@ -261,6 +261,10 @@ data:
         target_label: __address__
       - action: labelmap
         regex: __meta_kubernetes_pod_label_(.+)
+      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object, or
+      # `sourcegraph.labels`, to every metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
+      - action: labeldrop
+        regex: {{ include "sourcegraph.prometheus.droppedLabels" . }}
       - source_labels: [__meta_kubernetes_pod_name]
         action: replace
         target_label: kubernetes_pod_name
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
index c7a2862ae..35b1e786f 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
@@ -37,15 +37,10 @@ spec:
       {{- toYaml .Values.prometheus.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.prometheus) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.prometheus.podLabels }}
-      {{- toYaml .Values.prometheus.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.prometheus) | nindent 8 }}
         deploy: sourcegraph
         app: prometheus
+        app.kubernetes.io/component: prometheus
     spec:
       {{- with .Values.prometheus.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml b/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml
index b971f5c53..8dc527ea5 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml
@@ -39,15 +39,10 @@ spec:
       {{- toYaml .Values.redisCache.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.redisCache) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.redisCache.podLabels }}
-      {{- toYaml .Values.redisCache.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.redisCache) | nindent 8 }}
         deploy: sourcegraph
         app: redis-cache
+        app.kubernetes.io/component: redis
     spec:
       {{- with .Values.redisCache.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml b/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml
index 28f0ad05f..2e8b6e0a8 100644
--- a/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml
@@ -39,15 +39,10 @@ spec:
       {{- toYaml .Values.redisStore.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.redisStore) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.redisStore.podLabels }}
-      {{- toYaml .Values.redisStore.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.redisStore) | nindent 8 }}
         deploy: sourcegraph
         app: redis-store
+        app.kubernetes.io/component: redis
     spec:
       {{- with .Values.redisStore.extraInitContainers }}
       initContainers:
diff --git a/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml b/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml
index 218c932c8..b16db298b 100644
--- a/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml
@@ -33,15 +33,10 @@ spec:
       {{- toYaml .Values.searcher.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.searcher) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.searcher.podLabels }}
-      {{- toYaml .Values.searcher.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.searcher) | nindent 8 }}
         deploy: sourcegraph
         app: searcher
+        app.kubernetes.io/component: searcher
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "searcher") | nindent 6 }}
       {{- with .Values.searcher.extraInitContainers }}
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml
index 73b6394b6..77ca6476d 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml
@@ -37,15 +37,10 @@ spec:
       {{- toYaml .Values.syntacticCodeIntel.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.syntacticCodeIntel) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.syntacticCodeIntel.podLabels }}
-      {{- toYaml .Values.syntacticCodeIntel.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.syntacticCodeIntel) | nindent 8 }}
         deploy: sourcegraph
         app: syntactic-code-intel-worker
+        app.kubernetes.io/component: syntactic-code-intel
     spec:
       {{- $storageType := .Values.syntacticCodeIntel.storageType | default "emptyDir" }}
       {{- if not (has $storageType (list "emptyDir" "pvc")) }}
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml
index 94fa63718..aa770b6c5 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml
@@ -35,15 +35,10 @@ spec:
       {{- toYaml .Values.syntectServer.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" (list . .Values.syntectServer) | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.syntectServer.podLabels }}
-      {{- toYaml .Values.syntectServer.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.syntectServer) | nindent 8 }}
         deploy: sourcegraph
         app: syntect-server
+        app.kubernetes.io/component: syntect-server
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "syntectServer") | nindent 6 }}
       {{- with .Values.syntectServer.extraInitContainers }}
diff --git a/charts/sourcegraph/tests/allObjectLabels_test.yaml b/charts/sourcegraph/tests/allObjectLabels_test.yaml
index efc05cbf9..0cc7ec2ee 100644
--- a/charts/sourcegraph/tests/allObjectLabels_test.yaml
+++ b/charts/sourcegraph/tests/allObjectLabels_test.yaml
@@ -346,32 +346,30 @@ tests:
       value: otel-collector
     template: otel-collector/otel-collector.ConfigMap.yaml
 ---
-suite: Service labels that Prometheus does not copy to metrics
+suite: Object labels that Prometheus does not copy to metrics
 templates:
 - prometheus/prometheus.ConfigMap.yaml
 tests:
-# The dashboards and alerts were written for metrics without these labels, and
-# `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
-- it: should not copy the labels the chart adds to every Service to metrics
+# No bundled dashboard or alert queries these labels, and `helm.sh/chart` and
+# `app.kubernetes.io/version` change on every upgrade.
+- it: should not copy the labels the chart adds to every object to metrics
   asserts:
   - matchRegex:
       path: data["prometheus.yml"]
-      # Both jobs that map Service labels to metric labels drop the chart's labels afterwards.
-      # `app.kubernetes.io/managed-by` is not dropped: Helm adds it to every object it installs,
-      # so the metrics already had it.
-      pattern: (?s)(regex. __meta_kubernetes_service_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\)\n.*){2}
+      # All three jobs that map Service or pod labels to metric labels drop the chart's labels afterwards.
+      pattern: (?s)(regex. __meta_kubernetes_(service|pod)_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\n.*){3}
 
-- it: should not copy sourcegraph.labels from Services to metrics
+- it: should not copy sourcegraph.labels to metrics
   set:
     sourcegraph.labels:
       team: platform
       example.com/project: sourcegraph
       cost-center: "1234"
-      # Labels the chart sets on Services stay on metrics: `job` is derived from `app`.
+      # Labels the chart sets itself stay on metrics: `job` is derived from `app`.
       app: sourcegraph
       type: internal
   asserts:
   - matchRegex:
       path: data["prometheus.yml"]
       # Prometheus replaces every character of a label key outside [a-zA-Z0-9_] with `_`.
-      pattern: (?s)(regex. __meta_kubernetes_service_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\)\|cost_center\|example_com_project\|team\n.*){2}
+      pattern: (?s)(regex. __meta_kubernetes_(service|pod)_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\|cost_center\|example_com_project\|team\n.*){3}
diff --git a/charts/sourcegraph/tests/selectorLabels_test.yaml b/charts/sourcegraph/tests/selectorLabels_test.yaml
index c2b44f5af..d2b63b96e 100644
--- a/charts/sourcegraph/tests/selectorLabels_test.yaml
+++ b/charts/sourcegraph/tests/selectorLabels_test.yaml
@@ -55,10 +55,57 @@ tests:
   - isSubset:
       path: spec.template.metadata.labels
       content: *override
-  - notExists:
-      path: spec.template.metadata.labels["app.kubernetes.io/name"]
-  - notExists:
-      path: spec.template.metadata.labels["app.kubernetes.io/instance"]
+
+- it: should add sourcegraph.labels and the chart's labels to every pod template, and let the selector labels win
+  templates: *workloads
+  set:
+    sourcegraph.labels:
+      example.com/installation: production
+      example.com/project: sourcegraph
+    sourcegraph.podLabels:
+      example.com/project: pods
+      # A selector label: a different value would stop the selector from matching the pods.
+      app.kubernetes.io/instance: other
+  asserts:
+  - isSubset:
+      path: spec.template.metadata.labels
+      content:
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        deploy: sourcegraph
+        example.com/installation: production
+        example.com/project: pods
+  - exists:
+      path: spec.template.metadata.labels["helm.sh/chart"]
+  - exists:
+      path: spec.template.metadata.labels["app.kubernetes.io/version"]
+  - exists:
+      path: spec.template.metadata.labels["app.kubernetes.io/component"]
+  - exists:
+      path: spec.template.metadata.labels.app
+
+- it: should add sourcegraph.labels and the chart's labels to the jaeger pod template, and let the selector labels win
+  template: jaeger/jaeger.Deployment.yaml
+  set:
+    jaeger.enabled: true
+    sourcegraph.labels:
+      example.com/project: sourcegraph
+    jaeger.podLabels:
+      app.kubernetes.io/name: other
+  asserts:
+  - isSubset:
+      path: spec.template.metadata.labels
+      content:
+        app.kubernetes.io/name: jaeger
+        app.kubernetes.io/instance: sourcegraph
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/component: all-in-one
+        app: jaeger
+        deploy: sourcegraph
+        example.com/project: sourcegraph
+  - exists:
+      path: spec.template.metadata.labels["helm.sh/chart"]
 
 - it: should keep the standard labels on object metadata when the selector labels are replaced
   template: gitserver/gitserver.StatefulSet.yaml

From 700fab26294a83280fd2ffca0c9e71022dd9c173 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:12:15 -0600
Subject: [PATCH 10/16] otel-collector: pass the metrics setting as an argument

The setting that serves the collector's own metrics on all interfaces was
part of the default command, so a command set in
`openTelemetry.gateway.command` did not get it, and Prometheus could not
scrape the collector. It is now always the last container argument, after
`openTelemetry.gateway.args`, so a replacement command gets it too. Last,
so that it is `$0` of a `sh -c` command whose script is the first argument.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1cc03-93a7-7445-8f1f-3dd7123272bf
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md                    |  2 +-
 charts/sourcegraph/README.md                       |  2 +-
 .../otel-collector/otel-collector.Deployment.yaml  | 14 ++++++++------
 charts/sourcegraph/tests/command_test.yaml         |  3 ++-
 .../tests/otelCollectorJaeger_test.yaml            |  9 +++++----
 charts/sourcegraph/values.yaml                     |  9 ++-------
 6 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 08b54717d..9014841a5 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -9,7 +9,7 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
-- Fixed the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, having no data. The `otel-collector` Service was missing the `app` label that every other scraped Service has, so its metrics had no `app` and `job` labels. They now have `app="otel-collector"` and `job="otel-collector"`. The collector also served its own metrics on 127.0.0.1 only, unless `jaeger.enabled` was set, so Prometheus could not scrape them. It now serves them on all interfaces, port 8888: the default command passes the setting as a second `--config` argument, which restarts the `otel-collector` pod once, and the ConfigMap rendered for `openTelemetry.gateway.config.traces.exporters` includes it. The pod does not restart when only that ConfigMap changes, so restart the `otel-collector` Deployment after an upgrade that does not replace its pod. A command set in `openTelemetry.gateway.command` replaces the default one, so it does not get the argument. If it runs `/etc/otel-collector/config.yaml` or the image's `jaeger.yaml`, it needs no change. If it runs the image's `logging.yaml`, add the argument `--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]` after its `--config`. If it runs your own configuration file, set `service.telemetry.metrics.readers` to that list in the file. Until the metrics can be scraped, the alert fires.
+- Fixed the "pods available" panel and alert of the OpenTelemetry Collector dashboard, which query `up{app=~".*otel-collector"}`, having no data. The `otel-collector` Service was missing the `app` label that every other scraped Service has, so its metrics had no `app` and `job` labels. They now have `app="otel-collector"` and `job="otel-collector"`. The collector also served its own metrics on 127.0.0.1 only, unless `jaeger.enabled` was set, so Prometheus could not scrape them. The chart now always passes the container one argument, after `openTelemetry.gateway.args`, that serves them on all interfaces, port 8888. A command set in `openTelemetry.gateway.command` gets the argument too, so a shell wrapper must pass its arguments on to the collector (`"$@"`). The argument replaces `service.telemetry.metrics.readers` of the configuration files the command loads.
 - Every object the chart creates now has the `deploy` and `app.kubernetes.io/component` labels. PodDisruptionBudgets get the component of their workload, PriorityClasses get `priority-class`, the StorageClass gets `storage` and keeps `deploy: sourcegraph-storage`, and the `sg-test-connection` Pod gets `test-connection`. `extraResources` get `deploy: sourcegraph` unless they set their own; set `app.kubernetes.io/component` on them yourself. The `jaeger` ConfigMap, Deployment, and Services gain `app.kubernetes.io/instance` and keep `app.kubernetes.io/name: jaeger`, which their selectors use. Labels on these objects can be changed in place; the `jaeger` pod restarts once, because its `checksum/jaeger-config` annotation covers the ConfigMap's labels.
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index c900b8f80..35f3c31f5 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -373,7 +373,7 @@ In addition to the documented values, all services also support the following va
 | openTelemetry.agent.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `otel-agent` |
 | openTelemetry.agent.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | openTelemetry.enabled | bool | `true` |  |
-| openTelemetry.gateway.command | list | `[]` | Command for the `otel-collector` container, as a list, replacing the chart's `/bin/otelcol-sourcegraph --config=<file>` command, including the `--config` flag the chart selects, e.g. a shell wrapper that exports an exporter API key read from a mounted file. `openTelemetry.gateway.args` is still passed as the arguments. The default command makes the collector serve its own metrics on all interfaces, where Prometheus scrapes them. A command that runs `/etc/otel-collector/config.yaml`, rendered from `config.traces.exporters`, or the image's `jaeger.yaml` does too. A command that runs the image's `logging.yaml` must also pass the second argument of the default command, `--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]`, and your own configuration file must set `service.telemetry.metrics.readers` to that list. Otherwise Prometheus cannot scrape the collector and its "pods available" alert fires. |
+| openTelemetry.gateway.command | list | `[]` | Command for the `otel-collector` container, as a list, replacing the chart's `/bin/otelcol-sourcegraph --config=<file>` command, including the `--config` flag the chart selects, e.g. a shell wrapper that exports an exporter API key read from a mounted file. `openTelemetry.gateway.args` is still passed as the arguments. The chart always passes one argument that makes the collector serve its own metrics on all interfaces, where Prometheus scrapes them, so a shell wrapper must pass its arguments on (`"$@"`). |
 | openTelemetry.gateway.config.traces.exporters | object | `{}` | Define where traces should be exported to. Read how to configure different backends in the [OpenTelemetry documentation](https://opentelemetry.io/docs/collector/configuration/#exporters) |
 | openTelemetry.gateway.config.traces.exportersTlsSecretName | string | `""` | Define the name of a preexisting secret containing TLS certificates for exporters, which will be mounted under "/tls". Read more about TLS configuration of exporters in the [OpenTelemetry Collector documentation](https://github.com/open-telemetry/opentelemetry-collector/blob/main/config/configtls/README.md) |
 | openTelemetry.gateway.config.traces.processors | object | `{}` | Define trace processors. Read how to configure sampling in the [OpenTelemetry documentation](https://docs.sourcegraph.com/admin/observability/opentelemetry#sampling-traces) |
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
index 3db8c44ab..ae0b0157c 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
@@ -51,18 +51,20 @@ spec:
           - "/bin/otelcol-sourcegraph"
           {{- if and (not .Values.openTelemetry.gateway.config.traces.exporters) (not .Values.jaeger.enabled) }}  # default config: enable logging exporter
           - "--config=/etc/otel-collector/configs/logging.yaml"
-          # logging.yaml serves the collector's own metrics on 127.0.0.1 only, where Prometheus cannot scrape them.
-          - {{ printf "--config=yaml:service::telemetry::metrics::readers: %s" (include "sourcegraph.otelCollector.metricsReaders" .) | quote }}
           {{- else if .Values.jaeger.enabled }} # use bundled config to connect to bundled jaeger
           - "--config=/etc/otel-collector/configs/jaeger.yaml"
           {{- else }} # use config defined by customer in values.yaml
           - "--config=/etc/otel-collector/config.yaml"
           {{- end }}
-          {{- end -}}
-        {{- with .Values.openTelemetry.gateway.args }}
+          {{- end }}
         args:
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
+          {{- with .Values.openTelemetry.gateway.args }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          # The image's logging.yaml serves the collector's own metrics on 127.0.0.1 only, where Prometheus cannot
+          # scrape them. An argument, so that a command set in `openTelemetry.gateway.command` gets it too, and the
+          # last one, so that it is `$0` of a `sh -c` command whose script is the first argument.
+          - {{ printf "--config=yaml:service::telemetry::metrics::readers: %s" (include "sourcegraph.otelCollector.metricsReaders" .) | quote }}
         terminationMessagePolicy: FallbackToLogsOnError
         env:
         {{- if .Values.jaeger.enabled }}
diff --git a/charts/sourcegraph/tests/command_test.yaml b/charts/sourcegraph/tests/command_test.yaml
index 2446952a4..7a552971f 100644
--- a/charts/sourcegraph/tests/command_test.yaml
+++ b/charts/sourcegraph/tests/command_test.yaml
@@ -56,7 +56,7 @@ tests:
       path: spec.template.spec.initContainers[0].command
       value: ["sh", "-c", "/migrator up"]
 
-- it: should replace the otel-collector command, and keep args, when gateway.command is set
+- it: should replace the otel-collector command, and keep args before the chart's own argument, when gateway.command is set
   template: otel-collector/otel-collector.Deployment.yaml
   set:
     openTelemetry.gateway.command: ["/bin/sh", "-c"]
@@ -70,3 +70,4 @@ tests:
       path: spec.template.spec.containers[0].args
       value:
       - API_KEY=$(cat /secrets/api-key) /bin/otelcol-sourcegraph --config=/etc/otel-collector/config.yaml
+      - '--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]'
diff --git a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
index fddcbbba2..e1919a6c4 100644
--- a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
+++ b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
@@ -4,13 +4,14 @@ tests:
   - it: should use the logging exporter when Jaeger is disabled and no exporter has been set
     template: otel-collector/otel-collector.Deployment.yaml
     asserts:
-      # The second --config serves the collector's own metrics on all interfaces: logging.yaml
-      # leaves them on 127.0.0.1, where Prometheus cannot scrape them.
       - equal:
           path: spec.template.spec.containers[0].command
+          value: [ "/bin/otelcol-sourcegraph", "--config=/etc/otel-collector/configs/logging.yaml" ]
+      # The argument serves the collector's own metrics on all interfaces: logging.yaml
+      # leaves them on 127.0.0.1, where Prometheus cannot scrape them.
+      - equal:
+          path: spec.template.spec.containers[0].args
           value:
-            - "/bin/otelcol-sourcegraph"
-            - "--config=/etc/otel-collector/configs/logging.yaml"
             - '--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]'
       - isEmpty:
           path: spec.template.spec.containers[0].volumeMounts
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index b9069b147..7f0696dc4 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -756,13 +756,8 @@ openTelemetry:
     # `/bin/otelcol-sourcegraph --config=<file>` command, including the `--config` flag the chart
     # selects, e.g. a shell wrapper that exports an exporter API key read from a mounted file.
     # `openTelemetry.gateway.args` is still passed as the arguments.
-    # The default command makes the collector serve its own metrics on all interfaces, where Prometheus
-    # scrapes them. A command that runs `/etc/otel-collector/config.yaml`, rendered from
-    # `config.traces.exporters`, or the image's `jaeger.yaml` does too. A command that runs the image's
-    # `logging.yaml` must also pass the second argument of the default command,
-    # `--config=yaml:service::telemetry::metrics::readers: [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]`,
-    # and your own configuration file must set `service.telemetry.metrics.readers` to that list.
-    # Otherwise Prometheus cannot scrape the collector and its "pods available" alert fires.
+    # The chart always passes one argument that makes the collector serve its own metrics on all
+    # interfaces, where Prometheus scrapes them, so a shell wrapper must pass its arguments on (`"$@"`).
     command: []
     # -- Resource requests & limits for the `otel-collector` container,
     # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)

From 29ec1f1a9defe4bd65ebcb0d49d347df1afc78d4 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:43:25 -0600
Subject: [PATCH 11/16] otel-collector: restart when its configuration changes

The collector does not reload a changed ConfigMap by itself, so a change to openTelemetry.gateway.config.traces took effect only at the pod's next restart. The pod template now has a checksum/otel-collector-config annotation over those values, which are all the ConfigMap's data is rendered from. It is set only when the chart renders the ConfigMap, so the default install does not change.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1cc03-93a7-7445-8f1f-3dd7123272bf
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md                       |  1 +
 .../otel-collector/otel-collector.Deployment.yaml     |  4 ++++
 .../sourcegraph/tests/otelCollectorJaeger_test.yaml   | 11 +++++++++++
 3 files changed, 16 insertions(+)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 9014841a5..1cd66cf53 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -14,6 +14,7 @@ Use `**BREAKING**:` to denote a breaking change
 - `<serviceName>.labels` is now also rendered on the component's ConfigMaps, Secrets, and PodDisruptionBudget, not only on its workload, so releases that set it gain these labels on upgrade. Added `storageClass.labels` and a `labels` field on each `priorityClasses` entry.
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
 - The `prometheus` pod now restarts when an upgrade changes the chart's `prometheus.yml`, through a `checksum/prometheus-config` pod annotation. Prometheus does not reload a changed ConfigMap by itself, so such a change took effect only at the pod's next restart. The annotation is not set with `prometheus.existingConfig`.
+- The `otel-collector` pod now restarts when `openTelemetry.gateway.config.traces` changes, through a `checksum/otel-collector-config` pod annotation. The collector does not reload a changed ConfigMap by itself, so a changed exporter or processor took effect only at the pod's next restart. The annotation is set only with `openTelemetry.gateway.config.traces.exporters`, which is when the chart renders that ConfigMap, so the default install is not affected.
 - `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts on this upgrade, and from now on whenever the chart version changes, because `helm.sh/chart` and `app.kubernetes.io/version` are pod labels. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` and `jaeger` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so none is recreated. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
index ae0b0157c..779617f32 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
@@ -24,6 +24,10 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: otel-collector
+        {{- if .Values.openTelemetry.gateway.config.traces.exporters }}
+        {{- /* The collector does not reload a changed ConfigMap by itself. Its data is rendered from these values only. */}}
+        checksum/otel-collector-config: {{ toJson .Values.openTelemetry.gateway.config.traces | sha256sum }}
+        {{- end }}
       {{- if .Values.sourcegraph.podAnnotations }}
       {{- toYaml .Values.sourcegraph.podAnnotations | nindent 8 }}
       {{- end }}
diff --git a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
index e1919a6c4..c573f8d0a 100644
--- a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
+++ b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
@@ -17,6 +17,8 @@ tests:
           path: spec.template.spec.containers[0].volumeMounts
       - isEmpty:
           path: spec.template.spec.volumes
+      - notExists: # no ConfigMap, so nothing to restart for
+          path: spec.template.metadata.annotations["checksum/otel-collector-config"]
       - hasDocuments:
           count: 0 # ConfigMap is not rendered
         template: otel-collector/otel-collector.ConfigMap.yaml
@@ -33,6 +35,8 @@ tests:
           path: spec.template.spec.containers[0].volumeMounts
       - isEmpty:
           path: spec.template.spec.volumes
+      - notExists: # no ConfigMap, so nothing to restart for
+          path: spec.template.metadata.annotations["checksum/otel-collector-config"]
       - hasDocuments:
           count: 0 # ConfigMap is not rendered
         template: otel-collector/otel-collector.ConfigMap.yaml
@@ -67,6 +71,13 @@ tests:
               items:
                 - key: config.yaml
                   path: config.yaml
+      # The collector does not reload a changed ConfigMap, so the pod restarts when the values it is rendered from change.
+      - matchRegex:
+          path: spec.template.metadata.annotations["checksum/otel-collector-config"]
+          pattern: ^[0-9a-f]{64}$
+      - notEqual: # the hash of `null`, which is what a missing value would hash to
+          path: spec.template.metadata.annotations["checksum/otel-collector-config"]
+          value: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
       - hasDocuments:
           count: 1 # ConfigMap is rendered
         template: otel-collector/otel-collector.ConfigMap.yaml

From b98034a97caaa0a92821aa2a2e5a2cfa51f5c286 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:12:25 -0600
Subject: [PATCH 12/16] Keep the chart version labels off pod templates

helm.sh/chart and app.kubernetes.io/version change with every chart version. As pod labels they changed every pod template, so every pod restarted whenever the chart version changed, even when nothing else did. On main no pod template depends on the chart version.

Pod templates in all four charts now get the common labels without these two. The other objects keep them.

This also updates the pod label snapshots of the selector labels golden test: every pod gains app.kubernetes.io/managed-by and app.kubernetes.io/component, and no selector, volume claim template, or existing pod label changes.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1cc03-93a7-7445-8f1f-3dd7123272bf
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph-executor/CHANGELOG.md      |  2 +-
 .../dind/templates/_helpers.tpl               |  5 +-
 .../dind/tests/labels_test.yaml               |  8 +-
 .../k8s/templates/_helpers.tpl                |  5 +-
 .../k8s/tests/labels_test.yaml                |  4 +-
 .../templates/_helpers.tpl                    |  5 +-
 .../tests/labels_test.yaml                    |  4 +-
 charts/sourcegraph/CHANGELOG.md               |  2 +-
 charts/sourcegraph/templates/_helpers.tpl     |  5 +-
 .../templates/jaeger/jaeger.Deployment.yaml   |  2 +-
 .../selectorLabelsGolden_test.yaml.snap       | 90 +++++++++++++++++++
 .../tests/selectorLabels_test.yaml            |  6 +-
 12 files changed, 120 insertions(+), 18 deletions(-)

diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md
index f652c1dbf..3aa5f4a35 100644
--- a/charts/sourcegraph-executor/CHANGELOG.md
+++ b/charts/sourcegraph-executor/CHANGELOG.md
@@ -4,7 +4,7 @@
 ## Unreleased
 
 - Every object the charts create now has the `deploy` and `app.kubernetes.io/component` labels: the `sourcegraph-executor-k8s` Secret did not have them. `executor.labels` is now also rendered on the `sourcegraph-executor-k8s` ConfigMap, Secret, ServiceAccount, Role, and RoleBinding, and on the `sourcegraph-executor-dind` `docker-config` ConfigMap, not only on the Deployment. Added `privateDockerRegistry.serviceLabels` to the `sourcegraph-executor-dind` chart to label the `private-docker-registry` Service.
-- `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Pods get them too, and the `private-docker-registry` pod gains `app.kubernetes.io/component`. Existing releases gain these labels on upgrade. No object is recreated. Every pod restarts on this upgrade, and from now on whenever the chart version changes, because `helm.sh/chart` and `app.kubernetes.io/version` are pod labels.
+- `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Pods get them too, except `helm.sh/chart` and `app.kubernetes.io/version`, which change with every chart version and would restart every pod on every upgrade. The `private-docker-registry` pod gains `app.kubernetes.io/component`. Existing releases gain these labels on upgrade. No object is recreated. Every pod restarts once, on this upgrade.
 
 ## 8.0.0
 
diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
index aec7e5345..c63812f0e 100644
--- a/charts/sourcegraph-executor/dind/templates/_helpers.tpl
+++ b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
@@ -41,12 +41,15 @@ the component's podLabels, then the selector labels. The later one wins when a
 key is set more than once, so each key is rendered once and the selector always
 matches the pods.
 
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
 {{ include "sourcegraph.podLabels" (list . .Values.executor) }}
 */}}
 {{- define "sourcegraph.podLabels" -}}
 {{- $top := index . 0 -}}
 {{- $component := index . 1 -}}
-{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
 {{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
 {{- end }}
 
diff --git a/charts/sourcegraph-executor/dind/tests/labels_test.yaml b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
index 88dc1d0e5..9a9dfc7ed 100644
--- a/charts/sourcegraph-executor/dind/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
@@ -67,11 +67,11 @@ tests:
             app.kubernetes.io/managed-by: Helm
             deploy: sourcegraph
             example.com/project: pods
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["helm.sh/chart"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/name"]
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["app.kubernetes.io/version"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/component"]
@@ -97,11 +97,11 @@ tests:
             app.kubernetes.io/managed-by: Helm
             deploy: sourcegraph
             example.com/project: pods
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["helm.sh/chart"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/name"]
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["app.kubernetes.io/version"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
index 168ac8114..bdfd73fea 100644
--- a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
+++ b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
@@ -41,12 +41,15 @@ the component's podLabels, then the selector labels. The later one wins when a
 key is set more than once, so each key is rendered once and the selector always
 matches the pods.
 
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
 {{ include "sourcegraph.podLabels" (list . .Values.executor) }}
 */}}
 {{- define "sourcegraph.podLabels" -}}
 {{- $top := index . 0 -}}
 {{- $component := index . 1 -}}
-{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
 {{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
 {{- end }}
 
diff --git a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
index 33d00deaf..349649e74 100644
--- a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
@@ -63,11 +63,11 @@ tests:
             app.kubernetes.io/managed-by: Helm
             deploy: sourcegraph
             example.com/project: pods
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["helm.sh/chart"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/name"]
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["app.kubernetes.io/version"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph-migrator/templates/_helpers.tpl b/charts/sourcegraph-migrator/templates/_helpers.tpl
index a438403b4..41b006c6c 100644
--- a/charts/sourcegraph-migrator/templates/_helpers.tpl
+++ b/charts/sourcegraph-migrator/templates/_helpers.tpl
@@ -41,12 +41,15 @@ the component's podLabels, then the selector labels. The later one wins when a
 key is set more than once, so each key is rendered once and the selector always
 matches the pods.
 
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
 {{ include "sourcegraph.podLabels" (list . .Values.migrator) }}
 */}}
 {{- define "sourcegraph.podLabels" -}}
 {{- $top := index . 0 -}}
 {{- $component := index . 1 -}}
-{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
 {{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
 {{- end }}
 
diff --git a/charts/sourcegraph-migrator/tests/labels_test.yaml b/charts/sourcegraph-migrator/tests/labels_test.yaml
index dea0a7ed4..47c6571a0 100644
--- a/charts/sourcegraph-migrator/tests/labels_test.yaml
+++ b/charts/sourcegraph-migrator/tests/labels_test.yaml
@@ -45,11 +45,11 @@ tests:
             app.kubernetes.io/managed-by: Helm
             deploy: sourcegraph
             example.com/project: pods
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["helm.sh/chart"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/name"]
-      - exists:
+      - notExists:
           path: spec.template.metadata.labels["app.kubernetes.io/version"]
       - exists:
           path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 1cd66cf53..749a7014f 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -15,7 +15,7 @@ Use `**BREAKING**:` to denote a breaking change
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
 - The `prometheus` pod now restarts when an upgrade changes the chart's `prometheus.yml`, through a `checksum/prometheus-config` pod annotation. Prometheus does not reload a changed ConfigMap by itself, so such a change took effect only at the pod's next restart. The annotation is not set with `prometheus.existingConfig`.
 - The `otel-collector` pod now restarts when `openTelemetry.gateway.config.traces` changes, through a `checksum/otel-collector-config` pod annotation. The collector does not reload a changed ConfigMap by itself, so a changed exporter or processor took effect only at the pod's next restart. The annotation is set only with `openTelemetry.gateway.config.traces.exporters`, which is when the chart renders that ConfigMap, so the default install is not affected.
-- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts on this upgrade, and from now on whenever the chart version changes, because `helm.sh/chart` and `app.kubernetes.io/version` are pod labels. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` and `jaeger` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
+- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods do not get `helm.sh/chart` and `app.kubernetes.io/version`, which change with every chart version and would restart every pod on every upgrade, and they also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts once, on this upgrade. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` and `jaeger` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so none is recreated. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index ae8760c13..63fb2fd4e 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -88,12 +88,15 @@ sourcegraph.podLabels, then the component's podLabels, then its selector labels.
 The later one wins when a key is set more than once, so each key is rendered
 once and the selector always matches the pods.
 
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
 {{ include "sourcegraph.podLabels" (list . .Values.frontend) }}
 */}}
 {{- define "sourcegraph.podLabels" -}}
 {{- $top := index . 0 -}}
 {{- $component := index . 1 -}}
-{{- $labels := include "sourcegraph.labels" $top | fromYaml -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
 {{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" . | fromYaml) | toYaml -}}
 {{- end }}
 
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
index 8e2eb1646..1842f3e1d 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
@@ -41,7 +41,7 @@ spec:
       {{- end }}
       labels:
         {{- /* As sourcegraph.podLabels, with the jaeger common and selector labels */}}
-        {{- mergeOverwrite (include "sourcegraph.jaeger.labels" . | fromYaml) (.Values.sourcegraph.podLabels | default dict) (.Values.jaeger.podLabels | default dict) (include "sourcegraph.jaeger.selectorLabels" . | fromYaml) | toYaml | nindent 8 }}
+        {{- mergeOverwrite (omit (include "sourcegraph.jaeger.labels" . | fromYaml) "helm.sh/chart" "app.kubernetes.io/version") (.Values.sourcegraph.podLabels | default dict) (.Values.jaeger.podLabels | default dict) (include "sourcegraph.jaeger.selectorLabels" . | fromYaml) | toYaml | nindent 8 }}
         app: jaeger
         deploy: sourcegraph
         app.kubernetes.io/component: all-in-one
diff --git a/charts/sourcegraph/tests/__snapshot__/selectorLabelsGolden_test.yaml.snap b/charts/sourcegraph/tests/__snapshot__/selectorLabelsGolden_test.yaml.snap
index afd58d44f..ca7911c3c 100644
--- a/charts/sourcegraph/tests/__snapshot__/selectorLabelsGolden_test.yaml.snap
+++ b/charts/sourcegraph/tests/__snapshot__/selectorLabelsGolden_test.yaml.snap
@@ -163,40 +163,52 @@ should keep every Service selector:
 should keep every pod's labels when podLabels are set:
   1: |
     app: blobstore
+    app.kubernetes.io/component: blobstore
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   2: |
     app: cadvisor
+    app.kubernetes.io/component: cadvisor
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   3: |
     app: codeinsights-db
+    app.kubernetes.io/component: codeinsights-db
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
     group: backend
   4: |
     app: codeintel-db
+    app.kubernetes.io/component: codeintel-db
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
     group: backend
   5: |
     app: sourcegraph-frontend
+    app.kubernetes.io/component: frontend
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
     example.com/tier: web
   6: |
     app: gitserver
+    app.kubernetes.io/component: gitserver
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
@@ -204,13 +216,17 @@ should keep every pod's labels when podLabels are set:
     type: gitserver
   7: |
     app: grafana
+    app.kubernetes.io/component: grafana
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   8: |
     app: indexed-search
+    app.kubernetes.io/component: indexed-search
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
@@ -218,86 +234,113 @@ should keep every pod's labels when podLabels are set:
     app: jaeger
     app.kubernetes.io/component: all-in-one
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jaeger
     deploy: sourcegraph
     example.com/team: search
   10: |
     app: node-exporter
+    app.kubernetes.io/component: node-exporter
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   11: |
     app: otel-agent
+    app.kubernetes.io/component: otel-collector
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   12: |
     app: otel-collector
+    app.kubernetes.io/component: otel-collector
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   13: |
     app: pgsql
+    app.kubernetes.io/component: pgsql
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
     group: backend
   14: |
     app: precise-code-intel-worker
+    app.kubernetes.io/component: precise-code-intel
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   15: |
     app: prometheus
+    app.kubernetes.io/component: prometheus
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   16: |
     app: redis-cache
+    app.kubernetes.io/component: redis
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   17: |
     app: redis-store
+    app.kubernetes.io/component: redis
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   18: |
     app: searcher
+    app.kubernetes.io/component: searcher
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   19: |
     app: syntactic-code-intel-worker
+    app.kubernetes.io/component: syntactic-code-intel
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   20: |
     app: syntect-server
+    app.kubernetes.io/component: syntect-server
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
   21: |
     app: worker
+    app.kubernetes.io/component: worker
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
     example.com/tier: background
   22: |
     app: worker
+    app.kubernetes.io/component: worker
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
@@ -305,7 +348,9 @@ should keep every pod's labels when podLabels are set:
     worker-replica: worker-0
   23: |
     app: worker
+    app.kubernetes.io/component: worker
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     example.com/team: search
@@ -472,124 +517,169 @@ should keep every workload selector and pod labels:
       worker-replica: worker-1
   24: |
     app: blobstore
+    app.kubernetes.io/component: blobstore
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   25: |
     app: cadvisor
+    app.kubernetes.io/component: cadvisor
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   26: |
     app: codeinsights-db
+    app.kubernetes.io/component: codeinsights-db
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     group: backend
   27: |
     app: codeintel-db
+    app.kubernetes.io/component: codeintel-db
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     group: backend
   28: |
     app: sourcegraph-frontend
+    app.kubernetes.io/component: frontend
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   29: |
     app: gitserver
+    app.kubernetes.io/component: gitserver
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     group: backend
     type: gitserver
   30: |
     app: grafana
+    app.kubernetes.io/component: grafana
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   31: |
     app: indexed-search
+    app.kubernetes.io/component: indexed-search
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   32: |
     app: jaeger
     app.kubernetes.io/component: all-in-one
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jaeger
     deploy: sourcegraph
   33: |
     app: node-exporter
+    app.kubernetes.io/component: node-exporter
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   34: |
     app: otel-agent
+    app.kubernetes.io/component: otel-collector
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   35: |
     app: otel-collector
+    app.kubernetes.io/component: otel-collector
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   36: |
     app: pgsql
+    app.kubernetes.io/component: pgsql
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     group: backend
   37: |
     app: precise-code-intel-worker
+    app.kubernetes.io/component: precise-code-intel
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   38: |
     app: prometheus
+    app.kubernetes.io/component: prometheus
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   39: |
     app: redis-cache
+    app.kubernetes.io/component: redis
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   40: |
     app: redis-store
+    app.kubernetes.io/component: redis
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   41: |
     app: searcher
+    app.kubernetes.io/component: searcher
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   42: |
     app: syntactic-code-intel-worker
+    app.kubernetes.io/component: syntactic-code-intel
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   43: |
     app: syntect-server
+    app.kubernetes.io/component: syntect-server
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   44: |
     app: worker
+    app.kubernetes.io/component: worker
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
   45: |
     app: worker
+    app.kubernetes.io/component: worker
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     worker-replica: worker-0
   46: |
     app: worker
+    app.kubernetes.io/component: worker
     app.kubernetes.io/instance: sourcegraph
+    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sourcegraph
     deploy: sourcegraph
     worker-replica: worker-1
diff --git a/charts/sourcegraph/tests/selectorLabels_test.yaml b/charts/sourcegraph/tests/selectorLabels_test.yaml
index d2b63b96e..77a094eb1 100644
--- a/charts/sourcegraph/tests/selectorLabels_test.yaml
+++ b/charts/sourcegraph/tests/selectorLabels_test.yaml
@@ -76,9 +76,9 @@ tests:
         deploy: sourcegraph
         example.com/installation: production
         example.com/project: pods
-  - exists:
+  - notExists:
       path: spec.template.metadata.labels["helm.sh/chart"]
-  - exists:
+  - notExists:
       path: spec.template.metadata.labels["app.kubernetes.io/version"]
   - exists:
       path: spec.template.metadata.labels["app.kubernetes.io/component"]
@@ -104,7 +104,7 @@ tests:
         app: jaeger
         deploy: sourcegraph
         example.com/project: sourcegraph
-  - exists:
+  - notExists:
       path: spec.template.metadata.labels["helm.sh/chart"]
 
 - it: should keep the standard labels on object metadata when the selector labels are replaced

From 787ef60227e5eb8813001f3697a28fc6179c0d89 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:42:20 -0600
Subject: [PATCH 13/16] jaeger: serve its metrics where Prometheus scrapes them

The jaeger pod's prometheus.io/port annotation named port 16686, the
query UI, which has no /metrics, so the scrape target was down. Jaeger
v2 serves its own metrics on localhost:8888 unless its configuration
says otherwise.

The chart's Jaeger configuration now serves them on all interfaces,
port 8888, as Jaeger's own all-in-one configuration does, and the
annotation names that port.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1cc03-93a7-7445-8f1f-3dd7123272bf
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md               |  3 ++-
 charts/sourcegraph/README.md                  |  2 +-
 .../templates/jaeger/jaeger.ConfigMap.yaml    |  8 +++++++
 .../templates/jaeger/jaeger.Deployment.yaml   |  5 +++-
 .../tests/otelCollectorJaeger_test.yaml       | 24 +++++++++++++++++++
 charts/sourcegraph/values.yaml                |  2 +-
 6 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 749a7014f..9fbca06f6 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -15,8 +15,9 @@ Use `**BREAKING**:` to denote a breaking change
 - Fixed `redisStore.serviceAccount.annotations` being ignored, so the `redis-store` ServiceAccount was created without them, e.g. without a workload identity annotation. They are now rendered, as on every other ServiceAccount.
 - The `prometheus` pod now restarts when an upgrade changes the chart's `prometheus.yml`, through a `checksum/prometheus-config` pod annotation. Prometheus does not reload a changed ConfigMap by itself, so such a change took effect only at the pod's next restart. The annotation is not set with `prometheus.existingConfig`.
 - The `otel-collector` pod now restarts when `openTelemetry.gateway.config.traces` changes, through a `checksum/otel-collector-config` pod annotation. The collector does not reload a changed ConfigMap by itself, so a changed exporter or processor took effect only at the pod's next restart. The annotation is set only with `openTelemetry.gateway.config.traces.exporters`, which is when the chart renders that ConfigMap, so the default install is not affected.
-- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods do not get `helm.sh/chart` and `app.kubernetes.io/version`, which change with every chart version and would restart every pod on every upgrade, and they also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts once, on this upgrade. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` and `jaeger` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
+- `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods do not get `helm.sh/chart` and `app.kubernetes.io/version`, which change with every chart version and would restart every pod on every upgrade, and they also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts once, on this upgrade. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so none is recreated. See [Adopting existing workloads](README.md#adopting-existing-workloads).
+- Fixed Prometheus failing to scrape the bundled `jaeger`. The pod's `prometheus.io/port` annotation named port 16686, which does not serve `/metrics`, and Jaeger served its own metrics on localhost only. The chart's Jaeger configuration now serves them on all interfaces, port 8888, and the annotation names that port. The metrics have `app="jaeger"` and Prometheus names with unit and type suffixes, such as `otelcol_receiver_accepted_spans_total`. If you set `jaeger.config.existingConfigMap`, add the `service.telemetry.metrics.readers` setting of the chart's ConfigMap to your configuration.
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed `frontend.command` and `migrator.command` rendering a list as a single element, e.g. `["sh", "-c", "<script>"]` became `[sh -c <script>]`, so the container failed to start. Both are now rendered as YAML lists and documented in `values.yaml`. A string holding a YAML list, the only form that worked before, still renders unchanged.
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 35f3c31f5..040d3035a 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -324,7 +324,7 @@ In addition to the documented values, all services also support the following va
 | jaeger.collector.serviceLabels | object | `{}` | Add extra labels to jaeger `collector` service |
 | jaeger.collector.serviceType | string | "ClusterIP" | Kubernetes service type of jaeger `collector` service, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) |
 | jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000,"samplingDefaultProbability":1}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. |
-| jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. See https://www.jaegertracing.io/docs/2.16/configuration/ |
+| jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. Prometheus scrapes the `jaeger` pod on port 8888, so serve the metrics of Jaeger there on all interfaces, as the `service.telemetry.metrics.readers` setting of the chart's ConfigMap does. See https://www.jaegertracing.io/docs/2.16/configuration/ |
 | jaeger.config.logLevel | string | `"info"` | Log level for the Jaeger instance (debug, info, warn, error) |
 | jaeger.config.maxTraces | int | `20000` | Maximum number of traces stored in memory |
 | jaeger.config.samplingDefaultProbability | float | `1` | Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config |
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
index 168d482d8..2032dee73 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
@@ -21,6 +21,14 @@ data:
           processors: [batch]
           exporters: [jaeger_storage_exporter]
       telemetry:
+        # Serve the metrics of jaeger itself to Prometheus. Without this they are served on localhost only.
+        metrics:
+          readers:
+            - pull:
+                exporter:
+                  prometheus:
+                    host: "0.0.0.0"
+                    port: 8888
         logs:
           level: {{ .Values.jaeger.config.logLevel | default "info" }}
     extensions:
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
index 1842f3e1d..d61ea6b40 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
@@ -28,7 +28,7 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: jaeger
-        prometheus.io/port: "16686"
+        prometheus.io/port: "8888"
         sourcegraph.prometheus/scrape: "true"
         {{- if not .Values.jaeger.config.existingConfigMap }}
         checksum/jaeger-config: {{ include (print $.Template.BasePath "/jaeger/jaeger.ConfigMap.yaml") . | sha256sum }}
@@ -75,6 +75,9 @@ spec:
         - containerPort: 13133
           name: health
           protocol: TCP
+        - containerPort: 8888
+          name: metrics
+          protocol: TCP
         readinessProbe:
           httpGet:
             path: "/status"
diff --git a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
index c573f8d0a..ea1f045cf 100644
--- a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
+++ b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
@@ -118,3 +118,27 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "When 'jaeger.enabled' is set to true, 'openTelemetry.enabled' must be set to true as well."
+  - it: should have Prometheus scrape jaeger on the port where it serves its metrics
+    templates:
+      - jaeger/jaeger.Deployment.yaml
+      - jaeger/jaeger.ConfigMap.yaml
+    set:
+      jaeger:
+        enabled: true
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["prometheus.io/port"]
+          value: "8888"
+        template: jaeger/jaeger.Deployment.yaml
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            containerPort: 8888
+            name: metrics
+            protocol: TCP
+        template: jaeger/jaeger.Deployment.yaml
+      # On all interfaces: jaeger serves its metrics on localhost only by default.
+      - matchRegex:
+          path: data["jaeger-config.yaml"]
+          pattern: 'prometheus:\n\s+host: "0\.0\.0\.0"\n\s+port: 8888\n'
+        template: jaeger/jaeger.ConfigMap.yaml
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index 7f0696dc4..aab42a637 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -1489,7 +1489,7 @@ jaeger:
     ]
   # -- Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control.
   config:
-    # -- Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below.
+    # -- Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. Prometheus scrapes the `jaeger` pod on port 8888, so serve the metrics of Jaeger there on all interfaces, as the `service.telemetry.metrics.readers` setting of the chart's ConfigMap does.
     # See https://www.jaegertracing.io/docs/2.16/configuration/
     existingConfigMap: ""
     # -- Maximum number of traces stored in memory

From 772641b69da347167579153033ca5cd67d105f16 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Thu, 12 Nov 2026 23:18:23 -0600
Subject: [PATCH 14/16] Remove the k8s executor Service and kubernetes-services
 job, as #1016 does

sourcegraph/deploy-sourcegraph-helm#1016 deletes the executor-<queueName>
Service, which fronts a port the executor has not served since 4.1, and
the kubernetes-services scrape job, which probes through a blackbox
exporter the chart does not ship. Making the same deletions here keeps
this PR and #1016 from conflicting in those files.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d
Co-authored-by: Amp <amp@ampcode.com>
---
 .../k8s/templates/executor.Service.yaml       | 23 -----------
 .../k8s/tests/executor_test.yaml              |  8 +---
 .../k8s/tests/labels_test.yaml                |  4 +-
 .../prometheus-override-k3s.ConfigMap.yaml    | 29 --------------
 .../prometheus/prometheus.ConfigMap.yaml      | 38 -------------------
 .../tests/allObjectLabels_test.yaml           |  6 +--
 6 files changed, 5 insertions(+), 103 deletions(-)
 delete mode 100644 charts/sourcegraph-executor/k8s/templates/executor.Service.yaml

diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml
deleted file mode 100644
index ed865c0cb..000000000
--- a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{- if .Values.executor.serviceAnnotations }}
-    {{- toYaml .Values.executor.serviceAnnotations | nindent 4 }}
-    {{- end }}
-  labels:
-    {{- include "sourcegraph.labels" . | nindent 4 }}
-{{ include "executor.labels" . | indent 4 }}
-    {{- if .Values.executor.serviceLabels }}
-    {{- toYaml .Values.executor.serviceLabels | nindent 4 }}
-    {{- end }}
-  name: {{ include "executor.name" . }}
-spec:
-  ports:
-  - name: http-debug
-    port: 6060
-    targetPort: http-debug
-  selector:
-    {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
-    app: {{ include "executor.name" . }}
-  type: {{ .Values.executor.serviceType | default "ClusterIP" }}
diff --git a/charts/sourcegraph-executor/k8s/tests/executor_test.yaml b/charts/sourcegraph-executor/k8s/tests/executor_test.yaml
index 256638deb..dea6138f9 100644
--- a/charts/sourcegraph-executor/k8s/tests/executor_test.yaml
+++ b/charts/sourcegraph-executor/k8s/tests/executor_test.yaml
@@ -1,10 +1,9 @@
 suite: executor
 templates:
   - executor.Deployment.yaml
-  - executor.Service.yaml
   - executor.ConfigMap.yaml
 tests:
-  - it: should render the Deployment, Service, ConfigMap if executor is enabled
+  - it: should render the Deployment, ConfigMap if executor is enabled
     set:
       executor:
         queueName: "test"
@@ -14,11 +13,6 @@ tests:
           apiVersion: apps/v1
           name: executor-test
         template: executor.Deployment.yaml
-      - containsDocument:
-          kind: Service
-          apiVersion: v1
-          name: executor-test
-        template: executor.Service.yaml
       - containsDocument:
           kind: ConfigMap
           apiVersion: v1
diff --git a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
index 349649e74..1874a0cd1 100644
--- a/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
+++ b/charts/sourcegraph-executor/k8s/tests/labels_test.yaml
@@ -30,15 +30,13 @@ tests:
           path: metadata.labels["app.kubernetes.io/version"]
       - exists:
           path: metadata.labels["app.kubernetes.io/component"]
-  - it: should add executor.labels to every object, and serviceLabels to the Service
+  - it: should add executor.labels to every object
     set:
       executor:
         queueName: batches
         configureRbac: true
         labels:
           example.com/service: executor
-        serviceLabels:
-          example.com/service: executor
     asserts:
       - equal:
           path: metadata.labels["example.com/service"]
diff --git a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
index fb0bab8a3..113a34d49 100644
--- a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
+++ b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml
@@ -119,35 +119,6 @@ data:
         action: replace
         target_label: instance
 
-    - job_name: 'kubernetes-services'
-      metrics_path: /probe
-      params:
-        module: [http_2xx]
-      kubernetes_sd_configs:
-      - role: service
-      relabel_configs:
-      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
-        action: keep
-        regex: true
-      - source_labels: [__address__]
-        target_label: __param_target
-      - target_label: __address__
-        replacement: blackbox
-      - source_labels: [__param_target]
-        target_label: instance
-      - action: labelmap
-        regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object to every
-      # metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade. If you set
-      # `sourcegraph.labels`, append its keys, with `_` for every character that is not a letter, digit, or `_`,
-      # e.g. `|example_com_project` for `example.com/project`.
-      - action: labeldrop
-        regex: helm_sh_chart|app_kubernetes_io_(name|instance|version|managed_by)
-      - source_labels: [__meta_kubernetes_service_namespace]
-        target_label: ns
-      - source_labels: [__meta_kubernetes_service_name]
-        target_label: kubernetes_name
-
     - job_name: 'kubernetes-pods'
       kubernetes_sd_configs:
       - role: pod
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
index c7fd6eda7..c246c07ff 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml
@@ -195,44 +195,6 @@ data:
         regex: ^$
         action: drop
 
-    # Example scrape config for probing services via the Blackbox Exporter.
-    #
-    # The relabeling allows the actual service scrape endpoint to be configured
-    # via the following annotations:
-    #
-    # * `prometheus.io/probe`: Only probe services that have a value of `true`
-    - job_name: 'kubernetes-services'
-
-      metrics_path: /probe
-      params:
-        module: [http_2xx]
-
-      kubernetes_sd_configs:
-      - role: service
-
-      relabel_configs:
-      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
-        action: keep
-        regex: true
-      - source_labels: [__address__]
-        target_label: __param_target
-      - target_label: __address__
-        replacement: blackbox
-      - source_labels: [__param_target]
-        target_label: instance
-      - action: labelmap
-        regex: __meta_kubernetes_service_label_(.+)
-      # Sourcegraph specific customization. Do not copy the labels the chart adds to every object, or
-      # `sourcegraph.labels`, to every metric: `helm.sh/chart` and `app.kubernetes.io/version` change on every upgrade.
-      - action: labeldrop
-        regex: {{ include "sourcegraph.prometheus.droppedLabels" . }}
-      - source_labels: [__meta_kubernetes_service_namespace]
-        # Sourcegraph specific customization. We want a more convenient to type label.
-        # target_label: kubernetes_namespace
-        target_label: ns
-      - source_labels: [__meta_kubernetes_service_name]
-        target_label: kubernetes_name
-
     # Example scrape config for pods
     #
     # The relabeling allows the actual pod scrape endpoint to be configured via the
diff --git a/charts/sourcegraph/tests/allObjectLabels_test.yaml b/charts/sourcegraph/tests/allObjectLabels_test.yaml
index 0cc7ec2ee..be4ae06a2 100644
--- a/charts/sourcegraph/tests/allObjectLabels_test.yaml
+++ b/charts/sourcegraph/tests/allObjectLabels_test.yaml
@@ -356,8 +356,8 @@ tests:
   asserts:
   - matchRegex:
       path: data["prometheus.yml"]
-      # All three jobs that map Service or pod labels to metric labels drop the chart's labels afterwards.
-      pattern: (?s)(regex. __meta_kubernetes_(service|pod)_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\n.*){3}
+      # Both jobs that map Service or pod labels to metric labels drop the chart's labels afterwards.
+      pattern: (?s)(regex. __meta_kubernetes_(service|pod)_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\n.*){2}
 
 - it: should not copy sourcegraph.labels to metrics
   set:
@@ -372,4 +372,4 @@ tests:
   - matchRegex:
       path: data["prometheus.yml"]
       # Prometheus replaces every character of a label key outside [a-zA-Z0-9_] with `_`.
-      pattern: (?s)(regex. __meta_kubernetes_(service|pod)_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\|cost_center\|example_com_project\|team\n.*){3}
+      pattern: (?s)(regex. __meta_kubernetes_(service|pod)_label_\(\.\+\)\n(\s*#[^\n]*\n)*\s*- action. labeldrop\n\s*regex. helm_sh_chart\|app_kubernetes_io_\(name\|instance\|version\|managed_by\)\|cost_center\|example_com_project\|team\n.*){2}

From 756d760580aefb16e771d098715056070036bbf2 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Thu, 12 Nov 2026 23:27:51 -0600
Subject: [PATCH 15/16] jaeger: drop the metrics port and scrape annotations,
 as #1016 does

This replaces 4dc65cf, which served Jaeger's metrics on 0.0.0.0:8888 and
pointed the pod's prometheus.io/port annotation there.
sourcegraph/deploy-sourcegraph-helm#1016 removes the scrape annotations
instead: they pointed at port 16686, which has no /metrics, and Jaeger's
own otelcol_* metrics would otherwise mix into the OpenTelemetry Collector
dashboards. Making the same change here keeps this PR and #1016 from
conflicting in the Jaeger Deployment and the README.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d
Co-authored-by: Amp <amp@ampcode.com>
---
 charts/sourcegraph/CHANGELOG.md               |  1 -
 charts/sourcegraph/README.md                  |  2 +-
 .../templates/jaeger/jaeger.ConfigMap.yaml    |  8 -------
 .../templates/jaeger/jaeger.Deployment.yaml   |  5 ----
 .../tests/otelCollectorJaeger_test.yaml       | 24 -------------------
 charts/sourcegraph/values.yaml                |  2 +-
 6 files changed, 2 insertions(+), 40 deletions(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 9fbca06f6..f2daf8eb6 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -17,7 +17,6 @@ Use `**BREAKING**:` to denote a breaking change
 - The `otel-collector` pod now restarts when `openTelemetry.gateway.config.traces` changes, through a `checksum/otel-collector-config` pod annotation. The collector does not reload a changed ConfigMap by itself, so a changed exporter or processor took effect only at the pod's next restart. The annotation is set only with `openTelemetry.gateway.config.traces.exporters`, which is when the chart renders that ConfigMap, so the default install is not affected.
 - `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the chart creates: also on pods, Services, ConfigMaps, Secrets, the Ingress, PodDisruptionBudgets, PriorityClasses, and `extraResources`, so existing releases gain these labels on upgrade. Pods do not get `helm.sh/chart` and `app.kubernetes.io/version`, which change with every chart version and would restart every pod on every upgrade, and they also gain `app.kubernetes.io/component`. Labels that an `extraResources` entry, `serviceLabels`, or `podLabels` set take precedence, except that `podLabels` cannot change a selector label. No object is recreated. Every pod restarts once, on this upgrade. Prometheus copies the labels of a Service or pod to the metrics it scrapes from it, so the bundled Prometheus configuration now drops the five standard labels and the keys of `sourcegraph.labels`. No bundled dashboard or alert queries them. Metrics lose `app_kubernetes_io_managed_by`, which Helm added to every Service, `otel-collector` metrics lose the other standard labels, which its Service already had, and `cadvisor` metrics, scraped from pods, lose `app_kubernetes_io_name` and `app_kubernetes_io_instance` and gain `app_kubernetes_io_component`. To add a label to the metrics of a Service, set it in `<serviceName>.serviceLabels`, with a key that is not in `sourcegraph.labels`. If you set `prometheus.existingConfig`, add the same `labeldrop` rule after each `__meta_kubernetes_service_label_(.+)` and `__meta_kubernetes_pod_label_(.+)` `labelmap` rule in your `prometheus.yml`, as in the [k3s example](examples/prometheus/prometheus-override-k3s.ConfigMap.yaml), and append the keys of `sourcegraph.labels` to its regex.
 - Added `storageLabels` on `blobstore`, `codeInsightsDB`, `codeIntelDB`, `pgsql`, `prometheus`, `redisCache`, and `redisStore` to label each component's PersistentVolumeClaim, and `<serviceName>.serviceAccount.labels` to label a component's ServiceAccount and, for `frontend` and `prometheus`, its Role, RoleBinding, ClusterRole, and ClusterRoleBinding. `sourcegraph.labels` and the chart's standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now also rendered on these PersistentVolumeClaims, on every ServiceAccount, and on the `prometheus` RBAC objects, as they already are on every workload and on the `frontend` Role and RoleBinding, so existing releases gain these labels on upgrade. Labels on these objects can be changed in place, so none is recreated. See [Adopting existing workloads](README.md#adopting-existing-workloads).
-- Fixed Prometheus failing to scrape the bundled `jaeger`. The pod's `prometheus.io/port` annotation named port 16686, which does not serve `/metrics`, and Jaeger served its own metrics on localhost only. The chart's Jaeger configuration now serves them on all interfaces, port 8888, and the annotation names that port. The metrics have `app="jaeger"` and Prometheus names with unit and type suffixes, such as `otelcol_receiver_accepted_spans_total`. If you set `jaeger.config.existingConfigMap`, add the `service.telemetry.metrics.readers` setting of the chart's ConfigMap to your configuration.
 - Fixed the `jaeger` ServiceAccount failing to render with `jaeger.serviceAccount.create: true`. Its name and annotations were read from a `tracing` value that does not exist, and are now read from `jaeger.serviceAccount`, as the `jaeger` Deployment's `serviceAccountName` already was.
 - Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed `frontend.command` and `migrator.command` rendering a list as a single element, e.g. `["sh", "-c", "<script>"]` became `[sh -c <script>]`, so the container failed to start. Both are now rendered as YAML lists and documented in `values.yaml`. A string holding a YAML list, the only form that worked before, still renders unchanged.
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 040d3035a..35f3c31f5 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -324,7 +324,7 @@ In addition to the documented values, all services also support the following va
 | jaeger.collector.serviceLabels | object | `{}` | Add extra labels to jaeger `collector` service |
 | jaeger.collector.serviceType | string | "ClusterIP" | Kubernetes service type of jaeger `collector` service, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) |
 | jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000,"samplingDefaultProbability":1}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. |
-| jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. Prometheus scrapes the `jaeger` pod on port 8888, so serve the metrics of Jaeger there on all interfaces, as the `service.telemetry.metrics.readers` setting of the chart's ConfigMap does. See https://www.jaegertracing.io/docs/2.16/configuration/ |
+| jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. See https://www.jaegertracing.io/docs/2.16/configuration/ |
 | jaeger.config.logLevel | string | `"info"` | Log level for the Jaeger instance (debug, info, warn, error) |
 | jaeger.config.maxTraces | int | `20000` | Maximum number of traces stored in memory |
 | jaeger.config.samplingDefaultProbability | float | `1` | Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config |
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
index 2032dee73..168d482d8 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml
@@ -21,14 +21,6 @@ data:
           processors: [batch]
           exporters: [jaeger_storage_exporter]
       telemetry:
-        # Serve the metrics of jaeger itself to Prometheus. Without this they are served on localhost only.
-        metrics:
-          readers:
-            - pull:
-                exporter:
-                  prometheus:
-                    host: "0.0.0.0"
-                    port: 8888
         logs:
           level: {{ .Values.jaeger.config.logLevel | default "info" }}
     extensions:
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
index d61ea6b40..f0e62287b 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
@@ -28,8 +28,6 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: jaeger
-        prometheus.io/port: "8888"
-        sourcegraph.prometheus/scrape: "true"
         {{- if not .Values.jaeger.config.existingConfigMap }}
         checksum/jaeger-config: {{ include (print $.Template.BasePath "/jaeger/jaeger.ConfigMap.yaml") . | sha256sum }}
         {{- end }}
@@ -75,9 +73,6 @@ spec:
         - containerPort: 13133
           name: health
           protocol: TCP
-        - containerPort: 8888
-          name: metrics
-          protocol: TCP
         readinessProbe:
           httpGet:
             path: "/status"
diff --git a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
index ea1f045cf..c573f8d0a 100644
--- a/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
+++ b/charts/sourcegraph/tests/otelCollectorJaeger_test.yaml
@@ -118,27 +118,3 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "When 'jaeger.enabled' is set to true, 'openTelemetry.enabled' must be set to true as well."
-  - it: should have Prometheus scrape jaeger on the port where it serves its metrics
-    templates:
-      - jaeger/jaeger.Deployment.yaml
-      - jaeger/jaeger.ConfigMap.yaml
-    set:
-      jaeger:
-        enabled: true
-    asserts:
-      - equal:
-          path: spec.template.metadata.annotations["prometheus.io/port"]
-          value: "8888"
-        template: jaeger/jaeger.Deployment.yaml
-      - contains:
-          path: spec.template.spec.containers[0].ports
-          content:
-            containerPort: 8888
-            name: metrics
-            protocol: TCP
-        template: jaeger/jaeger.Deployment.yaml
-      # On all interfaces: jaeger serves its metrics on localhost only by default.
-      - matchRegex:
-          path: data["jaeger-config.yaml"]
-          pattern: 'prometheus:\n\s+host: "0\.0\.0\.0"\n\s+port: 8888\n'
-        template: jaeger/jaeger.ConfigMap.yaml
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index aab42a637..7f0696dc4 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -1489,7 +1489,7 @@ jaeger:
     ]
   # -- Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control.
   config:
-    # -- Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. Prometheus scrapes the `jaeger` pod on port 8888, so serve the metrics of Jaeger there on all interfaces, as the `service.telemetry.metrics.readers` setting of the chart's ConfigMap does.
+    # -- Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below.
     # See https://www.jaegertracing.io/docs/2.16/configuration/
     existingConfigMap: ""
     # -- Maximum number of traces stored in memory

From 05bb302eb568ce2fbb9d35e97190b5675844b169 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 13 Nov 2026 00:51:41 -0600
Subject: [PATCH 16/16] Move the label helpers to _helpers/_labels.tpl in all
 four charts

Each chart's label defines, with their comments, move unchanged out of
_helpers.tpl, next to the other one-topic helper files. Renders are
byte-identical.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1d360-e0b4-71d1-8ded-2e4851b93a8d
Co-authored-by: Amp <amp@ampcode.com>
---
 .../dind/templates/_helpers.tpl               |  49 ------
 .../dind/templates/_helpers/_labels.tpl       |  47 ++++++
 .../k8s/templates/_helpers.tpl                |  47 ------
 .../k8s/templates/_helpers/_labels.tpl        |  47 ++++++
 .../templates/_helpers.tpl                    |  41 -----
 .../templates/_helpers/_labels.tpl            |  40 +++++
 charts/sourcegraph/templates/_helpers.tpl     | 140 ------------------
 .../templates/_helpers/_labels.tpl            | 139 +++++++++++++++++
 8 files changed, 273 insertions(+), 277 deletions(-)
 create mode 100644 charts/sourcegraph-executor/dind/templates/_helpers/_labels.tpl
 create mode 100644 charts/sourcegraph-executor/k8s/templates/_helpers/_labels.tpl
 create mode 100644 charts/sourcegraph-migrator/templates/_helpers/_labels.tpl
 create mode 100644 charts/sourcegraph/templates/_helpers/_labels.tpl

diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
index c63812f0e..1143009eb 100644
--- a/charts/sourcegraph-executor/dind/templates/_helpers.tpl
+++ b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
@@ -12,47 +12,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "sourcegraph.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "sourcegraph.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Labels of a pod template: the common labels, then sourcegraph.podLabels, then
-the component's podLabels, then the selector labels. The later one wins when a
-key is set more than once, so each key is rendered once and the selector always
-matches the pods.
-
-`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
-every chart version, and a changed pod template restarts the pods.
-
-{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
-*/}}
-{{- define "sourcegraph.podLabels" -}}
-{{- $top := index . 0 -}}
-{{- $component := index . 1 -}}
-{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
-{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}
@@ -116,7 +75,6 @@ tolerations:
 {{- end }}
 {{- end }}
 
-
 {{- define "executor.name" -}}
 {{- if .Values.executor.queueName -}}
 executor-{{.Values.executor.queueName}}
@@ -125,13 +83,6 @@ executor-{{join "-" .Values.executor.queueNames }}
 {{- end }}
 {{- end }}
 
-{{- define "executor.labels" -}}
-app: {{ include "executor.name" . }}
-deploy: sourcegraph
-sourcegraph-resource-requires: no-cluster-admin
-app.kubernetes.io/component: executor
-{{- end}}
-
 {{- define "dind.daemonConfig" -}}
 {{- $config := .Values.dind.daemonConfig | deepCopy }}
 {{- if .Values.dind.gVisor.enabled }}
diff --git a/charts/sourcegraph-executor/dind/templates/_helpers/_labels.tpl b/charts/sourcegraph-executor/dind/templates/_helpers/_labels.tpl
new file mode 100644
index 000000000..f4c0197ef
--- /dev/null
+++ b/charts/sourcegraph-executor/dind/templates/_helpers/_labels.tpl
@@ -0,0 +1,47 @@
+{{/*
+Common labels
+*/}}
+{{- define "sourcegraph.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+{{ include "sourcegraph.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "sourcegraph.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
+{{- define "executor.labels" -}}
+app: {{ include "executor.name" . }}
+deploy: sourcegraph
+sourcegraph-resource-requires: no-cluster-admin
+app.kubernetes.io/component: executor
+{{- end}}
diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
index bdfd73fea..cb8bb442b 100644
--- a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
+++ b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
@@ -12,47 +12,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "sourcegraph.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "sourcegraph.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Labels of a pod template: the common labels, then sourcegraph.podLabels, then
-the component's podLabels, then the selector labels. The later one wins when a
-key is set more than once, so each key is rendered once and the selector always
-matches the pods.
-
-`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
-every chart version, and a changed pod template restarts the pods.
-
-{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
-*/}}
-{{- define "sourcegraph.podLabels" -}}
-{{- $top := index . 0 -}}
-{{- $component := index . 1 -}}
-{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
-{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}
@@ -124,9 +83,3 @@ executor-{{join "-" .Values.executor.queueNames }}
 {{- end }}
 {{- end }}
 
-{{- define "executor.labels" -}}
-app: {{ include "executor.name" . }}
-deploy: sourcegraph
-sourcegraph-resource-requires: no-cluster-admin
-app.kubernetes.io/component: executor
-{{- end}}
diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers/_labels.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers/_labels.tpl
new file mode 100644
index 000000000..f4c0197ef
--- /dev/null
+++ b/charts/sourcegraph-executor/k8s/templates/_helpers/_labels.tpl
@@ -0,0 +1,47 @@
+{{/*
+Common labels
+*/}}
+{{- define "sourcegraph.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+{{ include "sourcegraph.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "sourcegraph.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
+{{- define "executor.labels" -}}
+app: {{ include "executor.name" . }}
+deploy: sourcegraph
+sourcegraph-resource-requires: no-cluster-admin
+app.kubernetes.io/component: executor
+{{- end}}
diff --git a/charts/sourcegraph-migrator/templates/_helpers.tpl b/charts/sourcegraph-migrator/templates/_helpers.tpl
index 41b006c6c..2de962a1e 100644
--- a/charts/sourcegraph-migrator/templates/_helpers.tpl
+++ b/charts/sourcegraph-migrator/templates/_helpers.tpl
@@ -12,47 +12,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "sourcegraph.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "sourcegraph.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Labels of a pod template: the common labels, then sourcegraph.podLabels, then
-the component's podLabels, then the selector labels. The later one wins when a
-key is set more than once, so each key is rendered once and the selector always
-matches the pods.
-
-`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
-every chart version, and a changed pod template restarts the pods.
-
-{{ include "sourcegraph.podLabels" (list . .Values.migrator) }}
-*/}}
-{{- define "sourcegraph.podLabels" -}}
-{{- $top := index . 0 -}}
-{{- $component := index . 1 -}}
-{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
-{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}
diff --git a/charts/sourcegraph-migrator/templates/_helpers/_labels.tpl b/charts/sourcegraph-migrator/templates/_helpers/_labels.tpl
new file mode 100644
index 000000000..a73d9a7bb
--- /dev/null
+++ b/charts/sourcegraph-migrator/templates/_helpers/_labels.tpl
@@ -0,0 +1,40 @@
+{{/*
+Common labels
+*/}}
+{{- define "sourcegraph.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+{{ include "sourcegraph.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "sourcegraph.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.migrator) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
index 63fb2fd4e..1380abc87 100644
--- a/charts/sourcegraph/templates/_helpers.tpl
+++ b/charts/sourcegraph/templates/_helpers.tpl
@@ -12,44 +12,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "sourcegraph.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Regex of the Service and pod labels that the bundled Prometheus must not copy to
-the metrics it scrapes: the common labels and the keys of `sourcegraph.labels`,
-spelled as Prometheus spells them, with `_` for every character outside
-`[a-zA-Z0-9_]`. No bundled dashboard or alert queries them, and `helm.sh/chart`
-and `app.kubernetes.io/version` change on every upgrade.
-
-A key of `sourcegraph.labels` that the chart also sets itself, such as `app`,
-is kept: the chart's value wins on the object, and dashboards and alerts query it.
-*/}}
-{{- define "sourcegraph.prometheus.droppedLabels" -}}
-{{- $names := list "helm_sh_chart" "app_kubernetes_io_(name|instance|version|managed_by)" -}}
-{{- $kept := list "app" "deploy" "group" "type" "worker_replica" "app_kubernetes_io_component" "sourcegraph_resource_requires" -}}
-{{- range $key := keys (.Values.sourcegraph.labels | default dict) | sortAlpha -}}
-{{- $name := regexReplaceAll "[^a-zA-Z0-9_]" $key "_" -}}
-{{- if not (has $name $kept) -}}
-{{- $names = append $names $name -}}
-{{- end -}}
-{{- end -}}
-{{- $names | uniq | join "|" -}}
-{{- end }}
-
 {{/*
 The `service.telemetry.metrics.readers` setting of `otel-collector`, as a YAML
 flow sequence. It serves the collector's own metrics on all interfaces, port
@@ -63,67 +25,6 @@ The image's `jaeger.yaml` already has this setting. Its `logging.yaml` does not.
 [{pull: {exporter: {prometheus: {host: "0.0.0.0", port: 8888, without_type_suffix: true, without_units: true}}}}]
 {{- end }}
 
-{{/*
-Selector labels, shared by a component's workload selector, pod labels, and
-Service and PodDisruptionBudget selectors, so they cannot drift apart.
-
-Pass the root context and the component's values:
-
-{{ include "sourcegraph.selectorLabels" (list . .Values.frontend) }}
-*/}}
-{{- define "sourcegraph.selectorLabels" -}}
-{{- $top := index . 0 -}}
-{{- if not $top.Values.sourcegraph.selectorLabelsOverride -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" $top }}
-app.kubernetes.io/instance: {{ $top.Release.Name }}
-{{- end }}
-{{- with include "sourcegraph.customSelectorLabels" . }}
-{{ . }}
-{{- end }}
-{{- end }}
-
-{{/*
-Labels of a component's pod template: the common labels, then
-sourcegraph.podLabels, then the component's podLabels, then its selector labels.
-The later one wins when a key is set more than once, so each key is rendered
-once and the selector always matches the pods.
-
-`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
-every chart version, and a changed pod template restarts the pods.
-
-{{ include "sourcegraph.podLabels" (list . .Values.frontend) }}
-*/}}
-{{- define "sourcegraph.podLabels" -}}
-{{- $top := index . 0 -}}
-{{- $component := index . 1 -}}
-{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
-{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" . | fromYaml) | toYaml -}}
-{{- end }}
-
-{{/*
-The selector labels set in values: sourcegraph.selectorLabelsOverride, which
-replaces the default selector labels on every component, merged with the
-component's extraSelectorLabels. Empty by default.
-
-These exist to adopt workloads created outside this chart, whose selectors
-are immutable. The chart sets the labels in $chartLabels itself, so
-overriding one would stop a selector from matching its pods.
-*/}}
-{{- define "sourcegraph.customSelectorLabels" -}}
-{{- $top := index . 0 -}}
-{{- $component := index . 1 -}}
-{{- $chartLabels := list "app" "deploy" "group" "type" "worker-replica" -}}
-{{- $labels := mergeOverwrite (dict) ($top.Values.sourcegraph.selectorLabelsOverride | default dict) ($component.extraSelectorLabels | default dict) -}}
-{{- range $chartLabel := $chartLabels -}}
-{{- if hasKey $labels $chartLabel -}}
-{{- fail (printf "sourcegraph.selectorLabelsOverride and <serviceName>.extraSelectorLabels must not set the label %q, which the chart sets itself" $chartLabel) -}}
-{{- end -}}
-{{- end -}}
-{{- with $labels -}}
-{{ toYaml . }}
-{{- end -}}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 
@@ -179,24 +80,6 @@ annotations:
 {{- end }}
 {{- end }}
 
-{{/*
-The labels set in <serviceName>.serviceAccount.labels, rendered on the
-component's ServiceAccount and on its Role, RoleBinding, ClusterRole, and
-ClusterRoleBinding, if it has any. Empty by default.
-
-Takes the same arguments as "sourcegraph.serviceAccountName".
-*/}}
-{{- define "sourcegraph.serviceAccountLabels" -}}
-{{- $top := index . 0 }}
-{{- if hasKey $top "Values" -}}
-{{- $top = index $top "Values" -}}
-{{- end -}}
-{{- $service := index . 1 }}
-{{- with (index $top $service "serviceAccount" "labels") }}
-{{- toYaml . }}
-{{- end }}
-{{- end }}
-
 {{/*
 Create the docker image reference and allow it to be overridden on a per-service basis
 Default tags are toggled between a global and service-specific setting by the
@@ -255,29 +138,6 @@ tolerations:
 {{- end }}
 {{- end }}
 
-{{/*
-Jaeger common labels
-*/}}
-{{- define "sourcegraph.jaeger.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.jaeger.selectorLabels" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Jaeger selector labels
-*/}}
-{{- define "sourcegraph.jaeger.selectorLabels" -}}
-app.kubernetes.io/name: jaeger
-{{- end }}
-
 {{- define "sourcegraph.openTelemetryEnv" -}}
 {{- if .Values.openTelemetry.enabled -}}
 {{- if eq (.Values.openTelemetry.agent.kind | default "DaemonSet") "Deployment" -}}
diff --git a/charts/sourcegraph/templates/_helpers/_labels.tpl b/charts/sourcegraph/templates/_helpers/_labels.tpl
new file mode 100644
index 000000000..6a0718f90
--- /dev/null
+++ b/charts/sourcegraph/templates/_helpers/_labels.tpl
@@ -0,0 +1,139 @@
+{{/*
+Common labels
+*/}}
+{{- define "sourcegraph.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Regex of the Service and pod labels that the bundled Prometheus must not copy to
+the metrics it scrapes: the common labels and the keys of `sourcegraph.labels`,
+spelled as Prometheus spells them, with `_` for every character outside
+`[a-zA-Z0-9_]`. No bundled dashboard or alert queries them, and `helm.sh/chart`
+and `app.kubernetes.io/version` change on every upgrade.
+
+A key of `sourcegraph.labels` that the chart also sets itself, such as `app`,
+is kept: the chart's value wins on the object, and dashboards and alerts query it.
+*/}}
+{{- define "sourcegraph.prometheus.droppedLabels" -}}
+{{- $names := list "helm_sh_chart" "app_kubernetes_io_(name|instance|version|managed_by)" -}}
+{{- $kept := list "app" "deploy" "group" "type" "worker_replica" "app_kubernetes_io_component" "sourcegraph_resource_requires" -}}
+{{- range $key := keys (.Values.sourcegraph.labels | default dict) | sortAlpha -}}
+{{- $name := regexReplaceAll "[^a-zA-Z0-9_]" $key "_" -}}
+{{- if not (has $name $kept) -}}
+{{- $names = append $names $name -}}
+{{- end -}}
+{{- end -}}
+{{- $names | uniq | join "|" -}}
+{{- end }}
+
+{{/*
+Selector labels, shared by a component's workload selector, pod labels, and
+Service and PodDisruptionBudget selectors, so they cannot drift apart.
+
+Pass the root context and the component's values:
+
+{{ include "sourcegraph.selectorLabels" (list . .Values.frontend) }}
+*/}}
+{{- define "sourcegraph.selectorLabels" -}}
+{{- $top := index . 0 -}}
+{{- if not $top.Values.sourcegraph.selectorLabelsOverride -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" $top }}
+app.kubernetes.io/instance: {{ $top.Release.Name }}
+{{- end }}
+{{- with include "sourcegraph.customSelectorLabels" . }}
+{{ . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Labels of a component's pod template: the common labels, then
+sourcegraph.podLabels, then the component's podLabels, then its selector labels.
+The later one wins when a key is set more than once, so each key is rendered
+once and the selector always matches the pods.
+
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.frontend) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" . | fromYaml) | toYaml -}}
+{{- end }}
+
+{{/*
+The selector labels set in values: sourcegraph.selectorLabelsOverride, which
+replaces the default selector labels on every component, merged with the
+component's extraSelectorLabels. Empty by default.
+
+These exist to adopt workloads created outside this chart, whose selectors
+are immutable. The chart sets the labels in $chartLabels itself, so
+overriding one would stop a selector from matching its pods.
+*/}}
+{{- define "sourcegraph.customSelectorLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $chartLabels := list "app" "deploy" "group" "type" "worker-replica" -}}
+{{- $labels := mergeOverwrite (dict) ($top.Values.sourcegraph.selectorLabelsOverride | default dict) ($component.extraSelectorLabels | default dict) -}}
+{{- range $chartLabel := $chartLabels -}}
+{{- if hasKey $labels $chartLabel -}}
+{{- fail (printf "sourcegraph.selectorLabelsOverride and <serviceName>.extraSelectorLabels must not set the label %q, which the chart sets itself" $chartLabel) -}}
+{{- end -}}
+{{- end -}}
+{{- with $labels -}}
+{{ toYaml . }}
+{{- end -}}
+{{- end }}
+
+{{/*
+The labels set in <serviceName>.serviceAccount.labels, rendered on the
+component's ServiceAccount and on its Role, RoleBinding, ClusterRole, and
+ClusterRoleBinding, if it has any. Empty by default.
+
+Takes the same arguments as "sourcegraph.serviceAccountName".
+*/}}
+{{- define "sourcegraph.serviceAccountLabels" -}}
+{{- $top := index . 0 }}
+{{- if hasKey $top "Values" -}}
+{{- $top = index $top "Values" -}}
+{{- end -}}
+{{- $service := index . 1 }}
+{{- with (index $top $service "serviceAccount" "labels") }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Jaeger common labels
+*/}}
+{{- define "sourcegraph.jaeger.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+{{ include "sourcegraph.jaeger.selectorLabels" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Jaeger selector labels
+*/}}
+{{- define "sourcegraph.jaeger.selectorLabels" -}}
+app.kubernetes.io/name: jaeger
+{{- end }}