marcleblanc2 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026
diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md
@@ -3,6 +3,9 @@
 <!-- START CHANGELOG -->
 ## Unreleased
 
+- Every object the charts create now has the `deploy` and `app.kubernetes.io/component` labels: the `sourcegraph-executor-k8s` Secret did not have them. `executor.labels` is now also rendered on the `sourcegraph-executor-k8s` ConfigMap, Secret, ServiceAccount, Role, and RoleBinding, and on the `sourcegraph-executor-dind` `docker-config` ConfigMap, not only on the Deployment. Added `privateDockerRegistry.serviceLabels` to the `sourcegraph-executor-dind` chart to label the `private-docker-registry` Service.
+- `sourcegraph.labels` and the charts' standard labels (`helm.sh/chart`, `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`) are now rendered on every object the charts create. The `sourcegraph-executor-k8s` chart rendered them on none of its objects (ConfigMap, Deployment, Role, RoleBinding, Secret, Service, ServiceAccount), and the `sourcegraph-executor-dind` chart did not render them on the `docker-config` ConfigMap and the `private-docker-registry` Service. Pods get them too, except `helm.sh/chart` and `app.kubernetes.io/version`, which change with every chart version and would restart every pod on every upgrade. The `private-docker-registry` pod gains `app.kubernetes.io/component`. Existing releases gain these labels on upgrade. No object is recreated. Every pod restarts once, on this upgrade.
+
 ## 8.0.0
 
 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API.

diff --git a/charts/sourcegraph-executor/dind/README.md b/charts/sourcegraph-executor/dind/README.md
@@ -90,6 +90,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | privateDockerRegistry.image.registry | string | `"index.docker.io"` |  |
 | privateDockerRegistry.image.repository | string | `"registry"` |  |
 | privateDockerRegistry.image.tag | int | `3` |  |
+| privateDockerRegistry.serviceLabels | object | `{}` | Add extra labels to the `private-docker-registry` Service |
 | privateDockerRegistry.storageSize | string | `"10Gi"` |  |
 | queues | list | `[]` | Optional list of queues to deploy as standalone Deployments. When set, the single executor Deployment is not rendered. Each entry supports:   name        (required) — used as the deployment name suffix (executor-<name>)   queueName   — sets EXECUTOR_QUEUE_NAME; defaults to name if omitted   queueNames  — sets EXECUTOR_QUEUE_NAMES (comma-joined); takes precedence over queueName when set   replicaCount, resources, env (merged with executor.env, queue overrides) |
 | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) |

diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl
@@ -12,29 +12,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "sourcegraph.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "sourcegraph.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}
@@ -98,7 +75,6 @@ tolerations:
 {{- end }}
 {{- end }}
 
-
 {{- define "executor.name" -}}
 {{- if .Values.executor.queueName -}}
 executor-{{.Values.executor.queueName}}
@@ -107,13 +83,6 @@ executor-{{join "-" .Values.executor.queueNames }}
 {{- end }}
 {{- end }}
 
-{{- define "executor.labels" -}}
-app: {{ include "executor.name" . }}
-deploy: sourcegraph
-sourcegraph-resource-requires: no-cluster-admin
-app.kubernetes.io/component: executor
-{{- end}}
-
 {{- define "dind.daemonConfig" -}}
 {{- $config := .Values.dind.daemonConfig | deepCopy }}
 {{- if .Values.dind.gVisor.enabled }}
@@ -169,13 +138,7 @@ spec:
       {{- toYaml $r.Values.executor.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" $r | nindent 8 }}
-      {{- if $r.Values.sourcegraph.podLabels }}
-      {{- toYaml $r.Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if $r.Values.executor.podLabels }}
-      {{- toYaml $r.Values.executor.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list $r $r.Values.executor) | nindent 8 }}
         app: {{ .name }}
         deploy: sourcegraph
         sourcegraph-resource-requires: no-cluster-admin

diff --git a/charts/sourcegraph-executor/dind/templates/_helpers/_labels.tpl b/charts/sourcegraph-executor/dind/templates/_helpers/_labels.tpl
@@ -0,0 +1,47 @@
+{{/*
+Common labels
+*/}}
+{{- define "sourcegraph.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+{{ include "sourcegraph.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "sourcegraph.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
+{{- define "executor.labels" -}}
+app: {{ include "executor.name" . }}
+deploy: sourcegraph
+sourcegraph-resource-requires: no-cluster-admin
+app.kubernetes.io/component: executor
+{{- end}}
diff --git a/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml b/charts/sourcegraph-executor/dind/templates/executor/docker-daemon.ConfigMap.yaml
@@ -2,6 +2,10 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
     app: executor
     deploy: sourcegraph
     app.kubernetes.io/component: executor

diff --git a/...raph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml b/...raph-executor/dind/templates/private-docker-registry/private-docker-registry.Service.yaml
@@ -7,9 +7,13 @@ metadata:
     {{- toYaml .Values.privateDockerRegistry.serviceAnnotations | nindent 4 }}
   {{- end }}
   labels:
+    {{- include "sourcegraph.labels" . | nindent 4 }}
     app: private-docker-registry
     deploy: sourcegraph
     app.kubernetes.io/component: private-docker-registry
+    {{- if .Values.privateDockerRegistry.serviceLabels }}
+      {{- toYaml .Values.privateDockerRegistry.serviceLabels | nindent 4 }}
+    {{- end }}
   name: private-docker-registry
 spec:
   ports:

diff --git a/...-executor/dind/templates/private-docker-registry/private-docker-registry.Statefulset.yaml b/...-executor/dind/templates/private-docker-registry/private-docker-registry.Statefulset.yaml
@@ -30,15 +30,10 @@ spec:
       {{- toYaml .Values.privateDockerRegistry.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" . | nindent 8 }}
-      {{- if .Values.sourcegraph.podLabels }}
-      {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
-      {{- end }}
-      {{- if .Values.privateDockerRegistry.podLabels }}
-      {{- toYaml .Values.privateDockerRegistry.podLabels | nindent 8 }}
-      {{- end }}
+        {{- include "sourcegraph.podLabels" (list . .Values.privateDockerRegistry) | nindent 8 }}
         deploy: sourcegraph
         app: private-docker-registry
+        app.kubernetes.io/component: private-docker-registry
     spec:
       containers:
         - name: private-docker-registry

diff --git a/charts/sourcegraph-executor/dind/tests/labels_test.yaml b/charts/sourcegraph-executor/dind/tests/labels_test.yaml
@@ -0,0 +1,107 @@
+suite: sourcegraph.labels on every object
+# No `templates` list, so every template in the chart is rendered, including
+# ones added later. The test fails with "no manifest found" for a template that
+# renders nothing, so enable a new optional template here.
+tests:
+  - it: should add sourcegraph.labels to every object the chart renders
+    set:
+      sourcegraph:
+        labels:
+          example.com/installation: production
+          example.com/project: sourcegraph
+      executor:
+        queueName: batches
+      privateDockerRegistry:
+        enabled: true
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/installation: production
+            example.com/project: sourcegraph
+      - exists:
+          path: metadata.labels["helm.sh/chart"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/name"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/instance"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: metadata.labels["app.kubernetes.io/component"]
+  - it: should add the labels of a component to every object of it
+    set:
+      executor:
+        queueName: batches
+        labels:
+          example.com/service: component
+      privateDockerRegistry:
+        enabled: true
+        labels:
+          example.com/service: component
+        serviceLabels:
+          example.com/service: component
+    asserts:
+      - equal:
+          path: metadata.labels["example.com/service"]
+          value: component
+  - it: should add sourcegraph.labels and the chart's labels to the pod template, and let the selector labels win
+    template: executor/executor.Deployment.yaml
+    set:
+      sourcegraph:
+        labels:
+          example.com/project: sourcegraph
+        podLabels:
+          example.com/project: pods
+          # A selector label: a different value would stop the selector from matching the pods.
+          app.kubernetes.io/instance: other
+      executor:
+        queueName: batches
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/project: pods
+      - notExists:
+          path: spec.template.metadata.labels["helm.sh/chart"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+      - notExists:
+          path: spec.template.metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
+  - it: should add sourcegraph.labels and the chart's labels to the pod template, and let the selector labels win
+    template: private-docker-registry/private-docker-registry.Statefulset.yaml
+    set:
+      sourcegraph:
+        labels:
+          example.com/project: sourcegraph
+        podLabels:
+          example.com/project: pods
+          # A selector label: a different value would stop the selector from matching the pods.
+          app.kubernetes.io/instance: other
+      executor:
+        queueName: batches
+      privateDockerRegistry:
+        enabled: true
+    asserts:
+      - isSubset:
+          path: spec.template.metadata.labels
+          content:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/managed-by: Helm
+            deploy: sourcegraph
+            example.com/project: pods
+      - notExists:
+          path: spec.template.metadata.labels["helm.sh/chart"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
+      - notExists:
+          path: spec.template.metadata.labels["app.kubernetes.io/version"]
+      - exists:
+          path: spec.template.metadata.labels["app.kubernetes.io/component"]
diff --git a/charts/sourcegraph-executor/dind/values.yaml b/charts/sourcegraph-executor/dind/values.yaml
@@ -217,6 +217,8 @@ privateDockerRegistry:
     repository: registry
     tag: 3
   storageSize: 10Gi
+  # -- Add extra labels to the `private-docker-registry` Service
+  serviceLabels: {}
   # -- Extra environment variables to set on the registry container.
   # Registry can be configured with environment variables using the pattern
   # REGISTRY_<SECTION>_<KEY> (uppercase). Full reference:

diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers.tpl
@@ -12,29 +12,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "sourcegraph.labels" -}}
-helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- if .Values.sourcegraph.labels }}
-{{ toYaml .Values.sourcegraph.labels }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "sourcegraph.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}
@@ -106,9 +83,3 @@ executor-{{join "-" .Values.executor.queueNames }}
 {{- end }}
 {{- end }}
 
-{{- define "executor.labels" -}}
-app: {{ include "executor.name" . }}
-deploy: sourcegraph
-sourcegraph-resource-requires: no-cluster-admin
-app.kubernetes.io/component: executor
-{{- end}}
diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers/_labels.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers/_labels.tpl
@@ -0,0 +1,47 @@
+{{/*
+Common labels
+*/}}
+{{- define "sourcegraph.labels" -}}
+helm.sh/chart: {{ include "sourcegraph.chart" . }}
+{{ include "sourcegraph.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.sourcegraph.labels }}
+{{ toYaml .Values.sourcegraph.labels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "sourcegraph.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Labels of a pod template: the common labels, then sourcegraph.podLabels, then
+the component's podLabels, then the selector labels. The later one wins when a
+key is set more than once, so each key is rendered once and the selector always
+matches the pods.
+
+`helm.sh/chart` and `app.kubernetes.io/version` are left out: they change with
+every chart version, and a changed pod template restarts the pods.
+
+{{ include "sourcegraph.podLabels" (list . .Values.executor) }}
+*/}}
+{{- define "sourcegraph.podLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $labels := omit (include "sourcegraph.labels" $top | fromYaml) "helm.sh/chart" "app.kubernetes.io/version" -}}
+{{- mergeOverwrite $labels ($top.Values.sourcegraph.podLabels | default dict) ($component.podLabels | default dict) (include "sourcegraph.selectorLabels" $top | fromYaml) | toYaml -}}
+{{- end }}
+
+{{- define "executor.labels" -}}
+app: {{ include "executor.name" . }}
+deploy: sourcegraph
+sourcegraph-resource-requires: no-cluster-admin
+app.kubernetes.io/component: executor
+{{- end}}
diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml
@@ -3,7 +3,11 @@ kind: ConfigMap
 metadata:
   name: {{ include "executor.name" . }}
   labels:
-{{- include "executor.labels" . | nindent 4 }}
+    {{- include "sourcegraph.labels" . | nindent 4 }}
+    {{- include "executor.labels" . | nindent 4 }}
+    {{- if .Values.executor.labels }}
+      {{- toYaml .Values.executor.labels | nindent 4 }}
+    {{- end }}
 data:
   EXECUTOR_USE_FIRECRACKER: "false"
   EXECUTOR_FRONTEND_URL: "{{ .Values.executor.frontendUrl }}"