[marcleblanc2]

Summary

I checked every object, port, and setting the four charts render against what actually uses it, and opened this PR to remove the eight things that are not used

Removed	Why it's unused
k8s executor: container port 6060 (http-debug) and the executor-<queueName> Service	The executor hasn't served 6060 since Sourcegraph 4.1. The Service fronts only that port.
k8s executor: get and list on Pods, Secrets, and PVCs in its Role	The executor stopped calling them in Sourcegraph 5.1
k8s executor: SRC_TRACE_LOG in its ConfigMap	Nothing has read it since Sourcegraph 5.2
dind executor: container port 2375 on the dind sidecar	dockerd listens on 127.0.0.1 only; the executor reaches it over localhost
otel-agent: port 55679 (http-zpages) and its hostPort	zpages listens on localhost only
Jaeger: remote_sampling extension and port 5778	Nothing ever asked it for sampling strategies: no Service exposed the port, and Sourcegraph always set its own sampling
Jaeger: Prometheus scrape annotations	They point at port 16686, the UI, which returns 404 for /metrics. The scrape always failed
Prometheus: the kubernetes-services scrape job	It probes through a blackbox exporter the chart doesn't ship, and no Service opts in

These values go with them and are ignored if still set: openTelemetry.agent.hostPorts.httpZpages, jaeger.config.samplingDefaultProbability, executor.log.trace, and the undocumented executor.serviceAnnotations, executor.serviceLabels, and executor.serviceType.

Upgrade impact

• No admin action needed
• No change to system behaviour
• Helm deletes the executor-<queueName> Service
• The k8s executor, dind executor, otel-agent, and jaeger pods restart once
• Executor metrics are not affected: they go to frontend with each heartbeat, and Prometheus scrapes them from worker-executors

Evidence

• k8s executor, on test instances m and m5: no process listens on 6060, connecting to the pod or the Service on 6060 fails, and worker-executors:6996/metrics returns 200
• k8s executor Role: 30 days of EKS audit logs for its ServiceAccount on m and m5 show 365 requests, all create/delete on Jobs and Secrets, watch on Pods, or get on pods/log
• otel-agent, on m5: listens on 127.0.0.1:55679 only, and connecting on the pod IP or node IP fails. kubectl port-forward still reaches zpages
• Jaeger 2.17.0 (the pinned image's version), run locally with this PR's config: starts cleanly, accepts a trace, and shows it in the UI. 16686/metrics returns 404
• lint.sh, helm unittest, and helm-docs pass. helm template against main differs only in the removed lines

Review

Reviewed on 2026-11-13 (review thread), at bc281c3. No open issues.

Tested on the EKS test instance m5, by upgrading from main to this branch merged onto main:

• k8s executor: the Service is deleted, the Role is narrowed to what the table says, the executor logs no Forbidden, and a batch spec completes on main and on this branch
• otel-agent: only ports 4317, 4318, and 8888 remain, and the node's port 55679 is closed
• Jaeger: starts with no errors, and a span posted to an otel-agent node port shows up in the Jaeger UI
• Prometheus: the loaded config has no kubernetes-services job once the pod restarts, and the other targets are unchanged. On main nothing restarts the pod for a config change; Render sourcegraph.labels on every object, and add storage and ServiceAccount labels #1008 and fix/rbac: Fix Prometheus' defaults, privileged: false, and scope discovery down to the same namespace #1015 add that
• dind executor: port 2375 is gone from the sidecar and the executor still sends heartbeats. A batch spec fails the same way on main and on this branch (step.docker.step.0.post exits 1), so that is a problem with the test instance, not this PR

Not tested: an auto-indexing job (not enabled on the instance), and traces sent by Sourcegraph itself (the instance's collector is configured to log traces, not forward them).

Small ones, none blocking:

• No test asserts that the removed objects, ports, and values stay removed
• The zpages extension still runs in otel-agent, on localhost only

[github-actions]

Open the Diff Tour for this PR in Sourcegraph