From 5668cf11094b8b6aa0e69b585141c1507bfb1d64 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 18:36:42 -0600 Subject: [PATCH 1/6] executor/k8s: remove the unused debug port 6060 and its Service Executors stopped serving port 6060 in Sourcegraph 4.1, before this chart existed, so the container port and the Service that fronts it have never had a listener. The chart's probes use pgrep, and executor metrics reach Prometheus through worker's worker-executors Service. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d140-e6de-7173-8b4f-187543b7833c Co-authored-by: Amp --- charts/sourcegraph-executor/CHANGELOG.md | 2 ++ .../k8s/templates/executor.Deployment.yaml | 3 --- .../k8s/templates/executor.Service.yaml | 22 ------------------- .../k8s/tests/executor_test.yaml | 8 +------ charts/sourcegraph/CHANGELOG.md | 1 + 5 files changed, 4 insertions(+), 32 deletions(-) delete mode 100644 charts/sourcegraph-executor/k8s/templates/executor.Service.yaml diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md index 5e2f4fb18..756707c22 100644 --- a/charts/sourcegraph-executor/CHANGELOG.md +++ b/charts/sourcegraph-executor/CHANGELOG.md @@ -3,6 +3,8 @@ ## Unreleased +* Removed the unused `http-debug` container port (6060) and the `executor-` Service from the Kubernetes-native executor chart (`sourcegraph-executor/k8s`). Nothing listens on that port: executors stopped serving it in Sourcegraph 4.1, before this chart existed. Helm deletes the Service on upgrade. The undocumented `executor.serviceAnnotations`, `executor.serviceLabels`, and `executor.serviceType` values no longer have any effect. Executor metrics are unaffected; `worker` serves them through the `worker-executors` Service. + ## 8.0.0 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API. diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml index 1cb35d2c4..35dee6c4b 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml @@ -67,9 +67,6 @@ spec: imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }} securityContext: {{- toYaml .Values.executor.containerSecurityContext | nindent 12 }} - ports: - - name: http-debug - containerPort: 6060 envFrom: - configMapRef: name: {{ include "executor.name" . }} diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml deleted file mode 100644 index 33d841b3b..000000000 --- a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - annotations: - {{- if .Values.executor.serviceAnnotations }} - {{- toYaml .Values.executor.serviceAnnotations | nindent 4 }} - {{- end }} - labels: -{{ include "executor.labels" . | indent 4 }} - {{- if .Values.executor.serviceLabels }} - {{- toYaml .Values.executor.serviceLabels | nindent 4 }} - {{- end }} - name: {{ include "executor.name" . }} -spec: - ports: - - name: http-debug - port: 6060 - targetPort: http-debug - selector: - {{- include "sourcegraph.selectorLabels" . | nindent 4 }} - app: {{ include "executor.name" . }} - type: {{ .Values.executor.serviceType | default "ClusterIP" }} diff --git a/charts/sourcegraph-executor/k8s/tests/executor_test.yaml b/charts/sourcegraph-executor/k8s/tests/executor_test.yaml index 256638deb..dea6138f9 100644 --- a/charts/sourcegraph-executor/k8s/tests/executor_test.yaml +++ b/charts/sourcegraph-executor/k8s/tests/executor_test.yaml @@ -1,10 +1,9 @@ suite: executor templates: - executor.Deployment.yaml - - executor.Service.yaml - executor.ConfigMap.yaml tests: - - it: should render the Deployment, Service, ConfigMap if executor is enabled + - it: should render the Deployment, ConfigMap if executor is enabled set: executor: queueName: "test" @@ -14,11 +13,6 @@ tests: apiVersion: apps/v1 name: executor-test template: executor.Deployment.yaml - - containsDocument: - kind: Service - apiVersion: v1 - name: executor-test - template: executor.Service.yaml - containsDocument: kind: ConfigMap apiVersion: v1 diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index f4bf662f3..2f48bc4f1 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -21,6 +21,7 @@ Use `**BREAKING**:` to denote a breaking change - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence. - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. +- Removed the unused `http-debug` container port (6060) and the `executor-` Service from the Kubernetes-native executor chart (`sourcegraph-executor/k8s`). Nothing listens on that port: executors stopped serving it in Sourcegraph 4.1, before this chart existed. Helm deletes the Service on upgrade. The undocumented `executor.serviceAnnotations`, `executor.serviceLabels`, and `executor.serviceType` values no longer have any effect. Executor metrics are unaffected; `worker` serves them through the `worker-executors` Service ## 8.1.0 From 9d871d84d0dec306b535509f50d56f6c6b741046 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 19:12:14 -0600 Subject: [PATCH 2/6] Remove unused otel-agent zpages hostPort and dind port 2375 Neither port has a listener reachable from outside its pod: - otel-agent zpages binds localhost:55679, so hostPort 55679 only reserved the port on every node - dockerd in the dind sidecar binds 127.0.0.1:2375, and the executor reaches it over localhost Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph-executor/CHANGELOG.md | 2 ++ .../dind/templates/_helpers.tpl | 3 --- charts/sourcegraph/CHANGELOG.md | 2 ++ charts/sourcegraph/README.md | 2 +- .../otel-collector/otel-agent.DaemonSet.yaml | 3 --- .../sourcegraph/tests/otelAgentHostPort_test.yaml | 14 -------------- charts/sourcegraph/values.yaml | 1 - 7 files changed, 5 insertions(+), 22 deletions(-) diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md index 5e2f4fb18..ac7834775 100644 --- a/charts/sourcegraph-executor/CHANGELOG.md +++ b/charts/sourcegraph-executor/CHANGELOG.md @@ -3,6 +3,8 @@ ## Unreleased +* Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only (`dind.daemonConfig.hosts`), the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. + ## 8.0.0 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API. diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl index 8b87b5d24..69009566c 100644 --- a/charts/sourcegraph-executor/dind/templates/_helpers.tpl +++ b/charts/sourcegraph-executor/dind/templates/_helpers.tpl @@ -296,9 +296,6 @@ spec: fieldRef: apiVersion: v1 fieldPath: metadata.name - ports: - - containerPort: 2375 - protocol: TCP volumeMounts: - mountPath: /scratch name: executor-scratch diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index f4bf662f3..8e6a7b55c 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -21,6 +21,8 @@ Use `**BREAKING**:` to denote a breaking change - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence. - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. +- Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/ 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade. +- Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. ## 8.1.0 diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index 5bcea2ada..e6b00b058 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -283,7 +283,7 @@ In addition to the documented values, all services also support the following va | openTelemetry.agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | openTelemetry.agent.containerSecurityContext.runAsGroup | int | `101` | | | openTelemetry.agent.containerSecurityContext.runAsUser | int | `100` | | -| openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318,"httpZpages":55679}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | +| openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | openTelemetry.agent.kind | string | `"DaemonSet"` | The workload kind for the otel-agent. Valid values are `DaemonSet` and `Deployment`. Use `Deployment` in environments where DaemonSets are restricted (e.g. some managed Kubernetes offerings). When set to `Deployment`, the otel-agent DaemonSet is not created and application pods send traces directly to the existing otel-collector Deployment (otel-collector:4317) instead. | | openTelemetry.agent.name | string | `"otel-agent"` | Name used by resources. Does not affect service names or PVCs. | | openTelemetry.agent.resources.limits.cpu | string | `"500m"` | | diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml index 34e3c7ef2..9d2507509 100644 --- a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml +++ b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml @@ -79,9 +79,6 @@ spec: - name: http-otlp containerPort: 4318 hostPort: {{ toYaml .Values.openTelemetry.agent.hostPorts.httpOtlp }} - - name: http-zpages - containerPort: 55679 - hostPort: {{ toYaml .Values.openTelemetry.agent.hostPorts.httpZpages }} volumeMounts: - name: config mountPath: /etc/otel-agent diff --git a/charts/sourcegraph/tests/otelAgentHostPort_test.yaml b/charts/sourcegraph/tests/otelAgentHostPort_test.yaml index 0d4b00564..5a5889e2e 100644 --- a/charts/sourcegraph/tests/otelAgentHostPort_test.yaml +++ b/charts/sourcegraph/tests/otelAgentHostPort_test.yaml @@ -4,12 +4,6 @@ tests: - it: should use the default host ports when not defined in values template: otel-collector/otel-agent.DaemonSet.yaml asserts: - - contains: - path: spec.template.spec.containers[0].ports - content: - containerPort: 55679 - hostPort: 55679 - name: http-zpages - contains: path: spec.template.spec.containers[0].ports content: @@ -38,14 +32,7 @@ tests: hostPorts: grpcOtlp: 4319 httpOtlp: 4320 - httpZpages: 55680 asserts: - - contains: - path: spec.template.spec.containers[0].ports - content: - containerPort: 55679 - hostPort: 55680 - name: http-zpages - contains: path: spec.template.spec.containers[0].ports content: @@ -66,7 +53,6 @@ tests: hostPorts: grpcOtlp: 4319 httpOtlp: 4320 - httpZpages: 55680 asserts: - contains: path: spec.template.spec.containers[0].env diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 99823dc9c..265cc6a96 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -777,7 +777,6 @@ openTelemetry: hostPorts: grpcOtlp: 4317 httpOtlp: 4318 - httpZpages: 55679 resources: limits: cpu: "500m" From a12356d7dd25fb584ccb60059afef594deb46aa7 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 22:22:01 -0600 Subject: [PATCH 3/6] Remove Jaeger's unused remote_sampling extension and port 5778 Nothing ever asked Jaeger for sampling strategies: no Service exposed 5778, Sourcegraph and zoekt used a constant sampler while they had Jaeger clients, and both use OpenTelemetry since Sourcegraph 4.0. jaeger.config.samplingDefaultProbability is removed with it. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 1 + charts/sourcegraph/README.md | 3 +-- charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml | 8 +------- .../sourcegraph/templates/jaeger/jaeger.Deployment.yaml | 2 -- charts/sourcegraph/values.yaml | 2 -- 5 files changed, 3 insertions(+), 13 deletions(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index 8e6a7b55c..facb9aff0 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -22,6 +22,7 @@ Use `**BREAKING**:` to denote a breaking change - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. - Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/ 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade. +- Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade. - Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. ## 8.1.0 diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index e6b00b058..a0b07ee8f 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -243,11 +243,10 @@ In addition to the documented values, all services also support the following va | jaeger.collector.serviceAnnotations | object | `{}` | Add extra annotations to jaeger `collector` service | | jaeger.collector.serviceLabels | object | `{}` | Add extra labels to jaeger `collector` service | | jaeger.collector.serviceType | string | "ClusterIP" | Kubernetes service type of jaeger `collector` service, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) | -| jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000,"samplingDefaultProbability":1}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. | +| jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. | | jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. See https://www.jaegertracing.io/docs/2.16/configuration/ | | jaeger.config.logLevel | string | `"info"` | Log level for the Jaeger instance (debug, info, warn, error) | | jaeger.config.maxTraces | int | `20000` | Maximum number of traces stored in memory | -| jaeger.config.samplingDefaultProbability | float | `1` | Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config | | jaeger.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `jaeger` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | jaeger.enabled | bool | `false` | Enable `jaeger` | | jaeger.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `jaeger` image | diff --git a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml index 7e2a388cf..11df6f30e 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml @@ -11,7 +11,7 @@ metadata: data: jaeger-config.yaml: | service: - extensions: [jaeger_storage, jaeger_query, remote_sampling, healthcheckv2] + extensions: [jaeger_storage, jaeger_query, healthcheckv2] pipelines: traces: receivers: [otlp] @@ -36,12 +36,6 @@ data: base_path: "/-/debug/jaeger" http: endpoint: "0.0.0.0:16686" - remote_sampling: - file: - path: /etc/jaeger/sampling_strategies.json - default_sampling_probability: {{ .Values.jaeger.config.samplingDefaultProbability | default 1.0 }} - http: - endpoint: "0.0.0.0:5778" receivers: otlp: protocols: diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml index 856233e29..8ea1ca682 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml @@ -67,8 +67,6 @@ spec: {{- $item | toYaml | nindent 10 }} {{- end }} ports: - - containerPort: 5778 - protocol: TCP - containerPort: 16686 name: http protocol: TCP diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 265cc6a96..814f111f9 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -1452,8 +1452,6 @@ jaeger: maxTraces: 20000 # -- Log level for the Jaeger instance (debug, info, warn, error) logLevel: info - # -- Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config - samplingDefaultProbability: 1.0 # -- Security context for the `jaeger` container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) containerSecurityContext: From 7d37a19764ff963944f19c2ca09963bc7b42662d Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 22:26:01 -0600 Subject: [PATCH 4/6] executor/k8s: drop unused Role verbs and SRC_TRACE_LOG The executor watches Pods, gets pods/log, and creates and deletes Jobs, Secrets, and PVCs. It has not called get or list on Pods, Secrets, or PVCs since Sourcegraph 5.1; 30 days of EKS audit logs on two test instances show no such calls. SRC_TRACE_LOG has been unread since Sourcegraph 5.2. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph-executor/CHANGELOG.md | 2 ++ charts/sourcegraph-executor/k8s/README.md | 1 - .../k8s/templates/executor.ConfigMap.yaml | 1 - .../k8s/templates/executor.Role.yaml | 9 +++++---- charts/sourcegraph-executor/k8s/values.yaml | 1 - charts/sourcegraph/CHANGELOG.md | 1 + 6 files changed, 8 insertions(+), 7 deletions(-) diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md index ac7834775..41fcfb288 100644 --- a/charts/sourcegraph-executor/CHANGELOG.md +++ b/charts/sourcegraph-executor/CHANGELOG.md @@ -4,6 +4,8 @@ ## Unreleased * Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only (`dind.daemonConfig.hosts`), the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. +* Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1, before this chart existed. +* Removed `SRC_TRACE_LOG` from the Kubernetes-native executor's ConfigMap, and the `executor.log.trace` value that set it. Nothing has read `SRC_TRACE_LOG` since Sourcegraph 5.2. ## 8.0.0 diff --git a/charts/sourcegraph-executor/k8s/README.md b/charts/sourcegraph-executor/k8s/README.md index 67bae6cc3..5c6c6a4d2 100644 --- a/charts/sourcegraph-executor/k8s/README.md +++ b/charts/sourcegraph-executor/k8s/README.md @@ -86,7 +86,6 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.kubernetesJob.runAsUser | int | `nil`; accepts [0, 2147483647] | The user ID to run Kubernetes jobs as. | | executor.log.format | string | `"condensed"` | | | executor.log.level | string | `"warn"` | Possible values are `dbug`, `info`, `warn`, `eror`, `crit`. | -| executor.log.trace | string | `"false"` | | | executor.maximumNumJobs | int | `10` | The maximum amount of jobs that can be executed concurrently. | | executor.maximumRuntimePerJob | string | `"30m"` | | | executor.namespace | string | `"default"` | The namespace in which jobs are generated by the executor. | diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml index 6e773607b..67316cb82 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml @@ -14,7 +14,6 @@ data: SRC_LOG_LEVEL: "{{ .Values.executor.log.level }}" SRC_LOG_FORMAT: "{{ .Values.executor.log.format }}" - SRC_TRACE_LOG: "{{ .Values.executor.log.trace }}" EXECUTOR_KUBERNETES_NAMESPACE: "{{ .Values.executor.namespace }}" EXECUTOR_KUBERNETES_CONFIG_PATH: "{{ .Values.executor.kubeconfigPath }}" diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml index 7a3d1ef4d..873dbcf5d 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml @@ -20,19 +20,20 @@ rules: - "" resources: - pods + verbs: + - watch + - apiGroups: + - "" + resources: - pods/log verbs: - get - - list - - watch - apiGroups: - "" resources: - secrets - persistentvolumeclaims verbs: - - get - - list - create - delete {{- end }} diff --git a/charts/sourcegraph-executor/k8s/values.yaml b/charts/sourcegraph-executor/k8s/values.yaml index b55767725..42637aafd 100644 --- a/charts/sourcegraph-executor/k8s/values.yaml +++ b/charts/sourcegraph-executor/k8s/values.yaml @@ -75,7 +75,6 @@ executor: # -- Possible values are `dbug`, `info`, `warn`, `eror`, `crit`. level: "warn" format: "condensed" - trace: "false" # -- The namespace in which jobs are generated by the executor. namespace: "default" diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index facb9aff0..a93d0972d 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -24,6 +24,7 @@ Use `**BREAKING**:` to denote a breaking change - Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/ 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade. - Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade. - Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. +- Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) in `sourcegraph-executor/k8s` to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1. Also removed the unread `SRC_TRACE_LOG` setting and its `executor.log.trace` value. ## 8.1.0 From 31fe350bcc697b10da1cb06cc395b60ed60934f1 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 22:33:55 -0600 Subject: [PATCH 5/6] executor: list the k8s executor's real RBAC rules in the README Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph-executor/README.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/charts/sourcegraph-executor/README.md b/charts/sourcegraph-executor/README.md index 6bc0d8e71..6d084cd4d 100644 --- a/charts/sourcegraph-executor/README.md +++ b/charts/sourcegraph-executor/README.md @@ -11,10 +11,12 @@ This chart deploys executors that interact with the Kubernetes API to handle job Your cluster will need to allow configuration of the following RBAC rules: -| API Groups | Resources | Verbs | Reason | -|------------|--------------------|---------------------------|-------------------------------------------------------------------------------------------| -| `batch` | `jobs` | `create`, `delete` | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. | -| | `pods`, `pods/log` | `get`, `list`, `watch` | Executors need to look up and steam logs from the Job Pods. | +| API Groups | Resources | Verbs | Reason | +|------------|-------------------------------------|--------------------|-------------------------------------------------------------------------------------------| +| `batch` | `jobs` | `create`, `delete` | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. | +| `""` | `pods` | `watch` | Executors watch the Job pods to know when each step finishes. | +| `""` | `pods/log` | `get` | Executors stream logs from the Job pods. | +| `""` | `secrets`, `persistentvolumeclaims` | `create`, `delete` | Executors create a Secret for each job, and a PVC when job volumes use PVCs. | ## Docker in Docker (dind) From 368adf73e11d0af2fcd6c3532cbb5730e6873305 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:02:18 -0600 Subject: [PATCH 6/6] Remove Jaeger's broken scrape annotation and the blackbox probe job The jaeger pod asked Prometheus to scrape port 16686, which serves the UI and returns 404 for /metrics. The kubernetes-services job probed through a blackbox exporter the chart does not ship, and no Service opts in. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 2 ++ .../prometheus-override-k3s.ConfigMap.yaml | 23 ------------- .../templates/jaeger/jaeger.Deployment.yaml | 2 -- .../prometheus/prometheus.ConfigMap.yaml | 34 ------------------- 4 files changed, 2 insertions(+), 59 deletions(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index a93d0972d..6b5e61812 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -25,6 +25,8 @@ Use `**BREAKING**:` to denote a breaking change - Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade. - Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. - Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) in `sourcegraph-executor/k8s` to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1. Also removed the unread `SRC_TRACE_LOG` setting and its `executor.log.trace` value. +- Removed the Prometheus scrape annotations from the `jaeger` pod. They pointed Prometheus at port 16686, which serves the Jaeger UI and returns 404 for `/metrics`, so the scrape always failed. The `jaeger` pod is replaced once on upgrade. +- Removed the `kubernetes-services` scrape job from the built-in Prometheus configuration and the k3s example override. It probed Services annotated `prometheus.io/probe: "true"` through a `blackbox` exporter that the chart does not ship, and no Service carries that annotation, so it never produced data. ## 8.1.0 diff --git a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml index 5343dee1d..cde60295a 100644 --- a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml +++ b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml @@ -113,29 +113,6 @@ data: action: replace target_label: instance - - job_name: 'kubernetes-services' - metrics_path: /probe - params: - module: [http_2xx] - kubernetes_sd_configs: - - role: service - relabel_configs: - - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe] - action: keep - regex: true - - source_labels: [__address__] - target_label: __param_target - - target_label: __address__ - replacement: blackbox - - source_labels: [__param_target] - target_label: instance - - action: labelmap - regex: __meta_kubernetes_service_label_(.+) - - source_labels: [__meta_kubernetes_service_namespace] - target_label: ns - - source_labels: [__meta_kubernetes_service_name] - target_label: kubernetes_name - - job_name: 'kubernetes-pods' kubernetes_sd_configs: - role: pod diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml index 8ea1ca682..8dfddfe81 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml @@ -28,8 +28,6 @@ spec: metadata: annotations: kubectl.kubernetes.io/default-container: jaeger - prometheus.io/port: "16686" - sourcegraph.prometheus/scrape: "true" {{- if not .Values.jaeger.config.existingConfigMap }} checksum/jaeger-config: {{ include (print $.Template.BasePath "/jaeger/jaeger.ConfigMap.yaml") . | sha256sum }} {{- end }} diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml index 9d5f789b8..7a0c2e738 100644 --- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml +++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml @@ -187,40 +187,6 @@ data: regex: ^$ action: drop - # Example scrape config for probing services via the Blackbox Exporter. - # - # The relabeling allows the actual service scrape endpoint to be configured - # via the following annotations: - # - # * `prometheus.io/probe`: Only probe services that have a value of `true` - - job_name: 'kubernetes-services' - - metrics_path: /probe - params: - module: [http_2xx] - - kubernetes_sd_configs: - - role: service - - relabel_configs: - - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe] - action: keep - regex: true - - source_labels: [__address__] - target_label: __param_target - - target_label: __address__ - replacement: blackbox - - source_labels: [__param_target] - target_label: instance - - action: labelmap - regex: __meta_kubernetes_service_label_(.+) - - source_labels: [__meta_kubernetes_service_namespace] - # Sourcegraph specific customization. We want a more convenient to type label. - # target_label: kubernetes_namespace - target_label: ns - - source_labels: [__meta_kubernetes_service_name] - target_label: kubernetes_name - # Example scrape config for pods # # The relabeling allows the actual pod scrape endpoint to be configured via the