fix/resources: Drop unused ports, Services, Role verbs, and settings

charts/sourcegraph-executor/CHANGELOG.md

@@ -3,6 +3,11 @@
 <!-- START CHANGELOG -->
 ## Unreleased
 
+* Removed the unused `http-debug` container port (6060) and the `executor-<queueName>` Service from the Kubernetes-native executor chart (`sourcegraph-executor/k8s`). Nothing listens on that port: executors stopped serving it in Sourcegraph 4.1, before this chart existed. Helm deletes the Service on upgrade. The undocumented `executor.serviceAnnotations`, `executor.serviceLabels`, and `executor.serviceType` values no longer have any effect. Executor metrics are unaffected; `worker` serves them through the `worker-executors` Service.
+* Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only (`dind.daemonConfig.hosts`), the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade.
+* Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1, before this chart existed.
+* Removed `SRC_TRACE_LOG` from the Kubernetes-native executor's ConfigMap, and the `executor.log.trace` value that set it. Nothing has read `SRC_TRACE_LOG` since Sourcegraph 5.2.
+
 ## 8.0.0
 
 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API.

charts/sourcegraph-executor/README.md

@@ -11,10 +11,12 @@ This chart deploys executors that interact with the Kubernetes API to handle job
 
 Your cluster will need to allow configuration of the following RBAC rules:
 
-| API Groups | Resources          | Verbs                     | Reason                                                                                    |
-|------------|--------------------|---------------------------|-------------------------------------------------------------------------------------------|
-| `batch`    | `jobs`             | `create`, `delete`        | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. |
-|            | `pods`, `pods/log` | `get`, `list`, `watch`    | Executors need to look up and steam logs from the Job Pods.                               |
+| API Groups | Resources                           | Verbs              | Reason                                                                                    |
+|------------|-------------------------------------|--------------------|-------------------------------------------------------------------------------------------|
+| `batch`    | `jobs`                              | `create`, `delete` | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. |
+| `""`       | `pods`                              | `watch`            | Executors watch the Job pods to know when each step finishes.                             |
+| `""`       | `pods/log`                          | `get`              | Executors stream logs from the Job pods.                                                  |
+| `""`       | `secrets`, `persistentvolumeclaims` | `create`, `delete` | Executors create a Secret for each job, and a PVC when job volumes use PVCs.              |
 
 ## Docker in Docker (dind)
 

charts/sourcegraph-executor/dind/templates/_helpers.tpl

@@ -296,9 +296,6 @@ spec:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
-          ports:
-            - containerPort: 2375
-              protocol: TCP
           volumeMounts:
             - mountPath: /scratch
               name: executor-scratch

charts/sourcegraph-executor/k8s/README.md

@@ -86,7 +86,6 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | executor.kubernetesJob.runAsUser | int | `nil`; accepts [0, 2147483647] | The user ID to run Kubernetes jobs as. |
 | executor.log.format | string | `"condensed"` |  |
 | executor.log.level | string | `"warn"` | Possible values are `dbug`, `info`, `warn`, `eror`, `crit`. |
-| executor.log.trace | string | `"false"` |  |
 | executor.maximumNumJobs | int | `10` | The maximum amount of jobs that can be executed concurrently. |
 | executor.maximumRuntimePerJob | string | `"30m"` |  |
 | executor.namespace | string | `"default"` | The namespace in which jobs are generated by the executor. |

charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml

@@ -14,7 +14,6 @@ data:
 
   SRC_LOG_LEVEL: "{{ .Values.executor.log.level }}"
   SRC_LOG_FORMAT: "{{ .Values.executor.log.format }}"
-  SRC_TRACE_LOG: "{{ .Values.executor.log.trace }}"
 
   EXECUTOR_KUBERNETES_NAMESPACE: "{{ .Values.executor.namespace }}"
   EXECUTOR_KUBERNETES_CONFIG_PATH: "{{ .Values.executor.kubeconfigPath }}"

charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml

@@ -67,9 +67,6 @@ spec:
           imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.executor.containerSecurityContext | nindent 12 }}
-          ports:
-            - name: http-debug
-              containerPort: 6060
           envFrom:
             - configMapRef:
                 name: {{ include "executor.name" . }}

charts/sourcegraph-executor/k8s/templates/executor.Role.yaml

@@ -20,19 +20,20 @@ rules:
       - ""
     resources:
       - pods
+    verbs:
+      - watch
+  - apiGroups:
+      - ""
+    resources:
       - pods/log
     verbs:
       - get
-      - list
-      - watch
   - apiGroups:
       - ""
     resources:
       - secrets
       - persistentvolumeclaims
     verbs:
-      - get
-      - list
       - create
       - delete
 {{- end }}

charts/sourcegraph-executor/k8s/tests/executor_test.yaml

@@ -1,10 +1,9 @@
 suite: executor
 templates:
   - executor.Deployment.yaml
-  - executor.Service.yaml
   - executor.ConfigMap.yaml
 tests:
-  - it: should render the Deployment, Service, ConfigMap if executor is enabled
+  - it: should render the Deployment, ConfigMap if executor is enabled
     set:
       executor:
         queueName: "test"
@@ -14,11 +13,6 @@ tests:
           apiVersion: apps/v1
           name: executor-test
         template: executor.Deployment.yaml
-      - containsDocument:
-          kind: Service
-          apiVersion: v1
-          name: executor-test
-        template: executor.Service.yaml
       - containsDocument:
           kind: ConfigMap
           apiVersion: v1

charts/sourcegraph-executor/k8s/values.yaml

@@ -75,7 +75,6 @@ executor:
     # -- Possible values are `dbug`, `info`, `warn`, `eror`, `crit`.
     level: "warn"
     format: "condensed"
-    trace: "false"
 
   # -- The namespace in which jobs are generated by the executor.
   namespace: "default"

charts/sourcegraph/CHANGELOG.md

@@ -21,6 +21,13 @@ Use `**BREAKING**:` to denote a breaking change
 - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence.
 - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`.
 - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix.
+- Removed the unused `http-debug` container port (6060) and the `executor-<queueName>` Service from the Kubernetes-native executor chart (`sourcegraph-executor/k8s`). Nothing listens on that port: executors stopped serving it in Sourcegraph 4.1, before this chart existed. Helm deletes the Service on upgrade. The undocumented `executor.serviceAnnotations`, `executor.serviceLabels`, and `executor.serviceType` values no longer have any effect. Executor metrics are unaffected; `worker` serves them through the `worker-executors` Service
+- Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/<otel-agent-pod> 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade.
+- Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade.
+- Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade.
+- Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) in `sourcegraph-executor/k8s` to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1. Also removed the unread `SRC_TRACE_LOG` setting and its `executor.log.trace` value.
+- Removed the Prometheus scrape annotations from the `jaeger` pod. They pointed Prometheus at port 16686, which serves the Jaeger UI and returns 404 for `/metrics`, so the scrape always failed. The `jaeger` pod is replaced once on upgrade.
+- Removed the `kubernetes-services` scrape job from the built-in Prometheus configuration and the k3s example override. It probed Services annotated `prometheus.io/probe: "true"` through a `blackbox` exporter that the chart does not ship, and no Service carries that annotation, so it never produced data.
 
 ## 8.1.0
 

charts/sourcegraph/README.md

@@ -243,11 +243,10 @@ In addition to the documented values, all services also support the following va
 | jaeger.collector.serviceAnnotations | object | `{}` | Add extra annotations to jaeger `collector` service |
 | jaeger.collector.serviceLabels | object | `{}` | Add extra labels to jaeger `collector` service |
 | jaeger.collector.serviceType | string | "ClusterIP" | Kubernetes service type of jaeger `collector` service, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) |
-| jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000,"samplingDefaultProbability":1}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. |
+| jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. |
 | jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. See https://www.jaegertracing.io/docs/2.16/configuration/ |
 | jaeger.config.logLevel | string | `"info"` | Log level for the Jaeger instance (debug, info, warn, error) |
 | jaeger.config.maxTraces | int | `20000` | Maximum number of traces stored in memory |
-| jaeger.config.samplingDefaultProbability | float | `1` | Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config |
 | jaeger.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `jaeger` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | jaeger.enabled | bool | `false` | Enable `jaeger` |
 | jaeger.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `jaeger` image |
@@ -283,7 +282,7 @@ In addition to the documented values, all services also support the following va
 | openTelemetry.agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` |  |
 | openTelemetry.agent.containerSecurityContext.runAsGroup | int | `101` |  |
 | openTelemetry.agent.containerSecurityContext.runAsUser | int | `100` |  |
-| openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318,"httpZpages":55679}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
+| openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
 | openTelemetry.agent.kind | string | `"DaemonSet"` | The workload kind for the otel-agent. Valid values are `DaemonSet` and `Deployment`. Use `Deployment` in environments where DaemonSets are restricted (e.g. some managed Kubernetes offerings). When set to `Deployment`, the otel-agent DaemonSet is not created and application pods send traces directly to the existing otel-collector Deployment (otel-collector:4317) instead. |
 | openTelemetry.agent.name | string | `"otel-agent"` | Name used by resources. Does not affect service names or PVCs. |
 | openTelemetry.agent.resources.limits.cpu | string | `"500m"` |  |

charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml

@@ -113,29 +113,6 @@ data:
         action: replace
         target_label: instance
 
-    - job_name: 'kubernetes-services'
-      metrics_path: /probe
-      params:
-        module: [http_2xx]
-      kubernetes_sd_configs:
-      - role: service
-      relabel_configs:
-      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
-        action: keep
-        regex: true
-      - source_labels: [__address__]
-        target_label: __param_target
-      - target_label: __address__
-        replacement: blackbox
-      - source_labels: [__param_target]
-        target_label: instance
-      - action: labelmap
-        regex: __meta_kubernetes_service_label_(.+)
-      - source_labels: [__meta_kubernetes_service_namespace]
-        target_label: ns
-      - source_labels: [__meta_kubernetes_service_name]
-        target_label: kubernetes_name
-
     - job_name: 'kubernetes-pods'
       kubernetes_sd_configs:
       - role: pod

charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml

@@ -11,7 +11,7 @@ metadata:
 data:
   jaeger-config.yaml: |
     service:
-      extensions: [jaeger_storage, jaeger_query, remote_sampling, healthcheckv2]
+      extensions: [jaeger_storage, jaeger_query, healthcheckv2]
       pipelines:
         traces:
           receivers: [otlp]
@@ -36,12 +36,6 @@ data:
         base_path: "/-/debug/jaeger"
         http:
           endpoint: "0.0.0.0:16686"
-      remote_sampling:
-        file:
-          path: /etc/jaeger/sampling_strategies.json
-          default_sampling_probability: {{ .Values.jaeger.config.samplingDefaultProbability | default 1.0 }}
-        http:
-          endpoint: "0.0.0.0:5778"
     receivers:
       otlp:
         protocols:

charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml

@@ -28,8 +28,6 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: jaeger
-        prometheus.io/port: "16686"
-        sourcegraph.prometheus/scrape: "true"
         {{- if not .Values.jaeger.config.existingConfigMap }}
         checksum/jaeger-config: {{ include (print $.Template.BasePath "/jaeger/jaeger.ConfigMap.yaml") . | sha256sum }}
         {{- end }}
@@ -67,8 +65,6 @@ spec:
           {{- $item | toYaml | nindent 10 }}
         {{- end }}
         ports:
-        - containerPort: 5778
-          protocol: TCP
         - containerPort: 16686
           name: http
           protocol: TCP

charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml

@@ -79,9 +79,6 @@ spec:
           - name: http-otlp
             containerPort: 4318
             hostPort: {{ toYaml .Values.openTelemetry.agent.hostPorts.httpOtlp }}
-          - name: http-zpages
-            containerPort: 55679
-            hostPort: {{ toYaml .Values.openTelemetry.agent.hostPorts.httpZpages }}
         volumeMounts:
           - name: config
             mountPath: /etc/otel-agent

charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml

@@ -187,40 +187,6 @@ data:
         regex: ^$
         action: drop
 
-    # Example scrape config for probing services via the Blackbox Exporter.
-    #
-    # The relabeling allows the actual service scrape endpoint to be configured
-    # via the following annotations:
-    #
-    # * `prometheus.io/probe`: Only probe services that have a value of `true`
-    - job_name: 'kubernetes-services'
-
-      metrics_path: /probe
-      params:
-        module: [http_2xx]
-
-      kubernetes_sd_configs:
-      - role: service
-
-      relabel_configs:
-      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
-        action: keep
-        regex: true
-      - source_labels: [__address__]
-        target_label: __param_target
-      - target_label: __address__
-        replacement: blackbox
-      - source_labels: [__param_target]
-        target_label: instance
-      - action: labelmap
-        regex: __meta_kubernetes_service_label_(.+)
-      - source_labels: [__meta_kubernetes_service_namespace]
-        # Sourcegraph specific customization. We want a more convenient to type label.
-        # target_label: kubernetes_namespace
-        target_label: ns
-      - source_labels: [__meta_kubernetes_service_name]
-        target_label: kubernetes_name
-
     # Example scrape config for pods
     #
     # The relabeling allows the actual pod scrape endpoint to be configured via the