From 9d871d84d0dec306b535509f50d56f6c6b741046 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 19:12:14 -0600 Subject: [PATCH 1/5] Remove unused otel-agent zpages hostPort and dind port 2375 Neither port has a listener reachable from outside its pod: - otel-agent zpages binds localhost:55679, so hostPort 55679 only reserved the port on every node - dockerd in the dind sidecar binds 127.0.0.1:2375, and the executor reaches it over localhost Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph-executor/CHANGELOG.md | 2 ++ .../dind/templates/_helpers.tpl | 3 --- charts/sourcegraph/CHANGELOG.md | 2 ++ charts/sourcegraph/README.md | 2 +- .../otel-collector/otel-agent.DaemonSet.yaml | 3 --- .../sourcegraph/tests/otelAgentHostPort_test.yaml | 14 -------------- charts/sourcegraph/values.yaml | 1 - 7 files changed, 5 insertions(+), 22 deletions(-) diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md index 5e2f4fb18..ac7834775 100644 --- a/charts/sourcegraph-executor/CHANGELOG.md +++ b/charts/sourcegraph-executor/CHANGELOG.md @@ -3,6 +3,8 @@ ## Unreleased +* Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only (`dind.daemonConfig.hosts`), the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. + ## 8.0.0 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API. diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl index 8b87b5d24..69009566c 100644 --- a/charts/sourcegraph-executor/dind/templates/_helpers.tpl +++ b/charts/sourcegraph-executor/dind/templates/_helpers.tpl @@ -296,9 +296,6 @@ spec: fieldRef: apiVersion: v1 fieldPath: metadata.name - ports: - - containerPort: 2375 - protocol: TCP volumeMounts: - mountPath: /scratch name: executor-scratch diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index f4bf662f3..8e6a7b55c 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -21,6 +21,8 @@ Use `**BREAKING**:` to denote a breaking change - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence. - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. +- Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/ 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade. +- Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. ## 8.1.0 diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index 5bcea2ada..e6b00b058 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -283,7 +283,7 @@ In addition to the documented values, all services also support the following va | openTelemetry.agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | openTelemetry.agent.containerSecurityContext.runAsGroup | int | `101` | | | openTelemetry.agent.containerSecurityContext.runAsUser | int | `100` | | -| openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318,"httpZpages":55679}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | +| openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | openTelemetry.agent.kind | string | `"DaemonSet"` | The workload kind for the otel-agent. Valid values are `DaemonSet` and `Deployment`. Use `Deployment` in environments where DaemonSets are restricted (e.g. some managed Kubernetes offerings). When set to `Deployment`, the otel-agent DaemonSet is not created and application pods send traces directly to the existing otel-collector Deployment (otel-collector:4317) instead. | | openTelemetry.agent.name | string | `"otel-agent"` | Name used by resources. Does not affect service names or PVCs. | | openTelemetry.agent.resources.limits.cpu | string | `"500m"` | | diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml index 34e3c7ef2..9d2507509 100644 --- a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml +++ b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml @@ -79,9 +79,6 @@ spec: - name: http-otlp containerPort: 4318 hostPort: {{ toYaml .Values.openTelemetry.agent.hostPorts.httpOtlp }} - - name: http-zpages - containerPort: 55679 - hostPort: {{ toYaml .Values.openTelemetry.agent.hostPorts.httpZpages }} volumeMounts: - name: config mountPath: /etc/otel-agent diff --git a/charts/sourcegraph/tests/otelAgentHostPort_test.yaml b/charts/sourcegraph/tests/otelAgentHostPort_test.yaml index 0d4b00564..5a5889e2e 100644 --- a/charts/sourcegraph/tests/otelAgentHostPort_test.yaml +++ b/charts/sourcegraph/tests/otelAgentHostPort_test.yaml @@ -4,12 +4,6 @@ tests: - it: should use the default host ports when not defined in values template: otel-collector/otel-agent.DaemonSet.yaml asserts: - - contains: - path: spec.template.spec.containers[0].ports - content: - containerPort: 55679 - hostPort: 55679 - name: http-zpages - contains: path: spec.template.spec.containers[0].ports content: @@ -38,14 +32,7 @@ tests: hostPorts: grpcOtlp: 4319 httpOtlp: 4320 - httpZpages: 55680 asserts: - - contains: - path: spec.template.spec.containers[0].ports - content: - containerPort: 55679 - hostPort: 55680 - name: http-zpages - contains: path: spec.template.spec.containers[0].ports content: @@ -66,7 +53,6 @@ tests: hostPorts: grpcOtlp: 4319 httpOtlp: 4320 - httpZpages: 55680 asserts: - contains: path: spec.template.spec.containers[0].env diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 99823dc9c..265cc6a96 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -777,7 +777,6 @@ openTelemetry: hostPorts: grpcOtlp: 4317 httpOtlp: 4318 - httpZpages: 55679 resources: limits: cpu: "500m" From a12356d7dd25fb584ccb60059afef594deb46aa7 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 22:22:01 -0600 Subject: [PATCH 2/5] Remove Jaeger's unused remote_sampling extension and port 5778 Nothing ever asked Jaeger for sampling strategies: no Service exposed 5778, Sourcegraph and zoekt used a constant sampler while they had Jaeger clients, and both use OpenTelemetry since Sourcegraph 4.0. jaeger.config.samplingDefaultProbability is removed with it. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 1 + charts/sourcegraph/README.md | 3 +-- charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml | 8 +------- .../sourcegraph/templates/jaeger/jaeger.Deployment.yaml | 2 -- charts/sourcegraph/values.yaml | 2 -- 5 files changed, 3 insertions(+), 13 deletions(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index 8e6a7b55c..facb9aff0 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -22,6 +22,7 @@ Use `**BREAKING**:` to denote a breaking change - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. - Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. - Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/ 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade. +- Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade. - Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. ## 8.1.0 diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index e6b00b058..a0b07ee8f 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -243,11 +243,10 @@ In addition to the documented values, all services also support the following va | jaeger.collector.serviceAnnotations | object | `{}` | Add extra annotations to jaeger `collector` service | | jaeger.collector.serviceLabels | object | `{}` | Add extra labels to jaeger `collector` service | | jaeger.collector.serviceType | string | "ClusterIP" | Kubernetes service type of jaeger `collector` service, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) | -| jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000,"samplingDefaultProbability":1}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. | +| jaeger.config | object | `{"existingConfigMap":"","logLevel":"info","maxTraces":20000}` | Jaeger v2 configuration overrides. We only provide a limited number of options, use `existingConfigMap` to provide a full config if you need more control. | | jaeger.config.existingConfigMap | string | `""` | Name of an preexisting ConfigMap containing Jaeger configuration. They must contain a `jaeger-config.yaml` key. If set, this will be used instead of the `config` values below. See https://www.jaegertracing.io/docs/2.16/configuration/ | | jaeger.config.logLevel | string | `"info"` | Log level for the Jaeger instance (debug, info, warn, error) | | jaeger.config.maxTraces | int | `20000` | Maximum number of traces stored in memory | -| jaeger.config.samplingDefaultProbability | float | `1` | Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config | | jaeger.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `jaeger` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | jaeger.enabled | bool | `false` | Enable `jaeger` | | jaeger.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `jaeger` image | diff --git a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml index 7e2a388cf..11df6f30e 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.ConfigMap.yaml @@ -11,7 +11,7 @@ metadata: data: jaeger-config.yaml: | service: - extensions: [jaeger_storage, jaeger_query, remote_sampling, healthcheckv2] + extensions: [jaeger_storage, jaeger_query, healthcheckv2] pipelines: traces: receivers: [otlp] @@ -36,12 +36,6 @@ data: base_path: "/-/debug/jaeger" http: endpoint: "0.0.0.0:16686" - remote_sampling: - file: - path: /etc/jaeger/sampling_strategies.json - default_sampling_probability: {{ .Values.jaeger.config.samplingDefaultProbability | default 1.0 }} - http: - endpoint: "0.0.0.0:5778" receivers: otlp: protocols: diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml index 856233e29..8ea1ca682 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml @@ -67,8 +67,6 @@ spec: {{- $item | toYaml | nindent 10 }} {{- end }} ports: - - containerPort: 5778 - protocol: TCP - containerPort: 16686 name: http protocol: TCP diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 265cc6a96..814f111f9 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -1452,8 +1452,6 @@ jaeger: maxTraces: 20000 # -- Log level for the Jaeger instance (debug, info, warn, error) logLevel: info - # -- Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config - samplingDefaultProbability: 1.0 # -- Security context for the `jaeger` container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) containerSecurityContext: From 7d37a19764ff963944f19c2ca09963bc7b42662d Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 22:26:01 -0600 Subject: [PATCH 3/5] executor/k8s: drop unused Role verbs and SRC_TRACE_LOG The executor watches Pods, gets pods/log, and creates and deletes Jobs, Secrets, and PVCs. It has not called get or list on Pods, Secrets, or PVCs since Sourcegraph 5.1; 30 days of EKS audit logs on two test instances show no such calls. SRC_TRACE_LOG has been unread since Sourcegraph 5.2. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph-executor/CHANGELOG.md | 2 ++ charts/sourcegraph-executor/k8s/README.md | 1 - .../k8s/templates/executor.ConfigMap.yaml | 1 - .../k8s/templates/executor.Role.yaml | 9 +++++---- charts/sourcegraph-executor/k8s/values.yaml | 1 - charts/sourcegraph/CHANGELOG.md | 1 + 6 files changed, 8 insertions(+), 7 deletions(-) diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md index ac7834775..41fcfb288 100644 --- a/charts/sourcegraph-executor/CHANGELOG.md +++ b/charts/sourcegraph-executor/CHANGELOG.md @@ -4,6 +4,8 @@ ## Unreleased * Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only (`dind.daemonConfig.hosts`), the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. +* Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1, before this chart existed. +* Removed `SRC_TRACE_LOG` from the Kubernetes-native executor's ConfigMap, and the `executor.log.trace` value that set it. Nothing has read `SRC_TRACE_LOG` since Sourcegraph 5.2. ## 8.0.0 diff --git a/charts/sourcegraph-executor/k8s/README.md b/charts/sourcegraph-executor/k8s/README.md index 67bae6cc3..5c6c6a4d2 100644 --- a/charts/sourcegraph-executor/k8s/README.md +++ b/charts/sourcegraph-executor/k8s/README.md @@ -86,7 +86,6 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.kubernetesJob.runAsUser | int | `nil`; accepts [0, 2147483647] | The user ID to run Kubernetes jobs as. | | executor.log.format | string | `"condensed"` | | | executor.log.level | string | `"warn"` | Possible values are `dbug`, `info`, `warn`, `eror`, `crit`. | -| executor.log.trace | string | `"false"` | | | executor.maximumNumJobs | int | `10` | The maximum amount of jobs that can be executed concurrently. | | executor.maximumRuntimePerJob | string | `"30m"` | | | executor.namespace | string | `"default"` | The namespace in which jobs are generated by the executor. | diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml index 6e773607b..67316cb82 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml @@ -14,7 +14,6 @@ data: SRC_LOG_LEVEL: "{{ .Values.executor.log.level }}" SRC_LOG_FORMAT: "{{ .Values.executor.log.format }}" - SRC_TRACE_LOG: "{{ .Values.executor.log.trace }}" EXECUTOR_KUBERNETES_NAMESPACE: "{{ .Values.executor.namespace }}" EXECUTOR_KUBERNETES_CONFIG_PATH: "{{ .Values.executor.kubeconfigPath }}" diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml index 7a3d1ef4d..873dbcf5d 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.Role.yaml @@ -20,19 +20,20 @@ rules: - "" resources: - pods + verbs: + - watch + - apiGroups: + - "" + resources: - pods/log verbs: - get - - list - - watch - apiGroups: - "" resources: - secrets - persistentvolumeclaims verbs: - - get - - list - create - delete {{- end }} diff --git a/charts/sourcegraph-executor/k8s/values.yaml b/charts/sourcegraph-executor/k8s/values.yaml index b55767725..42637aafd 100644 --- a/charts/sourcegraph-executor/k8s/values.yaml +++ b/charts/sourcegraph-executor/k8s/values.yaml @@ -75,7 +75,6 @@ executor: # -- Possible values are `dbug`, `info`, `warn`, `eror`, `crit`. level: "warn" format: "condensed" - trace: "false" # -- The namespace in which jobs are generated by the executor. namespace: "default" diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index facb9aff0..a93d0972d 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -24,6 +24,7 @@ Use `**BREAKING**:` to denote a breaking change - Removed the unused `http-zpages` port (55679) and its `hostPort` from the `otel-agent` DaemonSet. The agent's zpages extension listens on `localhost` only, so the port has never been reachable from outside the pod; it only reserved port 55679 on every node. zpages is still available with `kubectl port-forward pod/ 55679`. `openTelemetry.agent.hostPorts.httpZpages` no longer has any effect, so multiple Sourcegraph instances on one cluster no longer need distinct values for it. The `otel-agent` pods are replaced once on upgrade. - Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade. - Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. +- Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) in `sourcegraph-executor/k8s` to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1. Also removed the unread `SRC_TRACE_LOG` setting and its `executor.log.trace` value. ## 8.1.0 From 31fe350bcc697b10da1cb06cc395b60ed60934f1 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 22:33:55 -0600 Subject: [PATCH 4/5] executor: list the k8s executor's real RBAC rules in the README Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph-executor/README.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/charts/sourcegraph-executor/README.md b/charts/sourcegraph-executor/README.md index 6bc0d8e71..6d084cd4d 100644 --- a/charts/sourcegraph-executor/README.md +++ b/charts/sourcegraph-executor/README.md @@ -11,10 +11,12 @@ This chart deploys executors that interact with the Kubernetes API to handle job Your cluster will need to allow configuration of the following RBAC rules: -| API Groups | Resources | Verbs | Reason | -|------------|--------------------|---------------------------|-------------------------------------------------------------------------------------------| -| `batch` | `jobs` | `create`, `delete` | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. | -| | `pods`, `pods/log` | `get`, `list`, `watch` | Executors need to look up and steam logs from the Job Pods. | +| API Groups | Resources | Verbs | Reason | +|------------|-------------------------------------|--------------------|-------------------------------------------------------------------------------------------| +| `batch` | `jobs` | `create`, `delete` | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. | +| `""` | `pods` | `watch` | Executors watch the Job pods to know when each step finishes. | +| `""` | `pods/log` | `get` | Executors stream logs from the Job pods. | +| `""` | `secrets`, `persistentvolumeclaims` | `create`, `delete` | Executors create a Secret for each job, and a PVC when job volumes use PVCs. | ## Docker in Docker (dind) From 368adf73e11d0af2fcd6c3532cbb5730e6873305 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:02:18 -0600 Subject: [PATCH 5/5] Remove Jaeger's broken scrape annotation and the blackbox probe job The jaeger pod asked Prometheus to scrape port 16686, which serves the UI and returns 404 for /metrics. The kubernetes-services job probed through a blackbox exporter the chart does not ship, and no Service opts in. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 2 ++ .../prometheus-override-k3s.ConfigMap.yaml | 23 ------------- .../templates/jaeger/jaeger.Deployment.yaml | 2 -- .../prometheus/prometheus.ConfigMap.yaml | 34 ------------------- 4 files changed, 2 insertions(+), 59 deletions(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index a93d0972d..6b5e61812 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -25,6 +25,8 @@ Use `**BREAKING**:` to denote a breaking change - Removed Jaeger's `remote_sampling` extension and its container port 5778. It served sampling strategies to Jaeger clients that ask for them, and nothing ever asked: no Service exposed the port, Sourcegraph and zoekt always used a constant sampler while they had Jaeger clients, and they have used OpenTelemetry since Sourcegraph 4.0. `jaeger.config.samplingDefaultProbability` no longer has any effect; trace sampling is set with `observability.tracing.sampling` in site configuration. The `jaeger` pod is replaced once on upgrade. - Removed the unused container port 2375 from the `dind` sidecar in the Docker-in-Docker executor chart (`sourcegraph-executor/dind`). `dockerd` listens on `127.0.0.1:2375` only, the executor reaches it over `localhost`, and no Service targets the port. The executor pod is replaced once on upgrade. - Narrowed the Kubernetes-native executor's Role (`sg-executor-role`) in `sourcegraph-executor/k8s` to the calls the executor makes: `watch` on `pods`, `get` on `pods/log`, and `create` and `delete` on `jobs`, `secrets`, and `persistentvolumeclaims`. It no longer grants `get` and `list` on `pods`, `secrets`, or `persistentvolumeclaims`; executors have not used them since Sourcegraph 5.1. Also removed the unread `SRC_TRACE_LOG` setting and its `executor.log.trace` value. +- Removed the Prometheus scrape annotations from the `jaeger` pod. They pointed Prometheus at port 16686, which serves the Jaeger UI and returns 404 for `/metrics`, so the scrape always failed. The `jaeger` pod is replaced once on upgrade. +- Removed the `kubernetes-services` scrape job from the built-in Prometheus configuration and the k3s example override. It probed Services annotated `prometheus.io/probe: "true"` through a `blackbox` exporter that the chart does not ship, and no Service carries that annotation, so it never produced data. ## 8.1.0 diff --git a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml index 5343dee1d..cde60295a 100644 --- a/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml +++ b/charts/sourcegraph/examples/prometheus/prometheus-override-k3s.ConfigMap.yaml @@ -113,29 +113,6 @@ data: action: replace target_label: instance - - job_name: 'kubernetes-services' - metrics_path: /probe - params: - module: [http_2xx] - kubernetes_sd_configs: - - role: service - relabel_configs: - - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe] - action: keep - regex: true - - source_labels: [__address__] - target_label: __param_target - - target_label: __address__ - replacement: blackbox - - source_labels: [__param_target] - target_label: instance - - action: labelmap - regex: __meta_kubernetes_service_label_(.+) - - source_labels: [__meta_kubernetes_service_namespace] - target_label: ns - - source_labels: [__meta_kubernetes_service_name] - target_label: kubernetes_name - - job_name: 'kubernetes-pods' kubernetes_sd_configs: - role: pod diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml index 8ea1ca682..8dfddfe81 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml @@ -28,8 +28,6 @@ spec: metadata: annotations: kubectl.kubernetes.io/default-container: jaeger - prometheus.io/port: "16686" - sourcegraph.prometheus/scrape: "true" {{- if not .Values.jaeger.config.existingConfigMap }} checksum/jaeger-config: {{ include (print $.Template.BasePath "/jaeger/jaeger.ConfigMap.yaml") . | sha256sum }} {{- end }} diff --git a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml index 9d5f789b8..7a0c2e738 100644 --- a/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml +++ b/charts/sourcegraph/templates/prometheus/prometheus.ConfigMap.yaml @@ -187,40 +187,6 @@ data: regex: ^$ action: drop - # Example scrape config for probing services via the Blackbox Exporter. - # - # The relabeling allows the actual service scrape endpoint to be configured - # via the following annotations: - # - # * `prometheus.io/probe`: Only probe services that have a value of `true` - - job_name: 'kubernetes-services' - - metrics_path: /probe - params: - module: [http_2xx] - - kubernetes_sd_configs: - - role: service - - relabel_configs: - - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe] - action: keep - regex: true - - source_labels: [__address__] - target_label: __param_target - - target_label: __address__ - replacement: blackbox - - source_labels: [__param_target] - target_label: instance - - action: labelmap - regex: __meta_kubernetes_service_label_(.+) - - source_labels: [__meta_kubernetes_service_namespace] - # Sourcegraph specific customization. We want a more convenient to type label. - # target_label: kubernetes_namespace - target_label: ns - - source_labels: [__meta_kubernetes_service_name] - target_label: kubernetes_name - # Example scrape config for pods # # The relabeling allows the actual pod scrape endpoint to be configured via the