From 3529294e2e0fe33fd4c9554633a19ebc0dba5d58 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Fri, 13 Nov 2026 01:12:40 -0600 Subject: [PATCH 01/14] Document the top-level nameOverride the charts read All four charts documented sourcegraph.nameOverride, but sourcegraph.name reads the top-level nameOverride, so the documented key did nothing. Document the top-level key, which is the Helm convention and what a parent chart sets for a subchart, and remove the unused one. Renders do not change. The subchart example aliases the chart as sg, which replaces the chart name in the app.kubernetes.io/name selector label. It now sets sg.nameOverride: sourcegraph to keep the selectors of a standalone install. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d360-e0b4-71d1-8ded-2e4851b93a8d --- charts/sourcegraph-executor/CHANGELOG.md | 1 + charts/sourcegraph-executor/dind/README.md | 2 +- charts/sourcegraph-executor/dind/values.yaml | 8 ++++++-- charts/sourcegraph-executor/k8s/README.md | 2 +- charts/sourcegraph-executor/k8s/values.yaml | 8 ++++++-- charts/sourcegraph-migrator/README.md | 2 +- charts/sourcegraph-migrator/values.yaml | 8 ++++++-- charts/sourcegraph/CHANGELOG.md | 1 + charts/sourcegraph/README.md | 2 +- charts/sourcegraph/examples/subchart/values.yaml | 3 +++ charts/sourcegraph/tests/selectorLabels_test.yaml | 12 ++++++++++++ charts/sourcegraph/values.yaml | 8 ++++++-- 12 files changed, 45 insertions(+), 12 deletions(-) diff --git a/charts/sourcegraph-executor/CHANGELOG.md b/charts/sourcegraph-executor/CHANGELOG.md index 5e2f4fb18..6cd162be8 100644 --- a/charts/sourcegraph-executor/CHANGELOG.md +++ b/charts/sourcegraph-executor/CHANGELOG.md @@ -3,6 +3,7 @@ ## Unreleased +- Fixed the documentation of `nameOverride` in the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts. It was documented as `sourcegraph.nameOverride`, which the charts never read, so setting it had no effect. The charts read the top-level `nameOverride`, which replaces the chart name in the `app.kubernetes.io/name` selector label. Set it only on a new install, because Kubernetes does not allow changing a selector. If you set `sourcegraph.nameOverride`, remove it; moving its value to `nameOverride` changes your selectors. ## 8.0.0 * Added a `network-policy` example to the `sourcegraph-executor-k8s` and `sourcegraph-executor-dind` charts, with `CiliumNetworkPolicy` resources which limit Executor and job pods to the frontend API. diff --git a/charts/sourcegraph-executor/dind/README.md b/charts/sourcegraph-executor/dind/README.md index 14bff60a9..5b6415df0 100644 --- a/charts/sourcegraph-executor/dind/README.md +++ b/charts/sourcegraph-executor/dind/README.md @@ -85,6 +85,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.storage.class | string | `""` | StorageClass for the ephemeral volume. Only used when type is ephemeral. Defaults to the cluster default StorageClass when empty. | | executor.storage.size | string | `""` | Size of the scratch volume. emptyDir: sets sizeLimit (optional, leave empty for unlimited). ephemeral: sets the PVC storage request (required). | | executor.storage.type | string | `"emptyDir"` | Type of scratch volume for job workspaces. One of: emptyDir, ephemeral. emptyDir: plain emptyDir, no storage class required. ephemeral: per-pod PVC via the cluster default storage class; size is required. | +| nameOverride | string | `""` | Replaces the chart name in the `app.kubernetes.io/name` label, which every selector uses. Set it only on a new install: Kubernetes does not allow changing a selector. As a subchart with an `alias`, the alias replaces the chart name; set `.nameOverride: sourcegraph-executor-dind` in the parent chart to keep the selectors of a standalone install. | | privateDockerRegistry.enabled | bool | `true` | Whether to deploy the private registry. Only one registry is needed when deploying multiple executors. More information: https://sourcegraph.com/docs/self-hosted/executors/deploy-executors#using-private-registries | | privateDockerRegistry.env | object | `{"REGISTRY_PROXY_REMOTEURL":{"value":"https://registry-1.docker.io"}}` | Extra environment variables to set on the registry container. Registry can be configured with environment variables using the pattern REGISTRY_
_ (uppercase). Full reference: https://distribution.github.io/distribution/about/configuration To proxy an internal private registry with credentials, override REGISTRY_PROXY_REMOTEURL and supply REGISTRY_PROXY_USERNAME / REGISTRY_PROXY_PASSWORD, e.g.: env: REGISTRY_PROXY_REMOTEURL: value: https://my-internal-registry.example.com REGISTRY_PROXY_USERNAME: value: myuser REGISTRY_PROXY_PASSWORD: valueFrom: secretKeyRef: name: registry-proxy-credentials key: password | | privateDockerRegistry.image.registry | string | `"index.docker.io"` | | @@ -99,7 +100,6 @@ In addition to the documented values, the `executor` and `private-docker-registr | sourcegraph.image.useGlobalTagAsDefault | bool | `false` | When set to true, sourcegraph.image.defaultTag is used as the default defaultTag for all services, instead of service-specific default defaultTags | | sourcegraph.imagePullSecrets | list | `[]` | Mount named secrets containing docker credentials | | sourcegraph.labels | object | `{}` | Add a global label to all resources | -| sourcegraph.nameOverride | string | `""` | Set a custom name for the app.kubernetes.io/name annotation | | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | diff --git a/charts/sourcegraph-executor/dind/values.yaml b/charts/sourcegraph-executor/dind/values.yaml index 571ebe624..acc2858c9 100644 --- a/charts/sourcegraph-executor/dind/values.yaml +++ b/charts/sourcegraph-executor/dind/values.yaml @@ -1,5 +1,11 @@ # These values are derived from https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/values.yaml +# -- Replaces the chart name in the `app.kubernetes.io/name` label, which every selector uses. +# Set it only on a new install: Kubernetes does not allow changing a selector. +# As a subchart with an `alias`, the alias replaces the chart name; set `.nameOverride: sourcegraph-executor-dind` +# in the parent chart to keep the selectors of a standalone install. +nameOverride: "" + ### Common Configuration ### sourcegraph: image: @@ -16,8 +22,6 @@ sourcegraph: imagePullSecrets: [] # -- Add a global label to all resources labels: {} - # -- Set a custom name for the app.kubernetes.io/name annotation - nameOverride: "" # -- Affinity, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) affinity: {} diff --git a/charts/sourcegraph-executor/k8s/README.md b/charts/sourcegraph-executor/k8s/README.md index 67bae6cc3..0857a590d 100644 --- a/charts/sourcegraph-executor/k8s/README.md +++ b/charts/sourcegraph-executor/k8s/README.md @@ -104,6 +104,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.securityContext.runAsGroup | string | `nil` | DEPRECATED: Use `executor.containerSecurityContext` or `executor.podSecurityContext` instead. | | executor.securityContext.runAsUser | string | `nil` | DEPRECATED: Use `executor.containerSecurityContext` or `executor.podSecurityContext` instead. | | executor.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | +| nameOverride | string | `""` | Replaces the chart name in the `app.kubernetes.io/name` label, which every selector uses. Set it only on a new install: Kubernetes does not allow changing a selector. As a subchart with an `alias`, the alias replaces the chart name; set `.nameOverride: sourcegraph-executor-k8s` in the parent chart to keep the selectors of a standalone install. | | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | | sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag | | sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy | @@ -112,7 +113,6 @@ In addition to the documented values, the `executor` and `private-docker-registr | sourcegraph.imagePullSecrets | list | `[]` | Mount named secrets containing docker credentials | | sourcegraph.labels | object | `{}` | Add a global label to all resources | | sourcegraph.localDevMode | bool | `false` | When true, remove all resource stanzas, allowing the scheduler to best-fit pods. Intended for local development with limited resources. | -| sourcegraph.nameOverride | string | `""` | Set a custom name for the app.kubernetes.io/name annotation | | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | diff --git a/charts/sourcegraph-executor/k8s/values.yaml b/charts/sourcegraph-executor/k8s/values.yaml index b55767725..0f4d024b3 100644 --- a/charts/sourcegraph-executor/k8s/values.yaml +++ b/charts/sourcegraph-executor/k8s/values.yaml @@ -1,5 +1,11 @@ # These values are derived from https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/values.yaml +# -- Replaces the chart name in the `app.kubernetes.io/name` label, which every selector uses. +# Set it only on a new install: Kubernetes does not allow changing a selector. +# As a subchart with an `alias`, the alias replaces the chart name; set `.nameOverride: sourcegraph-executor-k8s` +# in the parent chart to keep the selectors of a standalone install. +nameOverride: "" + ### Common Configuration ### sourcegraph: image: @@ -18,8 +24,6 @@ sourcegraph: labels: { } # -- When true, remove all resource stanzas, allowing the scheduler to best-fit pods. Intended for local development with limited resources. localDevMode: false - # -- Set a custom name for the app.kubernetes.io/name annotation - nameOverride: "" # -- Affinity, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) affinity: { } diff --git a/charts/sourcegraph-migrator/README.md b/charts/sourcegraph-migrator/README.md index eba7f0ecd..627f37db2 100644 --- a/charts/sourcegraph-migrator/README.md +++ b/charts/sourcegraph-migrator/README.md @@ -83,6 +83,7 @@ In addition to the documented values, the `migrator` service also supports the f | migrator.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `migrator` image | | migrator.image.name | string | `"migrator"` | Docker image name for the `migrator` image | | migrator.resources | object | `{"limits":{"cpu":"500m","memory":"100M"},"requests":{"cpu":"100m","memory":"50M"}}` | Resource requests & limits for the `migrator` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | +| nameOverride | string | `""` | Replaces the chart name in the `app.kubernetes.io/name` label, which every selector uses. Set it only on a new install: Kubernetes does not allow changing a selector. As a subchart with an `alias`, the alias replaces the chart name; set `.nameOverride: sourcegraph-migrator` in the parent chart to keep the selectors of a standalone install. | | pgsql.auth.existingSecret | string | `""` | Name of existing secret to use for pgsql credentials This should match the setting in the sourcegraph chart values | | pgsql.name | string | `"pgsql"` | | | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | @@ -92,7 +93,6 @@ In addition to the documented values, the `migrator` service also supports the f | sourcegraph.image.useGlobalTagAsDefault | bool | `false` | When set to true, sourcegraph.image.defaultTag is used as the default defaultTag for all services, instead of service-specific default defaultTags | | sourcegraph.imagePullSecrets | list | `[]` | Mount named secrets containing docker credentials | | sourcegraph.labels | object | `{}` | Add a global label to all resources | -| sourcegraph.nameOverride | string | `""` | Set a custom name for the app.kubernetes.io/name annotation | | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | diff --git a/charts/sourcegraph-migrator/values.yaml b/charts/sourcegraph-migrator/values.yaml index 0274af9b3..420f05349 100644 --- a/charts/sourcegraph-migrator/values.yaml +++ b/charts/sourcegraph-migrator/values.yaml @@ -1,5 +1,11 @@ # These values are derived from https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/values.yaml +# -- Replaces the chart name in the `app.kubernetes.io/name` label, which every selector uses. +# Set it only on a new install: Kubernetes does not allow changing a selector. +# As a subchart with an `alias`, the alias replaces the chart name; set `.nameOverride: sourcegraph-migrator` +# in the parent chart to keep the selectors of a standalone install. +nameOverride: "" + ### Common Configuration ### sourcegraph: image: @@ -16,8 +22,6 @@ sourcegraph: imagePullSecrets: [] # -- Add a global label to all resources labels: {} - # -- Set a custom name for the app.kubernetes.io/name annotation - nameOverride: "" # -- Affinity, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) affinity: {} diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index a8b444320..a8f6e21ce 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -8,6 +8,7 @@ Use `**BREAKING**:` to denote a breaking change ## Unreleased +- Fixed the documentation of `nameOverride` in the `sourcegraph` and `sourcegraph-migrator` charts. It was documented as `sourcegraph.nameOverride`, which the charts never read, so setting it had no effect. The charts read the top-level `nameOverride`, which replaces the chart name in the `app.kubernetes.io/name` selector label. Set it only on a new install, because Kubernetes does not allow changing a selector. If you set `sourcegraph.nameOverride`, remove it; moving its value to `nameOverride` changes your selectors. As a subchart with an `alias`, the alias replaces the chart name; the `subchart` example now sets `sg.nameOverride: sourcegraph` to keep the selectors of a standalone install. - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply. - Added `sourcegraph.selectorLabelsOverride`, `.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads). - Fixed `frontend.command` and `migrator.command` rendering a list as a single element, e.g. `["sh", "-c", "