sourcegraph: add extraInitContainers and extraServicePorts to every component

charts/sourcegraph/CHANGELOG.md

@@ -8,6 +8,8 @@ Use `**BREAKING**:` to denote a breaking change
 
 ## Unreleased
 
+- Added `<serviceName>.extraInitContainers` to every workload, rendered before any init containers the chart defines, so e.g. a secrets-fetching init container on `frontend` runs before `migrator`. Use `restartPolicy: Always` for a native sidecar that must be started before the main container, such as one that writes a `grafana` datasource credential file read by `datasources.yml`.
+- Added `<serviceName>.extraServicePorts` to append ports to each component's primary Service (`sourcegraph-frontend`, `indexed-search`, and `worker`, not `sourcegraph-frontend-internal`, `indexed-search-indexer`, or `worker-executors`), e.g. to expose a sidecar's port
 - Removed the hardcoded `PRECISE_CODE_INTEL_UPLOAD_BACKEND=blobstore` and `PRECISE_CODE_INTEL_UPLOAD_AWS_ENDPOINT=http://blobstore:9000` environment variables from `frontend`, `worker`, `precise-code-intel-worker`, and `syntactic-code-intel-worker`. They matched Sourcegraph's built-in defaults, so default deployments are unchanged. `SOURCEGRAPH_UPLOAD_*` in `*.env` is now the only object storage configuration in the chart, as in the `external-object-storage` examples. Previously, with `blobstore.enabled: true`, the chart's values were rendered after `*.env` and overrode any `PRECISE_CODE_INTEL_UPLOAD_*` set there. Helm's three-way merge removes every duplicate of those names on this upgrade, including the `*.env` override, and the override is applied on the next `helm upgrade` after this one, when code-intel uploads switch to its bucket. Before that, make sure the bucket exists, or move the settings to `SOURCEGRAPH_UPLOAD_*`, or remove them. Run a second `helm upgrade` right away to make the switch at a known time.
 - Added `syntacticCodeIntel.storageType`, `syntacticCodeIntel.storageSize`, and `syntacticCodeIntel.storageClassName`, so the `syntactic-code-intel-worker` `/tmp` scratch volume can be a per-pod PVC (generic ephemeral volume) instead of an `emptyDir` on the node boot disk, matching `preciseCodeIntel`. The default remains an unbounded `emptyDir`.
 - Added an `outbound-http-proxy` example, which routes outbound traffic from frontend, worker, and migrator through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`
@@ -27,7 +29,6 @@ Use `**BREAKING**:` to denote a breaking change
 - Added a `network-policy` example, which limits Executor and Executor job pods to the frontend API
 - Corrected the external object storage examples to configure the shared store for frontend, worker, precise code intel, syntactic code intel, gitserver, and searcher, including credentials or workload service accounts as required.
 - Removed the unused application ports from the precise and syntactic code intel worker Deployments and Services; health checks and Prometheus metrics continue to use the debug server on port 6060.
-- Added `grafana.initContainers`, so a native sidecar (`restartPolicy: Always`) can be started before `grafana`, e.g. to write a datasource credential file that `datasources.yml` reads with `$__file{}`
 - Added `gitserver.storageAccessModes` (default `["ReadWriteOnce"]`) to allow `["ReadWriteOncePod"]`, which lets Kubernetes mount the repos volume with `-o context` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) instead of recursively relabeling every file on each pod start. Changing this on an existing deployment requires recreating the StatefulSet and PVC, as both fields are immutable.
 - Added configurable pre-shutdown pauses, graceful-shutdown timeouts, and termination grace periods for application services
 - Added optional `syntectServer.podDisruptionBudget` support

charts/sourcegraph/README.md

@@ -81,6 +81,8 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.terminationGracePeriodSeconds` - override `sourcegraph.terminationGracePeriodSeconds` for this service
 - `<serviceName>.args` - override default container args
 - `<serviceName>.env` - consult `values.yaml` file
+- `<serviceName>.extraInitContainers` - add init containers to the pod, which run before any init containers the chart defines
+- `<serviceName>.extraServicePorts` - add ports to the service's primary Service. The OpenTelemetry and Jaeger values are `openTelemetry.gateway.*`, `openTelemetry.agent.extraInitContainers`, `jaeger.extraInitContainers`, `jaeger.collector.extraServicePorts`, and `jaeger.query.extraServicePorts`
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.
@@ -208,7 +210,6 @@ In addition to the documented values, all services also support the following va
 | grafana.existingConfig | string | `""` | Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key. |
 | grafana.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `grafana` image |
 | grafana.image.name | string | `"grafana"` | Docker image name for the `grafana` image |
-| grafana.initContainers | list | `[]` | Init containers for the `grafana` pod. Use `restartPolicy: Always` for a native sidecar that must be started before `grafana`, such as one that writes a datasource credential file read by `datasources.yml` |
 | grafana.name | string | `"grafana"` | Name used by resources. Does not affect service names or PVCs. |
 | grafana.podSecurityContext | object | `{"fsGroup":472,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":472,"runAsUser":472}` | Security context for the `grafana` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) |
 | grafana.resources | object | `{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"100m","memory":"512Mi"}}` | Resource requests & limits for the `grafana` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |

charts/sourcegraph/README.md.gotmpl

@@ -81,6 +81,8 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.terminationGracePeriodSeconds` - override `sourcegraph.terminationGracePeriodSeconds` for this service
 - `<serviceName>.args` - override default container args
 - `<serviceName>.env` - consult `values.yaml` file
+- `<serviceName>.extraInitContainers` - add init containers to the pod, which run before any init containers the chart defines
+- `<serviceName>.extraServicePorts` - add ports to the service's primary Service. The OpenTelemetry and Jaeger values are `openTelemetry.gateway.*`, `openTelemetry.agent.extraInitContainers`, `jaeger.extraInitContainers`, `jaeger.collector.extraServicePorts`, and `jaeger.query.extraServicePorts`
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.

charts/sourcegraph/templates/_worker.tpl

@@ -65,6 +65,10 @@ spec:
         {{- end }}
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list $top "worker") | nindent 6 }}
+      {{- with $top.Values.worker.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: worker
         env:

charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml

@@ -43,6 +43,10 @@ spec:
         deploy: sourcegraph
         app: blobstore
     spec:
+      {{- with .Values.blobstore.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: blobstore
         env:

charts/sourcegraph/templates/blobstore/blobstore.Service.yaml

@@ -19,6 +19,9 @@ spec:
   - name: http
     port: 9000
     targetPort: http
+  {{- with .Values.blobstore.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: blobstore

charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml

@@ -43,6 +43,10 @@ spec:
         app: cadvisor
     spec:
       {{- include "sourcegraph.renderServiceAccountName" (list . "cadvisor") | trim | nindent 6 }}
+      {{- with .Values.cadvisor.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: cadvisor
         image: {{ include "sourcegraph.image" (list . "cadvisor" ) }}

charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml

@@ -24,6 +24,9 @@ spec:
   - name: codeinsights-db
     port: 5432
     targetPort: codeinsights-db
+  {{- with .Values.codeInsightsDB.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: codeinsights-db

charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml

@@ -44,6 +44,9 @@ spec:
         group: backend
     spec:
       initContainers:
+      {{- with .Values.codeInsightsDB.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       - name: correct-data-dir-permissions
         image: {{ include "sourcegraph.image" (list . "alpine") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}

charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml

@@ -24,6 +24,9 @@ spec:
   - name: pgsql
     port: 5432
     targetPort: pgsql
+  {{- with .Values.codeIntelDB.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: codeintel-db

charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml

@@ -44,6 +44,9 @@ spec:
         group: backend
     spec:
       initContainers:
+      {{- with .Values.codeIntelDB.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       - name: correct-data-dir-permissions
         image: {{ include "sourcegraph.image" (list . "alpine") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}

charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml

@@ -49,6 +49,9 @@ spec:
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "frontend") | nindent 6 }}
       initContainers:
+      {{- with .Values.frontend.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       {{- if .Values.migrator.enabled }}
       - name: migrator
         image: {{ include "sourcegraph.image" (list . "migrator") }}

charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml

@@ -23,6 +23,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.frontend.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: sourcegraph-frontend

charts/sourcegraph/templates/gitserver/gitserver.Service.yaml

@@ -30,6 +30,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.gitserver.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: gitserver

charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml

@@ -44,6 +44,10 @@ spec:
         deploy: sourcegraph
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "gitserver") | nindent 6 }}
+      {{- with .Values.gitserver.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: gitserver
         args: {{- default (list "run") .Values.gitserver.args | toYaml | nindent 8 }}

charts/sourcegraph/templates/grafana/grafana.Service.yaml

@@ -19,6 +19,9 @@ spec:
   - name: http
     port: 30070
     targetPort: http
+  {{- with .Values.grafana.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: grafana

charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml

@@ -42,7 +42,7 @@ spec:
         app: grafana
         deploy: sourcegraph
     spec:
-      {{- with .Values.grafana.initContainers }}
+      {{- with .Values.grafana.extraInitContainers }}
       initContainers:
         {{- toYaml . | nindent 6 }}
       {{- end }}

charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml

@@ -23,6 +23,9 @@ spec:
   - name: grpc
     port: 6070
     targetPort: grpc
+  {{- with .Values.indexedSearch.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: indexed-search

charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml

@@ -41,6 +41,10 @@ spec:
         app: indexed-search
         deploy: sourcegraph
     spec:
+      {{- with .Values.indexedSearch.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: zoekt-webserver
         image: {{ include "sourcegraph.image" (list . "indexedSearch") }}

charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml

@@ -25,6 +25,9 @@ spec:
     port: 4317
     protocol: TCP
     targetPort: grpc-otlp
+  {{- with .Values.jaeger.collector.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.jaeger.selectorLabels" . | nindent 4 }}
     app.kubernetes.io/instance: {{ .Release.Name }}

charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml

@@ -21,6 +21,9 @@ spec:
     port: 16686
     protocol: TCP
     targetPort: http
+  {{- with .Values.jaeger.query.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.jaeger.selectorLabels" . | nindent 4 }}
     app.kubernetes.io/instance: {{ .Release.Name }}

charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml

@@ -52,6 +52,10 @@ spec:
         deploy: sourcegraph
         app.kubernetes.io/component: all-in-one
     spec:
+      {{- with .Values.jaeger.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: jaeger
         image: {{ include "sourcegraph.image" (list . "jaeger") }}

charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml

@@ -44,6 +44,10 @@ spec:
       {{- if .Values.nodeExporter.serviceAccount.create }}
       {{- include "sourcegraph.renderServiceAccountName" (list . "nodeExporter") | trim | nindent 6 }}
       {{- end }}
+      {{- with .Values.nodeExporter.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: node-exporter
         image: {{ include "sourcegraph.image" (list . "nodeExporter" ) }}

charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml

@@ -24,6 +24,9 @@ spec:
   - name: metrics
     port: 9100
     targetPort: metrics
+  {{- with .Values.nodeExporter.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: node-exporter

charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml

@@ -39,6 +39,10 @@ spec:
         deploy: sourcegraph
         app: otel-agent
     spec:
+      {{- with .Values.openTelemetry.agent.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: otel-agent
         image: {{ include "sourcegraph.image" (list . "openTelemetry") }}

charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml

@@ -41,6 +41,10 @@ spec:
         deploy: sourcegraph
         app: otel-collector
     spec:
+      {{- with .Values.openTelemetry.gateway.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: otel-collector
         image: {{ include "sourcegraph.image" (list . "openTelemetry") }}

charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml

@@ -29,6 +29,9 @@ spec:
       port: 4318
       protocol: TCP
       targetPort: http-otlp
+  {{- with .Values.openTelemetry.gateway.extraServicePorts }}
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: otel-collector

charts/sourcegraph/templates/pgsql/pgsql.Service.yaml

@@ -24,6 +24,9 @@ spec:
   - name: pgsql
     port: 5432
     targetPort: pgsql
+  {{- with .Values.pgsql.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: pgsql

charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml

@@ -44,6 +44,9 @@ spec:
         group: backend
     spec:
       initContainers:
+      {{- with .Values.pgsql.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       - name: correct-data-dir-permissions
         image: {{ include "sourcegraph.image" (list . "alpine") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}

charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml

@@ -50,6 +50,10 @@ spec:
       {{- fail (printf "preciseCodeIntel.storageType must be one of emptyDir, pvc; got %q" $storageType) }}
       {{- end }}
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "preciseCodeIntel") | nindent 6 }}
+      {{- with .Values.preciseCodeIntel.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: precise-code-intel-worker
         env:

charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml

@@ -20,6 +20,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.preciseCodeIntel.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: precise-code-intel-worker

charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml

@@ -43,6 +43,10 @@ spec:
         deploy: sourcegraph
         app: prometheus
     spec:
+      {{- with .Values.prometheus.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: prometheus
         image: {{ include "sourcegraph.image" (list . "prometheus") }}

charts/sourcegraph/templates/prometheus/prometheus.Service.yaml

@@ -19,6 +19,9 @@ spec:
   - name: http
     port: 30090
     targetPort: http
+  {{- with .Values.prometheus.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: prometheus

charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml

@@ -49,6 +49,10 @@ spec:
         deploy: sourcegraph
         app: redis-cache
     spec:
+      {{- with .Values.redisCache.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: redis-cache
         image: {{ include "sourcegraph.image" (list . "redisCache") }}

charts/sourcegraph/templates/redis/redis-cache.Service.yaml

@@ -24,6 +24,9 @@ spec:
   - name: redis
     port: 6379
     targetPort: redis
+  {{- with .Values.redisCache.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: redis-cache

charts/sourcegraph/templates/redis/redis-store.Deployment.yaml

@@ -49,6 +49,10 @@ spec:
         deploy: sourcegraph
         app: redis-store
     spec:
+      {{- with .Values.redisStore.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: redis-store
         image: {{ include "sourcegraph.image" (list . "redisStore") }}

charts/sourcegraph/templates/redis/redis-store.Service.yaml

@@ -24,6 +24,9 @@ spec:
   - name: redis
     port: 6379
     targetPort: redis
+  {{- with .Values.redisStore.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: redis-store