diff --git a/charts/sourcegraph-executor/dind/README.md b/charts/sourcegraph-executor/dind/README.md index 14bff60a9..8c7faeba5 100644 --- a/charts/sourcegraph-executor/dind/README.md +++ b/charts/sourcegraph-executor/dind/README.md @@ -59,7 +59,9 @@ In addition to the documented values, the `executor` and `private-docker-registr | Key | Type | Default | Description | |-----|------|---------|-------------| | dind.command | list | `["dockerd"]` | Command for the dind container. | +| dind.containerSecurityContext | object | `{}` | Override container security context for the dind container. Ignored when gVisor is enabled. | | dind.daemonConfig | object | `{"hosts":["tcp://127.0.0.1:2375"],"insecure-registries":["private-docker-registry:5000"],"mtu":1200,"registry-mirrors":["http://private-docker-registry:5000"],"tls":false}` | Docker daemon configuration passed as daemon.json to the dind sidecar. Learn more from: https://docs.docker.com/reference/cli/dockerd/#on-linux | +| dind.defaultContainerSecurityContext | object | `{"privileged":true}` | Default container security context for the dind container. Ignored when gVisor is enabled. | | dind.gVisor.command | list | `["/bin/sh","-c","ip link del docker0 2>/dev/null || true\necho 1 > /proc/sys/net/ipv4/ip_forward\ndev=$(ip route show default | awk '{for(i=1;i<=NF;i++) if($i==\"dev\"){print $(i+1); exit}}')\naddr=$(ip addr show dev \"$dev\" | awk '/inet /{gsub(/\\/.*/, \"\", $2); print $2; exit}')\niptables-legacy -t nat -A POSTROUTING -o \"$dev\" -j SNAT --to-source \"$addr\" -p tcp || true\niptables-legacy -t nat -A POSTROUTING -o \"$dev\" -j SNAT --to-source \"$addr\" -p udp || true\nexec dockerd\n"]` | Command for the dind container when gVisor is enabled. Overrides dind.command. Prepares the network environment that gVisor does not initialise automatically before handing off to dockerd. | | dind.gVisor.daemonConfig | object | `{"features":{"containerd-snapshotter":false},"ip6tables":false,"iptables":false,"storage-driver":"vfs"}` | Extra daemon.json settings merged into dind.daemonConfig when gVisor is enabled. These defaults configure Docker to work within gVisor's kernel constraints. | | dind.gVisor.enabled | bool | `false` | Enable gVisor sandbox (GKE only). Requires the GKE node pool to have sandbox type set to gvisor. When enabled, sets runtimeClassName: gvisor on executor pods and replaces privileged: true with explicit capabilities — these are intercepted in-sandbox and never granted to the host kernel. See: https://gvisor.dev/docs/tutorials/docker-in-gvisor/ | @@ -67,6 +69,9 @@ In addition to the documented values, the `executor` and `private-docker-registr | dind.image.registry | string | `"index.docker.io"` | | | dind.image.repository | string | `"docker"` | | | dind.image.tag | string | `"29.5.3-dind"` | | +| executor.containerSecurityContext | object | `{}` | Override container security context for the executor container | +| executor.defaultContainerSecurityContext | object | `{}` | Default container security context for the executor container | +| executor.defaultPodSecurityContext | object | `{"fsGroup":101}` | Default pod security context for executor pods. fsGroup: 101 ensures the scratch volume is writable by the sourcegraph user (uid=100, gid=101) when running in Docker mode (dind). Set to {} to disable. | | executor.env | object | `{}` | Extra environment variables to set on the executor container. | | executor.frontendExistingSecret | string | `""` | Name of existing k8s Secret to use for frontend password. The k8s Secret must contain the key EXECUTOR_FRONTEND_PASSWORD matching the site config executors.accessToken value. frontendPassword is ignored if this is set. | | executor.frontendPassword | string | `""` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required if frontendExistingSecret is not configured. | @@ -77,7 +82,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.log.level | string | `"warn"` | Possible values are dbug, info, warn, eror, crit. | | executor.maximumNumJobs | int | `10` | The maximum amount of jobs that can be executed concurrently. | | executor.maximumRuntimePerJob | string | `"30m"` | The maximum wall time that can be spent on a single job. | -| executor.podSecurityContext | object | `{"fsGroup":101}` | Pod-level security context applied to executor pods. fsGroup: 101 ensures the scratch volume is writable by the sourcegraph user (uid=100, gid=101) when running in Docker mode (dind). Set to {} to disable. | +| executor.podSecurityContext | object | `{}` | Override pod security context for executor pods | | executor.queueName | string | `""` | The name of the queue to pull jobs from. Possible values: batches and codeintel. Either this or queueNames is required (when not using queues). | | executor.queueNames | list | `[]` | The names of multiple queues to pull jobs from. Possible values: batches and codeintel. Either this or queueName is required (when not using queues). | | executor.replicaCount | int | `1` | | @@ -93,6 +98,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | privateDockerRegistry.storageSize | string | `"10Gi"` | | | queues | list | `[]` | Optional list of queues to deploy as standalone Deployments. When set, the single executor Deployment is not rendered. Each entry supports: name (required) — used as the deployment name suffix (executor-) queueName — sets EXECUTOR_QUEUE_NAME; defaults to name if omitted queueNames — sets EXECUTOR_QUEUE_NAMES (comma-joined); takes precedence over queueName when set replicaCount, resources, env (merged with executor.env, queue overrides) | | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | +| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers. Merges with component defaults; component-specific overrides take precedence. | | sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag | | sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy | | sourcegraph.image.repository | string | Sourcegraph's public Docker Hub registry | Global docker image registry or prefix | @@ -103,6 +109,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | +| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods. Merges with component defaults; component-specific overrides take precedence. | | sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) | | sourcegraph.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | | storageClass.allowedTopologies | object | `{}` | Persistent volumes topology configuration, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies) | diff --git a/charts/sourcegraph-executor/dind/templates/_helpers.tpl b/charts/sourcegraph-executor/dind/templates/_helpers.tpl index 8b87b5d24..6883fdbfb 100644 --- a/charts/sourcegraph-executor/dind/templates/_helpers.tpl +++ b/charts/sourcegraph-executor/dind/templates/_helpers.tpl @@ -181,14 +181,12 @@ spec: sourcegraph-resource-requires: no-cluster-admin app.kubernetes.io/component: executor spec: - {{- with $r.Values.executor.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} + {{- include "sourcegraph.podSecurityContext" (list $r "executor" 6) }} containers: - name: executor image: {{ include "sourcegraph.image" (list $r "executor") }} imagePullPolicy: {{ $r.Values.sourcegraph.image.pullPolicy }} + {{- include "sourcegraph.containerSecurityContext" (list $r "executor" 10) }} livenessProbe: httpGet: path: /healthz @@ -260,12 +258,12 @@ spec: - name: dind image: "{{ $r.Values.dind.image.registry }}/{{ $r.Values.dind.image.repository }}:{{ $r.Values.dind.image.tag }}" imagePullPolicy: {{ $r.Values.sourcegraph.image.pullPolicy }} + {{- if $r.Values.dind.gVisor.enabled }} securityContext: - {{- if $r.Values.dind.gVisor.enabled }} {{- toYaml $r.Values.dind.gVisor.securityContext | nindent 12 }} - {{- else }} - privileged: true - {{- end }} + {{- else }} + {{- include "sourcegraph.containerSecurityContext" (list $r "dind" 10) }} + {{- end }} command: {{- if $r.Values.dind.gVisor.enabled }} {{- toYaml $r.Values.dind.gVisor.command | nindent 12 }} diff --git a/charts/sourcegraph-executor/dind/templates/_helpers/_securityContext.tpl b/charts/sourcegraph-executor/dind/templates/_helpers/_securityContext.tpl new file mode 100644 index 000000000..993de2e0a --- /dev/null +++ b/charts/sourcegraph-executor/dind/templates/_helpers/_securityContext.tpl @@ -0,0 +1,120 @@ +{{/* + +Security context helpers for container and pod security contexts. + +These helpers implement a 3-tier merge precedence: +1. Component default (e.g., .Values.frontend.defaultContainerSecurityContext) +2. Global override (e.g., .Values.sourcegraph.containerSecurityContext) +3. Component override (e.g., .Values.frontend.containerSecurityContext) + +Later values override earlier ones, allowing customers to: +- Set global security context settings that apply to all components +- Override specific components as needed +- Retain Sourcegraph's secure defaults when no overrides are specified + +Supports nested paths like "openTelemetry" "gateway" or "codeInsightsDB" "init". + +*/}} + +{{/* +Internal: walk the component path and merge default, global, and component +override security contexts. Returns the merged map as YAML. + +Parameters: + - $ (root context) + - default key, e.g. "defaultContainerSecurityContext" + - override key, e.g. "containerSecurityContext"; also the global key under .Values.sourcegraph + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergeSecurityContext" -}} +{{- $root := index . 0 -}} +{{- $defaultKey := index . 1 -}} +{{- $overrideKey := index . 2 -}} +{{- $component := $root.Values -}} +{{- range slice . 3 -}} +{{- $component = index $component . | default dict -}} +{{- end -}} +{{- $default := index $component $defaultKey | default dict -}} +{{- $global := index $root.Values.sourcegraph $overrideKey | default dict -}} +{{- $override := index $component $overrideKey | default dict -}} +{{- mustMergeOverwrite (deepCopy $default) $global $override | toYaml -}} +{{- end -}} + +{{/* +Merged container security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedContainerSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedContainerSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultContainerSecurityContext" "containerSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Merged pod security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedPodSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedPodSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultPodSecurityContext" "podSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Internal: render a map as a "securityContext:" block, or nothing if empty. +The output includes a leading newline for proper YAML formatting. + +Parameters: + - merged security context map + - indent level (integer) +*/}} +{{- define "sourcegraph.renderSecurityContext" -}} +{{- $merged := index . 0 -}} +{{- $indent := int (index . 1) -}} +{{- if $merged }} +{{ "securityContext:" | indent $indent }} +{{ toYaml $merged | indent (int (add $indent 2)) -}} +{{- end -}} +{{- end -}} + +{{/* +Container security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.containerSecurityContext" (list . "frontend" 8) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.containerSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedContainerSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} + +{{/* +Pod security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.podSecurityContext" (list . "frontend" 6) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.podSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedPodSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} diff --git a/charts/sourcegraph-executor/dind/values.yaml b/charts/sourcegraph-executor/dind/values.yaml index 9032e83f8..d9fe9c663 100644 --- a/charts/sourcegraph-executor/dind/values.yaml +++ b/charts/sourcegraph-executor/dind/values.yaml @@ -33,6 +33,12 @@ sourcegraph: podLabels: {} # -- Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) priorityClassName: "" + # -- Global container security context override applied to all containers. + # Merges with component defaults; component-specific overrides take precedence. + containerSecurityContext: {} + # -- Global pod security context override applied to all pods. + # Merges with component defaults; component-specific overrides take precedence. + podSecurityContext: {} storageClass: @@ -131,17 +137,28 @@ executor: # -- StorageClass for the ephemeral volume. Only used when type is ephemeral. # Defaults to the cluster default StorageClass when empty. class: "" - # -- Pod-level security context applied to executor pods. + # -- Default pod security context for executor pods. # fsGroup: 101 ensures the scratch volume is writable by the sourcegraph user (uid=100, gid=101) # when running in Docker mode (dind). Set to {} to disable. - podSecurityContext: + defaultPodSecurityContext: fsGroup: 101 + # -- Override pod security context for executor pods + podSecurityContext: {} + # -- Default container security context for the executor container + defaultContainerSecurityContext: {} + # -- Override container security context for the executor container + containerSecurityContext: {} dind: image: registry: index.docker.io repository: docker tag: 29.5.3-dind + # -- Default container security context for the dind container. Ignored when gVisor is enabled. + defaultContainerSecurityContext: + privileged: true + # -- Override container security context for the dind container. Ignored when gVisor is enabled. + containerSecurityContext: {} # -- Command for the dind container. command: - dockerd diff --git a/charts/sourcegraph-executor/k8s/README.md b/charts/sourcegraph-executor/k8s/README.md index 67bae6cc3..e68b46ee8 100644 --- a/charts/sourcegraph-executor/k8s/README.md +++ b/charts/sourcegraph-executor/k8s/README.md @@ -58,10 +58,13 @@ In addition to the documented values, the `executor` and `private-docker-registr |-----|------|---------|-------------| | executor.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | | executor.configureRbac | bool | `true` | Whether to configure the necessary RBAC resources. Required only once for all executor deployments. | -| executor.containerSecurityContext | object | `{"privileged":false}` | Security context for the container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| executor.containerSecurityContext | object | `{}` | Override container security context for the executor container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | executor.debug.keepJobs | string | `"false"` | If true, Kubernetes jobs will not be deleted after they complete. Not recommended for production use as it can hit cluster limits. | | executor.debug.keepWorkspaces | string | `"false"` | | +| executor.defaultContainerSecurityContext | object | `{"privileged":false}` | Default container security context for the executor container | +| executor.defaultPodSecurityContext | object | `{}` | Default pod security context for the executor pod | | executor.dockerAddHostGateway | string | `"false"` | For local deployments the host is 'host.docker.internal' and this needs to be true | +| executor.enabled | bool | `true` | Whether to deploy the executor | | executor.extraEnv | string | `nil` | Sets extra environment variables on the executor deployment. See `values.yaml` for the format. | | executor.frontendExistingSecret | string | `""` | Name of existing k8s Secret to use for frontend password The name of the secret must match `executor.name`, i.e., the name of the helm release used to deploy the helm chart. The k8s Secret must contain the key `EXECUTOR_FRONTEND_PASSWORD` matching the site config `executors.accessToken` value. `executor.frontendPassword` is ignored if this is enabled. | | executor.frontendPassword | string | `""` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required if `executor.frontendExistingSecret`` is not configured. | @@ -91,7 +94,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.maximumRuntimePerJob | string | `"30m"` | | | executor.namespace | string | `"default"` | The namespace in which jobs are generated by the executor. | | executor.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | -| executor.podSecurityContext | object | `{}` | Security context for the pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| executor.podSecurityContext | object | `{}` | Override pod security context for the executor pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | | executor.queueName | string | `""` | The name of the queue to pull jobs from to. Possible values: batches and codeintel. **Either this or queueNames is required.** | | executor.queueNames | list | `[]` | The names of multiple queues to pull jobs from to. Possible values: batches and codeintel. **Either this or queueName is required.** | | executor.resources.limits.cpu | string | `"1"` | | @@ -105,6 +108,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | executor.securityContext.runAsUser | string | `nil` | DEPRECATED: Use `executor.containerSecurityContext` or `executor.podSecurityContext` instead. | | executor.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | +| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers. Merges with component defaults; component-specific overrides take precedence. | | sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag | | sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy | | sourcegraph.image.repository | string | Sourcegraph's public Docker Hub registry | Global docker image registry or prefix | @@ -116,5 +120,6 @@ In addition to the documented values, the `executor` and `private-docker-registr | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | +| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods. Merges with component defaults; component-specific overrides take precedence. | | sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) | | sourcegraph.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | diff --git a/charts/sourcegraph-executor/k8s/templates/_helpers/_securityContext.tpl b/charts/sourcegraph-executor/k8s/templates/_helpers/_securityContext.tpl new file mode 100644 index 000000000..993de2e0a --- /dev/null +++ b/charts/sourcegraph-executor/k8s/templates/_helpers/_securityContext.tpl @@ -0,0 +1,120 @@ +{{/* + +Security context helpers for container and pod security contexts. + +These helpers implement a 3-tier merge precedence: +1. Component default (e.g., .Values.frontend.defaultContainerSecurityContext) +2. Global override (e.g., .Values.sourcegraph.containerSecurityContext) +3. Component override (e.g., .Values.frontend.containerSecurityContext) + +Later values override earlier ones, allowing customers to: +- Set global security context settings that apply to all components +- Override specific components as needed +- Retain Sourcegraph's secure defaults when no overrides are specified + +Supports nested paths like "openTelemetry" "gateway" or "codeInsightsDB" "init". + +*/}} + +{{/* +Internal: walk the component path and merge default, global, and component +override security contexts. Returns the merged map as YAML. + +Parameters: + - $ (root context) + - default key, e.g. "defaultContainerSecurityContext" + - override key, e.g. "containerSecurityContext"; also the global key under .Values.sourcegraph + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergeSecurityContext" -}} +{{- $root := index . 0 -}} +{{- $defaultKey := index . 1 -}} +{{- $overrideKey := index . 2 -}} +{{- $component := $root.Values -}} +{{- range slice . 3 -}} +{{- $component = index $component . | default dict -}} +{{- end -}} +{{- $default := index $component $defaultKey | default dict -}} +{{- $global := index $root.Values.sourcegraph $overrideKey | default dict -}} +{{- $override := index $component $overrideKey | default dict -}} +{{- mustMergeOverwrite (deepCopy $default) $global $override | toYaml -}} +{{- end -}} + +{{/* +Merged container security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedContainerSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedContainerSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultContainerSecurityContext" "containerSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Merged pod security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedPodSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedPodSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultPodSecurityContext" "podSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Internal: render a map as a "securityContext:" block, or nothing if empty. +The output includes a leading newline for proper YAML formatting. + +Parameters: + - merged security context map + - indent level (integer) +*/}} +{{- define "sourcegraph.renderSecurityContext" -}} +{{- $merged := index . 0 -}} +{{- $indent := int (index . 1) -}} +{{- if $merged }} +{{ "securityContext:" | indent $indent }} +{{ toYaml $merged | indent (int (add $indent 2)) -}} +{{- end -}} +{{- end -}} + +{{/* +Container security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.containerSecurityContext" (list . "frontend" 8) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.containerSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedContainerSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} + +{{/* +Pod security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.podSecurityContext" (list . "frontend" 6) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.podSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedPodSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} diff --git a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml index 6e773607b..4c94689d1 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.ConfigMap.yaml @@ -1,3 +1,4 @@ +{{- if .Values.executor.enabled -}} apiVersion: v1 kind: ConfigMap metadata: @@ -41,3 +42,4 @@ data: EXECUTOR_DOCKER_ADD_HOST_GATEWAY: "{{.Values.executor.dockerAddHostGateway }}" KUBERNETES_KEEP_JOBS: "{{ .Values.executor.debug.keepJobs }}" EXECUTOR_KEEP_WORKSPACES: "{{ .Values.executor.debug.keepWorkspaces }}" +{{- end }} diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml index 1cb35d2c4..db1707671 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.Deployment.yaml @@ -1,3 +1,4 @@ +{{- if .Values.executor.enabled -}} apiVersion: apps/v1 kind: Deployment metadata: @@ -46,27 +47,22 @@ spec: {{- end }} {{- include "executor.labels" . | nindent 8 }} spec: - securityContext: - {{- if .Values.executor.podSecurityContext }} - {{- toYaml .Values.executor.podSecurityContext | nindent 8 }} - {{- else }} - {{- with .Values.executor.securityContext.fsGroup }} - fsGroup: {{ . }} - {{- end }} - {{- with .Values.executor.securityContext.runAsUser }} - runAsUser: {{ . }} - {{- end }} - {{- with .Values.executor.securityContext.runAsGroup }} - runAsGroup: {{ . }} - {{- end }} - {{- end }} + {{- $podSecurityContext := include "sourcegraph.mergedPodSecurityContext" (list . "executor") | fromYaml }} + {{- if not .Values.executor.podSecurityContext }} + {{- /* DEPRECATED executor.securityContext: its pod fields still apply when executor.podSecurityContext is unset */}} + {{- range $field := list "fsGroup" "runAsUser" "runAsGroup" }} + {{- with index ($.Values.executor.securityContext | default dict) $field }} + {{- $_ := set $podSecurityContext $field . }} + {{- end }} + {{- end }} + {{- end }} + {{- include "sourcegraph.renderSecurityContext" (list $podSecurityContext 6) }} serviceAccountName: sg-executor containers: - name: executor image: {{ include "sourcegraph.image" (list . "executor") }} imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }} - securityContext: - {{- toYaml .Values.executor.containerSecurityContext | nindent 12 }} + {{- include "sourcegraph.containerSecurityContext" (list . "executor" 10) }} ports: - name: http-debug containerPort: 6060 @@ -118,3 +114,4 @@ spec: imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} +{{- end }} diff --git a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml b/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml index 33d841b3b..3d8ee538c 100644 --- a/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml +++ b/charts/sourcegraph-executor/k8s/templates/executor.Service.yaml @@ -1,3 +1,4 @@ +{{- if .Values.executor.enabled -}} apiVersion: v1 kind: Service metadata: @@ -20,3 +21,4 @@ spec: {{- include "sourcegraph.selectorLabels" . | nindent 4 }} app: {{ include "executor.name" . }} type: {{ .Values.executor.serviceType | default "ClusterIP" }} +{{- end }} diff --git a/charts/sourcegraph-executor/k8s/values.yaml b/charts/sourcegraph-executor/k8s/values.yaml index d6ea71561..5d8936992 100644 --- a/charts/sourcegraph-executor/k8s/values.yaml +++ b/charts/sourcegraph-executor/k8s/values.yaml @@ -35,9 +35,17 @@ sourcegraph: podLabels: { } # -- Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) priorityClassName: "" + # -- Global container security context override applied to all containers. + # Merges with component defaults; component-specific overrides take precedence. + containerSecurityContext: {} + # -- Global pod security context override applied to all pods. + # Merges with component defaults; component-specific overrides take precedence. + podSecurityContext: {} executor: + # -- Whether to deploy the executor + enabled: true # -- Whether to configure the necessary RBAC resources. Required only once for all executor deployments. configureRbac: true image: @@ -158,10 +166,14 @@ executor: # -- For local deployments the host is 'host.docker.internal' and this needs to be true dockerAddHostGateway: "false" - # -- Security context for the container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default container security context for the executor container + defaultContainerSecurityContext: privileged: false - # -- Security context for the pod, + # -- Override container security context for the executor container, + # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) + containerSecurityContext: {} + # -- Default pod security context for the executor pod + defaultPodSecurityContext: {} + # -- Override pod security context for the executor pod, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) podSecurityContext: {} diff --git a/charts/sourcegraph-migrator/README.md b/charts/sourcegraph-migrator/README.md index eba7f0ecd..9751067b4 100644 --- a/charts/sourcegraph-migrator/README.md +++ b/charts/sourcegraph-migrator/README.md @@ -78,14 +78,18 @@ In addition to the documented values, the `migrator` service also supports the f | codeIntelDB.auth.existingSecret | string | `""` | Name of existing secret to use for codeintel-db credentials This should match the setting in the sourcegraph chart values | | codeIntelDB.name | string | `"codeintel-db"` | | | migrator.args | list | `["up","-db=all"]` | Override default `migrator` container args Available commands can be found at https://docs.sourcegraph.com/admin/how-to/manual_database_migrations | -| migrator.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `migrator` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| migrator.containerSecurityContext | object | `{}` | Override container security context for the `migrator` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| migrator.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `migrator` container | +| migrator.defaultPodSecurityContext | object | `{}` | Default pod security context for the `migrator` pod | | migrator.env | object | `{}` | Environment variables for the `migrator` container | | migrator.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `migrator` image | | migrator.image.name | string | `"migrator"` | Docker image name for the `migrator` image | +| migrator.podSecurityContext | object | `{}` | Override pod security context for the `migrator` pod learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | | migrator.resources | object | `{"limits":{"cpu":"500m","memory":"100M"},"requests":{"cpu":"100m","memory":"50M"}}` | Resource requests & limits for the `migrator` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | pgsql.auth.existingSecret | string | `""` | Name of existing secret to use for pgsql credentials This should match the setting in the sourcegraph chart values | | pgsql.name | string | `"pgsql"` | | | sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | +| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers. Merges with component defaults; component-specific overrides take precedence. | | sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag | | sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy | | sourcegraph.image.repository | string | Sourcegraph's public Docker Hub registry | Global docker image registry or prefix | @@ -96,6 +100,7 @@ In addition to the documented values, the `migrator` service also supports the f | sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | +| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods. Merges with component defaults; component-specific overrides take precedence. | | sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) | | sourcegraph.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | diff --git a/charts/sourcegraph-migrator/templates/_helpers/_securityContext.tpl b/charts/sourcegraph-migrator/templates/_helpers/_securityContext.tpl new file mode 100644 index 000000000..993de2e0a --- /dev/null +++ b/charts/sourcegraph-migrator/templates/_helpers/_securityContext.tpl @@ -0,0 +1,120 @@ +{{/* + +Security context helpers for container and pod security contexts. + +These helpers implement a 3-tier merge precedence: +1. Component default (e.g., .Values.frontend.defaultContainerSecurityContext) +2. Global override (e.g., .Values.sourcegraph.containerSecurityContext) +3. Component override (e.g., .Values.frontend.containerSecurityContext) + +Later values override earlier ones, allowing customers to: +- Set global security context settings that apply to all components +- Override specific components as needed +- Retain Sourcegraph's secure defaults when no overrides are specified + +Supports nested paths like "openTelemetry" "gateway" or "codeInsightsDB" "init". + +*/}} + +{{/* +Internal: walk the component path and merge default, global, and component +override security contexts. Returns the merged map as YAML. + +Parameters: + - $ (root context) + - default key, e.g. "defaultContainerSecurityContext" + - override key, e.g. "containerSecurityContext"; also the global key under .Values.sourcegraph + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergeSecurityContext" -}} +{{- $root := index . 0 -}} +{{- $defaultKey := index . 1 -}} +{{- $overrideKey := index . 2 -}} +{{- $component := $root.Values -}} +{{- range slice . 3 -}} +{{- $component = index $component . | default dict -}} +{{- end -}} +{{- $default := index $component $defaultKey | default dict -}} +{{- $global := index $root.Values.sourcegraph $overrideKey | default dict -}} +{{- $override := index $component $overrideKey | default dict -}} +{{- mustMergeOverwrite (deepCopy $default) $global $override | toYaml -}} +{{- end -}} + +{{/* +Merged container security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedContainerSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedContainerSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultContainerSecurityContext" "containerSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Merged pod security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedPodSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedPodSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultPodSecurityContext" "podSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Internal: render a map as a "securityContext:" block, or nothing if empty. +The output includes a leading newline for proper YAML formatting. + +Parameters: + - merged security context map + - indent level (integer) +*/}} +{{- define "sourcegraph.renderSecurityContext" -}} +{{- $merged := index . 0 -}} +{{- $indent := int (index . 1) -}} +{{- if $merged }} +{{ "securityContext:" | indent $indent }} +{{ toYaml $merged | indent (int (add $indent 2)) -}} +{{- end -}} +{{- end -}} + +{{/* +Container security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.containerSecurityContext" (list . "frontend" 8) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.containerSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedContainerSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} + +{{/* +Pod security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.podSecurityContext" (list . "frontend" 6) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.podSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedPodSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} diff --git a/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml b/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml index c77ec3b33..858270070 100644 --- a/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml +++ b/charts/sourcegraph-migrator/templates/migrator/sourcegraph-migrator.Job.yaml @@ -49,8 +49,7 @@ spec: {{- end }} resources: {{- toYaml .Values.migrator.resources | nindent 10 }} - securityContext: - {{- toYaml .Values.migrator.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "migrator" 8) }} volumeMounts: {{- if .Values.migrator.extraVolumeMounts }} {{- toYaml .Values.migrator.extraVolumeMounts | nindent 8 }} @@ -58,8 +57,7 @@ spec: {{- if .Values.migrator.extraContainers }} {{- toYaml .Values.migrator.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.migrator.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "migrator" 6) }} {{- with .Values.sourcegraph.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/sourcegraph-migrator/values.yaml b/charts/sourcegraph-migrator/values.yaml index 2392f0de1..c9d215b59 100644 --- a/charts/sourcegraph-migrator/values.yaml +++ b/charts/sourcegraph-migrator/values.yaml @@ -33,6 +33,12 @@ sourcegraph: podLabels: {} # -- Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) priorityClassName: "" + # -- Global container security context override applied to all containers. + # Merges with component defaults; component-specific overrides take precedence. + containerSecurityContext: {} + # -- Global pod security context override applied to all pods. + # Merges with component defaults; component-specific overrides take precedence. + podSecurityContext: {} # Generic application configuration options, used by most applications below @@ -120,13 +126,20 @@ migrator: requests: cpu: 100m memory: 50M - # -- Security context for the `migrator` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `migrator` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `migrator` container, + # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) + containerSecurityContext: {} + # -- Default pod security context for the `migrator` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `migrator` pod + # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + podSecurityContext: {} # -- Override default `migrator` container args # Available commands can be found at # https://docs.sourcegraph.com/admin/how-to/manual_database_migrations diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index d91807147..4eaa8b46b 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -13,7 +13,6 @@ Use `**BREAKING**:` to denote a breaking change - Added `indexedSearch.readinessProbe` (`failureThreshold`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` readiness probe, which was previously hardcoded. Defaults are unchanged (`3`/`5`/`5`). Raise `failureThreshold` on instances with large monorepos, where loading a many-shard repo can stall `/healthz` past `timeoutSeconds` and drop a healthy pod out of the `indexed-search` service. - Added `indexedSearch.livenessProbe` (`failureThreshold`, `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`) to tune the `zoekt-webserver` liveness probe, which was previously hardcoded. Defaults are unchanged (`10`/`120`/`60`/`5`). Raise `failureThreshold` or `timeoutSeconds` where the index greatly exceeds the container memory limit: page-cache reclaim stalls `/healthz` past `timeoutSeconds`, and consecutive failures restart a container that is still serving. Keep the resulting window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog remains the first line of defence. - `searcher.storageSize` now accepts any Kubernetes quantity (e.g. `150G`, `1Ti`, `1.5Ti`, `500000M`) when deriving `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB`. Previously anything other than `Gi` silently rendered both as `0`, which disables cache eviction and lets the cache volume fill up. Unparseable values, or values below `3M`, now fail the render unless `searcher.autoCacheSize` is enabled. The derived size now matches searcher's own auto-sizing arithmetic (45% of the volume in decimal megabytes), so existing `Gi` deployments see a slightly higher value on upgrade, e.g. the default `26Gi` renders `12562` instead of `11700`. -- Fixed `redis-cache` and `redis-store` restarting on every upgrade when `config.enabled` is true. The `checksum/redis-config` pod annotation hashed the whole rendered ConfigMap, including its chart-version labels, so it changed with every release even when `redis.conf` did not. It now hashes only `redis.conf`, so redis restarts only when its configuration changes. The annotation value changes once, so redis restarts one last time on the upgrade that picks up this fix. ## 8.1.0 diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index 6a6ad8d11..e3ca3fb8d 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -87,28 +87,34 @@ In addition to the documented values, all services also support the following va | Key | Type | Default | Description | |-----|------|---------|-------------| -| alpine.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsUser":999}` | Security context for the `alpine` initContainer, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| alpine.containerSecurityContext | object | `{}` | Override container security context for the `alpine` initContainer | +| alpine.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsUser":999}` | Default security context for the `alpine` initContainer Used in init containers for pgsql and codeintel-db statefulSets, not codeinsights-db | | alpine.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `alpine` image | | alpine.image.name | string | `"alpine-3.14"` | Docker image name for the `alpine` image | | alpine.resources | object | `{"limits":{"cpu":"10m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}` | Resource requests & limits for the `alpine` initContainer, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | -| blobstore.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"runAsGroup":101,"runAsUser":100}` | Security context for the `blobstore` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| blobstore.containerSecurityContext | object | `{}` | Override container security context for the `blobstore` container | +| blobstore.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"runAsGroup":101,"runAsUser":100}` | Default security context for the `blobstore` container | +| blobstore.defaultPodSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":101,"runAsUser":100}` | Default security context for the `blobstore` pod | | blobstore.enabled | bool | `true` | Enable `blobstore` (S3 compatible storage) | | blobstore.env | object | the chart will add some default environment values | Environment variables for the `blobstore` container | | blobstore.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `blobstore` image | | blobstore.image.name | string | `"blobstore"` | Docker image name for the `blobstore` image | | blobstore.name | string | `"blobstore"` | Name used by resources. Does not affect service names or PVCs. | -| blobstore.podSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":101,"runAsUser":100}` | Security context for the `blobstore` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| blobstore.podSecurityContext | object | `{}` | Override pod security context for the `blobstore` pod | | blobstore.resources | object | `{"limits":{"cpu":"1","memory":"500M"},"requests":{"cpu":"1","memory":"500M"}}` | Resource requests & limits for the `blobstore` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | blobstore.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `blobstore` | | blobstore.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | | blobstore.storageAnnotations | object | `{}` | Optional annotations to add to the `blobstore` PVC | | blobstore.storageSize | string | `"100Gi"` | PVC Storage Request for `blobstore` data volume | | blobstore.storageSubPath | string | `""` | Optional subPath for the `blobstore` primary data volume mount | -| cadvisor.containerSecurityContext | object | `{"privileged":true}` | Security context for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| cadvisor.containerSecurityContext | object | `{}` | Override container security context for the `cadvisor` container | +| cadvisor.defaultContainerSecurityContext | object | `{"privileged":true}` | Default security context for the `cadvisor` container | +| cadvisor.defaultPodSecurityContext | object | `{}` | Default pod security context for `cadvisor` | | cadvisor.enabled | bool | `true` | Enable `cadvisor` | | cadvisor.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `cadvisor` image | | cadvisor.image.name | string | `"cadvisor"` | Docker image name for the `cadvisor` image | | cadvisor.name | string | `"cadvisor"` | Name used by resources. Does not affect service names or PVCs. | +| cadvisor.podSecurityContext | object | `{}` | Override pod security context for `cadvisor` | | cadvisor.resources | object | `{"limits":{"cpu":"300m","memory":"2000Mi"},"requests":{"cpu":"150m","memory":"200Mi"}}` | Resource requests & limits for the `cadvisor` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | cadvisor.serviceAccount.create | bool | `true` | Enable creation of ServiceAccount for `cadvisor` | | cadvisor.serviceAccount.name | string | `"cadvisor"` | Name of the ServiceAccount to be created or an existing ServiceAccount | @@ -120,15 +126,18 @@ In addition to the documented values, all services also support the following va | codeInsightsDB.auth.port | string | `"5432"` | Sets codeinsights-db port | | codeInsightsDB.auth.sslmode | string | `"disable"` | Sets codeinsights-db SSL mode | | codeInsightsDB.auth.user | string | `"postgres"` | Sets codeinsights-db username | -| codeInsightsDB.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":70,"runAsUser":70}` | Security context for the `codeinsights-db` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| codeInsightsDB.containerSecurityContext | object | `{}` | Override container security context for the `codeinsights-db` container | +| codeInsightsDB.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":70,"runAsUser":70}` | Default security context for the `codeinsights-db` container | +| codeInsightsDB.defaultPodSecurityContext | object | `{"fsGroup":70,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":70}` | Default security context for the `codeinsights-db` pod | | codeInsightsDB.enabled | bool | `true` | Enable `codeinsights-db` PostgreSQL server | | codeInsightsDB.env | object | `{}` | Environment variables for the `codeinsights-db` container | | codeInsightsDB.existingConfig | string | `""` | Name of existing ConfigMap for `codeinsights-db`. It must contain a `postgresql.conf` key. | | codeInsightsDB.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `codeinsights-db` image | | codeInsightsDB.image.name | string | `"postgresql-16-codeinsights"` | Docker image name for the `codeinsights-db` image | -| codeInsightsDB.init.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":70,"runAsUser":70}` | Security context for the `alpine` initContainer, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| codeInsightsDB.init.containerSecurityContext | object | `{}` | Override container security context for the `alpine` initContainer | +| codeInsightsDB.init.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":70,"runAsUser":70}` | Default security context for the `alpine` initContainer | | codeInsightsDB.name | string | `"codeinsights-db"` | Name used by resources. Does not affect service names or PVCs. | -| codeInsightsDB.podSecurityContext | object | `{"fsGroup":70,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":70}` | Security context for the `codeinsights-db` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| codeInsightsDB.podSecurityContext | object | `{}` | Override pod security context for the `codeinsights-db` pod | | codeInsightsDB.postgresExporter | object | `{}` | Configuration for the `pgsql-exporter` sidecar container | | codeInsightsDB.resources | object | `{"limits":{"cpu":"4","memory":"2Gi"},"requests":{"cpu":"4","memory":"2Gi"}}` | Resource requests & limits for the `codeinsights-db` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | codeInsightsDB.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `codeinsights-db` | @@ -144,13 +153,15 @@ In addition to the documented values, all services also support the following va | codeIntelDB.auth.port | string | `"5432"` | Sets codeintel-db port | | codeIntelDB.auth.sslmode | string | `"disable"` | Sets codeintel-db SSL mode | | codeIntelDB.auth.user | string | `"sg"` | Sets codeintel-db username | -| codeIntelDB.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsUser":999}` | Security context for the `codeintel-db` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| codeIntelDB.containerSecurityContext | object | `{}` | Override container security context for the `codeintel-db` container | +| codeIntelDB.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsUser":999}` | Default security context for the `codeintel-db` container | +| codeIntelDB.defaultPodSecurityContext | object | `{"fsGroup":999,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":999}` | Default security context for the `codeintel-db` pod | | codeIntelDB.enabled | bool | `true` | Enable `codeintel-db` PostgreSQL server | | codeIntelDB.existingConfig | string | `""` | Name of existing ConfigMap for `codeintel-db`. It must contain a `postgresql.conf` key | | codeIntelDB.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `codeintel-db` image | | codeIntelDB.image.name | string | `"postgresql-16"` | Docker image name for the `codeintel-db` image | | codeIntelDB.name | string | `"codeintel-db"` | Name used by resources. Does not affect service names or PVCs. | -| codeIntelDB.podSecurityContext | object | `{"fsGroup":999,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":999}` | Security context for the `codeintel-db` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| codeIntelDB.podSecurityContext | object | `{}` | Override pod security context for the `codeintel-db` pod | | codeIntelDB.postgresExporter | object | `{}` | Configuration for the `pgsql-exporter` sidecar container | | codeIntelDB.resources | object | `{"limits":{"cpu":"4","memory":"4Gi"},"requests":{"cpu":"4","memory":"4Gi"}}` | Resource requests & limits for the `codeintel-db` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | codeIntelDB.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `codeintel-db` | @@ -159,8 +170,10 @@ In addition to the documented values, all services also support the following va | codeIntelDB.storageSize | string | `"200Gi"` | PVC Storage Request for `codeintel-db` data volume | | codeIntelDB.storageSubPath | string | `""` | Optional subPath for the `codeintel-db` primary data volume mount | | extraResources | list | `[]` | Additional resources to include in the rendered manifest. Templates are supported. | -| frontend.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `frontend` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| frontend.containerSecurityContext | object | `{}` | Override container security context for the `frontend` container | | frontend.createRoleBinding | bool | `true` | Disable the roleBinding resource for deployment environments blocking RBAC, ex. OpenShift's default "secure" SCC | +| frontend.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `frontend` container | +| frontend.defaultPodSecurityContext | object | `{}` | Default pod security context for the `frontend` pod | | frontend.env | object | the chart will add some default environment values | Environment variables for the `frontend` container | | frontend.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `frontend` image | | frontend.image.name | string | `"frontend"` | Docker image name for the `frontend` image | @@ -173,19 +186,21 @@ In addition to the documented values, all services also support the following va | frontend.ingress.tls | list | `[]` | Full TLS configuration for the ingress. Supersedes `tlsSecret` if set. Cannot be set together with `tlsSecret`. Omit `secretName` for controllers that manage certificates themselves (e.g. Tailscale). Example: tls: - hosts: - sourcegraph.example.com secretName: sourcegraph-tls # optional | | frontend.ingress.tlsSecret | string | `""` | Secret containing TLS cert. Cannot be set together with `tls`. | | frontend.name | string | `"sourcegraph-frontend"` | Name used by resources. Does not affect service names or PVCs. | -| frontend.podSecurityContext | object | `{}` | Security context for the `frontend` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| frontend.podSecurityContext | object | `{}` | Override pod security context for the `frontend` pod | | frontend.privileged | bool | `true` | Enable creation of Role and RoleBinding (RBAC). Uses [view](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) ClusterRole if set to false | | frontend.replicaCount | int | `2` | Number of `frontend` pod | | frontend.resources | object | `{"limits":{"cpu":"2","ephemeral-storage":"8Gi","memory":"4G"},"requests":{"cpu":"2","ephemeral-storage":"4Gi","memory":"2G"}}` | Resource requests & limits for the `frontend` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | frontend.serviceAccount.create | bool | `true` | Enable creation of ServiceAccount for `frontend` | | frontend.serviceAccount.name | string | `"sourcegraph-frontend"` | Name of the ServiceAccount to be created or an existing ServiceAccount | -| gitserver.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `gitserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| gitserver.containerSecurityContext | object | `{}` | Override container security context for the `gitserver` container | +| gitserver.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `gitserver` container | +| gitserver.defaultPodSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":101,"runAsUser":100}` | Default security context for the `gitserver` pod | | gitserver.env | object | the chart will add some default environment values | Environment variables for the `gitserver` container | | gitserver.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `gitserver` image | | gitserver.image.name | string | `"gitserver"` | Docker image name for the `gitserver` image | | gitserver.name | string | `"gitserver"` | Name used by resources. Does not affect service names or PVCs. | | gitserver.podDisruptionBudget | object | `{}` | Pod disruption budget for `gitserver`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| gitserver.podSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":101,"runAsUser":100}` | Security context for the `gitserver` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| gitserver.podSecurityContext | object | `{}` | Override pod security context for the `gitserver` pod | | gitserver.replicaCount | int | `1` | Number of `gitserver` pod | | gitserver.resources | object | `{"limits":{"cpu":"4","memory":"8G"},"requests":{"cpu":"4","memory":"8G"}}` | Resource requests & limits for the `gitserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | gitserver.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `gitserver` | @@ -203,28 +218,32 @@ In addition to the documented values, all services also support the following va | grafana.auth.port | string | `""` | Sets postgres port | | grafana.auth.sslmode | string | `""` | Sets postgres sslmode | | grafana.auth.user | string | `""` | Sets postgres username | -| grafana.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":472,"runAsUser":472}` | Security context for the `grafana` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| grafana.containerSecurityContext | object | `{}` | Override container security context for the `grafana` container | +| grafana.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":472,"runAsUser":472}` | Default security context for the `grafana` container | +| grafana.defaultPodSecurityContext | object | `{"fsGroup":472,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":472,"runAsUser":472}` | Default security context for the `grafana` pod | | grafana.enabled | bool | `true` | Enable `grafana` dashboard (recommended) | | grafana.existingConfig | string | `""` | Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key. | | grafana.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `grafana` image | | grafana.image.name | string | `"grafana"` | Docker image name for the `grafana` image | | grafana.initContainers | list | `[]` | Init containers for the `grafana` pod. Use `restartPolicy: Always` for a native sidecar that must be started before `grafana`, such as one that writes a datasource credential file read by `datasources.yml` | | grafana.name | string | `"grafana"` | Name used by resources. Does not affect service names or PVCs. | -| grafana.podSecurityContext | object | `{"fsGroup":472,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":472,"runAsUser":472}` | Security context for the `grafana` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| grafana.podSecurityContext | object | `{}` | Override pod security context for the `grafana` pod | | grafana.resources | object | `{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"100m","memory":"512Mi"}}` | Resource requests & limits for the `grafana` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | grafana.serviceAccount.create | bool | `true` | Enable creation of ServiceAccount for `grafana` | | grafana.serviceAccount.name | string | `"grafana"` | Name of the ServiceAccount to be created or an existing ServiceAccount | | grafana.storageAnnotations | object | `{}` | Optional annotations to add to the `grafana` PVC | | grafana.storageSize | string | `"2Gi"` | PVC Storage Request for `grafana` data volume | | grafana.storageSubPath | string | `""` | Optional subPath for the `grafana` primary data volume mount | -| indexedSearch.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `zoekt-webserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| indexedSearch.containerSecurityContext | object | `{}` | Override container security context for the `zoekt-webserver` container | +| indexedSearch.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `zoekt-webserver` container | +| indexedSearch.defaultPodSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch"}` | Default security context for the `indexed-search` pod | | indexedSearch.env | object | the chart will add some default environment values | Environment variables for the `zoekt-webserver` container | | indexedSearch.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `zoekt-webserver` image | | indexedSearch.image.name | string | `"indexed-searcher"` | Docker image name for the `zoekt-webserver` image | | indexedSearch.livenessProbe | object | `{"failureThreshold":10,"initialDelaySeconds":120,"periodSeconds":60,"timeoutSeconds":5}` | Liveness probe tuning for the `zoekt-webserver` container. Raise `failureThreshold` or `timeoutSeconds` where memory pressure stalls `/healthz` for minutes at a time, so the container is not killed while it is still serving. Keep the window wider than zoekt's in-process watchdog (`ZOEKT_WATCHDOG_ERRORS` x `ZOEKT_WATCHDOG_TICK`) so the watchdog stays the first line of defence. | | indexedSearch.name | string | `"indexed-search"` | Name used by resources. Does not affect service names or PVCs. | | indexedSearch.podDisruptionBudget | object | `{}` | Pod disruption budget for `indexed-search`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| indexedSearch.podSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch"}` | Security context for the `indexed-search` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| indexedSearch.podSecurityContext | object | `{}` | Override pod security context for the `indexed-search` pod | | indexedSearch.readinessProbe | object | `{"failureThreshold":3,"periodSeconds":5,"timeoutSeconds":5}` | Readiness probe tuning for the `zoekt-webserver` container. Raise `failureThreshold` on instances with large monorepos: loading a many-shard repo can stall `/healthz` past `timeoutSeconds`, briefly dropping the pod from the service even though it is healthy. | | indexedSearch.replicaCount | int | `1` | Number of `indexed-search` pod | | indexedSearch.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `zoekt-webserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | @@ -233,7 +252,8 @@ In addition to the documented values, all services also support the following va | indexedSearch.storageAnnotations | object | `{}` | Optional annotations to add to the `indexed-search` PVC | | indexedSearch.storageSize | string | `"200Gi"` | PVC Storage Request for `indexed-search` data volume The size of disk to used for search indexes. This should typically be gitserver disk size multiplied by the number of gitserver shards. | | indexedSearch.storageSubPath | string | `""` | Optional subPath for the `indexed-search` primary data volume mount | -| indexedSearchIndexer.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `zoekt-indexserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| indexedSearchIndexer.containerSecurityContext | object | `{}` | Override container security context for the `zoekt-indexserver` container | +| indexedSearchIndexer.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `zoekt-indexserver` container | | indexedSearchIndexer.env | object | the chart will add some default environment values | Environment variables for the `zoekt-indexserver` container | | indexedSearchIndexer.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `zoekt-indexserver` image | | indexedSearchIndexer.image.name | string | `"search-indexer"` | Docker image name for the `zoekt-indexserver` image | @@ -248,12 +268,14 @@ In addition to the documented values, all services also support the following va | jaeger.config.logLevel | string | `"info"` | Log level for the Jaeger instance (debug, info, warn, error) | | jaeger.config.maxTraces | int | `20000` | Maximum number of traces stored in memory | | jaeger.config.samplingDefaultProbability | float | `1` | Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config | -| jaeger.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `jaeger` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| jaeger.containerSecurityContext | object | `{}` | Override container security context for the `jaeger` container | +| jaeger.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `jaeger` container | +| jaeger.defaultPodSecurityContext | object | `{}` | Default pod security context for the `jaeger` pod | | jaeger.enabled | bool | `false` | Enable `jaeger` | | jaeger.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `jaeger` image | | jaeger.image.name | string | `"jaeger-all-in-one"` | Docker image name for the `jaeger` image | | jaeger.name | string | `"jaeger"` | Name used by resources. Does not affect service names or PVCs. | -| jaeger.podSecurityContext | object | `{}` | Security context for the `jaeger` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| jaeger.podSecurityContext | object | `{}` | Override pod security context for the `jaeger` pod | | jaeger.query.name | string | `""` | Name of jaeger `query` service | | jaeger.query.serviceAnnotations | object | `{}` | Add extra annotations to jaeger `query` service | | jaeger.query.serviceLabels | object | `{}` | Add extra labels to jaeger `query` service | @@ -262,29 +284,33 @@ In addition to the documented values, all services also support the following va | jaeger.resources | object | `{"limits":{"cpu":"1","memory":"1G"},"requests":{"cpu":"500m","memory":"500M"}}` | Resource requests & limits for the `jaeger` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | jaeger.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `jaeger` | | jaeger.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | -| migrator.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `migrator` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| migrator.containerSecurityContext | object | `{}` | Override container security context for the `migrator` container | +| migrator.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `migrator` container | | migrator.enabled | bool | `true` | Enable [migrator](https://docs.sourcegraph.com/admin/how-to/manual_database_migrations) initContainer in `frontend` deployment to perform database migration | | migrator.env | object | the chart will add some default environment values | Environment variables for the `migrator` container | | migrator.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `migrator` image | | migrator.image.name | string | `"migrator"` | Docker image name for the `migrator` image | | migrator.resources | object | `{"limits":{"cpu":"500m","memory":"100M"},"requests":{"cpu":"100m","memory":"50M"}}` | Resource requests & limits for the `migrator` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | -| nodeExporter.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsUser":65534}` | Security context for the `node-exporter` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| nodeExporter.containerSecurityContext | object | `{}` | Override container security context for the `node-exporter` container | +| nodeExporter.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsUser":65534}` | Default security context for the `node-exporter` container | +| nodeExporter.defaultPodSecurityContext | object | `{"fsGroup":65534,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534}` | Default security context for the `node-exporter` pod | | nodeExporter.enabled | bool | `true` | Enable `node-exporter` | | nodeExporter.extraArgs | list | `[]` | | | nodeExporter.hostPID | bool | `true` | | | nodeExporter.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `node-exporter` image | | nodeExporter.image.name | string | `"node-exporter"` | Docker image name for the `node-exporter` image | | nodeExporter.name | string | `"node-exporter"` | Name used by resources. Does not affect service names or PVCs. | -| nodeExporter.podSecurityContext | object | `{"fsGroup":65534,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534}` | Security context for the `node-exporter` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| nodeExporter.podSecurityContext | object | `{}` | Override pod security context for the `node-exporter` pod | | nodeExporter.resources | object | `{"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":".2","memory":"100Mi"}}` | Resource requests & limits for the `node-exporter` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | nodeExporter.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `node-exporter` | | nodeExporter.serviceAccount.name | string | `"node-exporter"` | Name of the ServiceAccount to be created or an existing ServiceAccount | -| openTelemetry.agent.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | -| openTelemetry.agent.containerSecurityContext.runAsGroup | int | `101` | | -| openTelemetry.agent.containerSecurityContext.runAsUser | int | `100` | | +| openTelemetry.agent.containerSecurityContext | object | `{}` | Override container security context for the `otel-agent` container | +| openTelemetry.agent.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"runAsGroup":101,"runAsUser":100}` | Default security context for the `otel-agent` container | +| openTelemetry.agent.defaultPodSecurityContext | object | `{}` | Default pod security context for the `otel-agent` pod | | openTelemetry.agent.hostPorts | object | `{"grpcOtlp":4317,"httpOtlp":4318,"httpZpages":55679}` | Resource requests & limits for the `otel-agent` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | openTelemetry.agent.kind | string | `"DaemonSet"` | The workload kind for the otel-agent. Valid values are `DaemonSet` and `Deployment`. Use `Deployment` in environments where DaemonSets are restricted (e.g. some managed Kubernetes offerings). When set to `Deployment`, the otel-agent DaemonSet is not created and application pods send traces directly to the existing otel-collector Deployment (otel-collector:4317) instead. | | openTelemetry.agent.name | string | `"otel-agent"` | Name used by resources. Does not affect service names or PVCs. | +| openTelemetry.agent.podSecurityContext | object | `{}` | Override pod security context for the `otel-agent` pod | | openTelemetry.agent.resources.limits.cpu | string | `"500m"` | | | openTelemetry.agent.resources.limits.memory | string | `"500Mi"` | | | openTelemetry.agent.resources.requests.cpu | string | `"100m"` | | @@ -296,10 +322,11 @@ In addition to the documented values, all services also support the following va | openTelemetry.gateway.config.traces.exportersTlsSecretName | string | `""` | Define the name of a preexisting secret containing TLS certificates for exporters, which will be mounted under "/tls". Read more about TLS configuration of exporters in the [OpenTelemetry Collector documentation](https://github.com/open-telemetry/opentelemetry-collector/blob/main/config/configtls/README.md) | | openTelemetry.gateway.config.traces.processors | object | `{}` | Define trace processors. Read how to configure sampling in the [OpenTelemetry documentation](https://docs.sourcegraph.com/admin/observability/opentelemetry#sampling-traces) | | openTelemetry.gateway.config.traces.tracePipelineProcessors | list | `[]` | Define the order in which processors are applied in the traces pipeline. When set, this takes precedence over the iteration order of `processors` (which cannot be relied on to preserve insertion order). Must contain exactly the same processor names as the keys of `processors`. | -| openTelemetry.gateway.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | -| openTelemetry.gateway.containerSecurityContext.runAsGroup | int | `101` | | -| openTelemetry.gateway.containerSecurityContext.runAsUser | int | `100` | | +| openTelemetry.gateway.containerSecurityContext | object | `{}` | Override container security context for the `otel-collector` container | +| openTelemetry.gateway.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"runAsGroup":101,"runAsUser":100}` | Default security context for the `otel-collector` container | +| openTelemetry.gateway.defaultPodSecurityContext | object | `{}` | Default pod security context for the `otel-collector` pod | | openTelemetry.gateway.name | string | `"otel-collector"` | Name used by resources. Does not affect service names or PVCs. | +| openTelemetry.gateway.podSecurityContext | object | `{}` | Override pod security context for the `otel-collector` pod | | openTelemetry.gateway.resources | object | `{"limits":{"cpu":"3","memory":"3Gi"},"requests":{"cpu":"1","memory":"1Gi"}}` | Resource requests & limits for the `otel-collector` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | openTelemetry.gateway.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `otel-collector` | | openTelemetry.gateway.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | @@ -313,13 +340,15 @@ In addition to the documented values, all services also support the following va | pgsql.auth.port | string | `"5432"` | Sets postgres port | | pgsql.auth.sslmode | string | `"disable"` | Sets postgres SSL mode | | pgsql.auth.user | string | `"sg"` | Sets postgres username | -| pgsql.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsUser":999}` | Security context for the `pgsql` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| pgsql.containerSecurityContext | object | `{}` | Override container security context for the `pgsql` container | +| pgsql.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsUser":999}` | Default security context for the `pgsql` container | +| pgsql.defaultPodSecurityContext | object | `{"fsGroup":999,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":999,"runAsUser":999}` | Default security context for the `pgsql` pod | | pgsql.enabled | bool | `true` | Enable `pgsql` PostgreSQL server | | pgsql.existingConfig | string | `""` | Name of existing ConfigMap for `pgsql`. It must contain a `postgresql.conf` key | | pgsql.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `pgsql` image | | pgsql.image.name | string | `"postgresql-16"` | Docker image name for the `pgsql` image | | pgsql.name | string | `"pgsql"` | Name used by resources. Does not affect service names or PVCs. | -| pgsql.podSecurityContext | object | `{"fsGroup":999,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":999,"runAsUser":999}` | Security context for the `pgsql` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| pgsql.podSecurityContext | object | `{}` | Override pod security context for the `pgsql` pod | | pgsql.postgresExporter | object | `{}` | Configuration for the `pgsql-exporter` sidecar container | | pgsql.resources | object | `{"limits":{"cpu":"4","memory":"4Gi"},"requests":{"cpu":"4","memory":"4Gi"}}` | Resource requests & limits for the `pgsql` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | pgsql.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `pgsql` | @@ -327,16 +356,20 @@ In addition to the documented values, all services also support the following va | pgsql.storageAnnotations | object | `{}` | Optional annotations to add to the `pgsql` PVC | | pgsql.storageSize | string | `"200Gi"` | PVC Storage Request for `pgsql` data volume | | pgsql.storageSubPath | string | `""` | Optional subPath for the `pgsql` primary data volume mount | +| postgresExporter.containerSecurityContext | object | `{}` | Override container security context for the `pgsql-exporter` sidecar container | +| postgresExporter.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false}` | Default security context for the `pgsql-exporter` sidecar container | | postgresExporter.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `pgsql-exporter` image | | postgresExporter.image.name | string | `"postgres_exporter"` | Docker image name for the `pgsql-exporter` image | | postgresExporter.resources | object | `{"limits":{"cpu":"10m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}` | Resource requests & limits for the `pgsql-exporter` sidecar container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | -| preciseCodeIntel.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `precise-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| preciseCodeIntel.containerSecurityContext | object | `{}` | Override container security context for the `precise-code-intel-worker` container | +| preciseCodeIntel.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `precise-code-intel-worker` container | +| preciseCodeIntel.defaultPodSecurityContext | object | `{}` | Default pod security context for the `precise-code-intel-worker` pod | | preciseCodeIntel.env | object | the chart will add some default environment values | Environment variables for the `precise-code-intel-worker` container | | preciseCodeIntel.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `precise-code-intel-worker` image | | preciseCodeIntel.image.name | string | `"precise-code-intel-worker"` | Docker image name for the `precise-code-intel-worker` image | | preciseCodeIntel.name | string | `"precise-code-intel-worker"` | Name used by resources. Does not affect service names or PVCs. | | preciseCodeIntel.podDisruptionBudget | object | `{}` | Pod disruption budget for `precise-code-intel-worker`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| preciseCodeIntel.podSecurityContext | object | `{}` | Security context for the `precise-code-intel-worker` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| preciseCodeIntel.podSecurityContext | object | `{}` | Override pod security context for the `precise-code-intel-worker` pod | | preciseCodeIntel.replicaCount | int | `2` | Number of `precise-code-intel-worker` pod | | preciseCodeIntel.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `precise-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | preciseCodeIntel.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `precise-code-intel-worker` | @@ -345,14 +378,16 @@ In addition to the documented values, all services also support the following va | preciseCodeIntel.storageSize | string | `""` | Size of the `/tmp` scratch volume. Required when storageType is `pvc`. When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty for unlimited). | | preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. | | priorityClasses | list | `[]` | Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) Sample class definition: - name: gitserver-class value: 100 preemptionPolicy: Never description: "gitserver priority class" | -| prometheus.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":false,"runAsGroup":100,"runAsUser":100}` | Security context for the `prometheus` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| prometheus.containerSecurityContext | object | `{}` | Override container security context for the `prometheus` container | | prometheus.createRoleBinding | bool | `true` | Disable the creation of a RoleBinding object, for customers who block all RBAC resource creation | +| prometheus.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":false,"runAsGroup":100,"runAsUser":100}` | Default security context for the `prometheus` container | +| prometheus.defaultPodSecurityContext | object | `{"fsGroup":100,"fsGroupChangePolicy":"OnRootMismatch"}` | Default security context for the `prometheus` pod | | prometheus.enabled | bool | `true` | Enable `prometheus` (recommended) | | prometheus.existingConfig | string | `""` | Name of existing ConfigMap for `pgsql`. It must contain a `prometheus.yml` key | | prometheus.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `prometheus` image | | prometheus.image.name | string | `"prometheus"` | Docker image name for the `prometheus` image | | prometheus.name | string | `"prometheus"` | Name used by resources. Does not affect service names or PVCs. | -| prometheus.podSecurityContext | object | `{"fsGroup":100,"fsGroupChangePolicy":"OnRootMismatch"}` | Security context for the `prometheus` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| prometheus.podSecurityContext | object | `{}` | Override pod security context for the `prometheus` pod | | prometheus.privileged | bool | `true` | Enable RBAC for `prometheus` | | prometheus.resources | object | `{"limits":{"cpu":"2","memory":"6G"},"requests":{"cpu":"500m","memory":"6G"}}` | Resource requests & limits for the `prometheus` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) Prometheus is relied upon to monitor services for sending alerts to site admins when something is wrong with Sourcegraph, thus its memory requests and limits are the same to guarantee it has enough memory to perform its job reliably and prevent conflicts with other pods on the same host node. The limit chosen here is based on what works reliably on Sourcegraph.com with lots of traffic. | | prometheus.serviceAccount.create | bool | `true` | Enable creation of ServiceAccount | @@ -368,20 +403,23 @@ In addition to the documented values, all services also support the following va | redisCache.config.maxmemoryRatio | float | `0.75` | Fraction of `redisCache.resources.limits.memory` used for `maxmemory` when `maxmemory` is empty. Must be greater than 0 and less than 1. Ignored when no memory limit is set or `sourcegraph.localDevMode` is enabled. An absent or unrecognised limit keeps the vendored 6gb default; use an explicit maxmemory if needed. | | redisCache.connection.endpoint | string | `"redis-cache:6379"` | Endpoint to use for redis-cache. Supports either host:port or IANA specification | | redisCache.connection.existingSecret | string | `""` | Name of existing secret to use for Redis endpoint The secret must contain the key `endpoint` and should follow IANA specification learn more from the [Helm docs](https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-redis-instances) | -| redisCache.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Security context for the `redis-cache` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| redisCache.containerSecurityContext | object | `{}` | Override container security context for the `redis-cache` container | +| redisCache.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Default security context for the `redis-cache` container | +| redisCache.defaultPodSecurityContext | object | `{"fsGroup":1000,"fsGroupChangePolicy":"OnRootMismatch"}` | Default security context for the `redis-cache` pod | | redisCache.enabled | bool | `true` | Enable `redis-cache` Redis server | | redisCache.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `redis-cache` image | | redisCache.image.name | string | `"redis-cache"` | Docker image name for the `redis-cache` image | | redisCache.name | string | `"redis-cache"` | Name used by resources. Does not affect service names or PVCs. | | redisCache.podDisruptionBudget | object | `{}` | Pod disruption budget for `redis-cache`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| redisCache.podSecurityContext | object | `{"fsGroup":1000,"fsGroupChangePolicy":"OnRootMismatch"}` | Security context for the `redis-cache` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| redisCache.podSecurityContext | object | `{}` | Override pod security context for the `redis-cache` pod | | redisCache.resources | object | `{"limits":{"cpu":"1","memory":"7Gi"},"requests":{"cpu":"1","memory":"7Gi"}}` | Resource requests & limits for the `redis-cache` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | redisCache.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `redis-cache` | | redisCache.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | | redisCache.storageAnnotations | object | `{}` | Optional annotations to add to the `redis-cache` PVC | | redisCache.storageSize | string | `"100Gi"` | PVC Storage Request for `redis-cache` data volume | | redisCache.storageSubPath | string | `""` | Optional subPath for the `redis-cache` primary data volume mount | -| redisExporter.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Security context for the `redis-exporter` sidecar container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| redisExporter.containerSecurityContext | object | `{}` | Override container security context for the `redis-exporter` sidecar container | +| redisExporter.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Default security context for the `redis-exporter` sidecar container | | redisExporter.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `redis-exporter` image | | redisExporter.image.name | string | `"redis_exporter"` | Docker image name for the `redis-exporter` image | | redisExporter.resources | object | `{"limits":{"cpu":"10m","memory":"100Mi"},"requests":{"cpu":"10m","memory":"100Mi"}}` | Resource requests & limits for the `redis-exporter` sidecar container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | @@ -393,13 +431,15 @@ In addition to the documented values, all services also support the following va | redisStore.config.maxmemoryRatio | float | `0.75` | Fraction of `redisStore.resources.limits.memory` used for `maxmemory` when `maxmemory` is empty. Must be greater than 0 and less than 1. Ignored when no memory limit is set or `sourcegraph.localDevMode` is enabled. An absent or unrecognised limit keeps the vendored 6gb default; use an explicit maxmemory if needed. | | redisStore.connection.endpoint | string | `"redis-store:6379"` | Endpoint to use for redis-store. Supports either host:port or IANA specification | | redisStore.connection.existingSecret | string | `""` | Name of existing secret to use for Redis endpoint The secret must contain the key `endpoint` and should follow IANA specification learn more from the [Helm docs](https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-redis-instances) | -| redisStore.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Security context for the `redis-store` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| redisStore.containerSecurityContext | object | `{}` | Override container security context for the `redis-store` container | +| redisStore.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":999}` | Default security context for the `redis-store` container | +| redisStore.defaultPodSecurityContext | object | `{"fsGroup":1000,"fsGroupChangePolicy":"OnRootMismatch"}` | Default security context for the `redis-store` pod | | redisStore.enabled | bool | `true` | Enable `redis-store` Redis server | | redisStore.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `redis-store` image | | redisStore.image.name | string | `"redis-store"` | Docker image name for the `redis-store` image | | redisStore.name | string | `"redis-store"` | Name used by resources. Does not affect service names or PVCs. | | redisStore.podDisruptionBudget | object | `{}` | Pod disruption budget for `redis-store`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| redisStore.podSecurityContext | object | `{"fsGroup":1000,"fsGroupChangePolicy":"OnRootMismatch"}` | Security context for the `redis-store` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| redisStore.podSecurityContext | object | `{}` | Override pod security context for the `redis-store` pod | | redisStore.resources | object | `{"limits":{"cpu":"1","memory":"7Gi"},"requests":{"cpu":"1","memory":"7Gi"}}` | Resource requests & limits for the `redis-store` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | redisStore.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `redis-store` | | redisStore.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | @@ -407,13 +447,15 @@ In addition to the documented values, all services also support the following va | redisStore.storageSize | string | `"100Gi"` | PVC Storage Request for `redis-store` data volume | | redisStore.storageSubPath | string | `""` | Optional subPath for the `redis-store` primary data volume mount | | searcher.autoCacheSize | bool | `false` | When enabled, omit the `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB` env vars so `searcher` auto-sizes its cache to ~45% of the live cache volume. This tracks PVC expansion automatically, whereas the hardcoded env vars are frozen to the initial `storageSize` and do not follow later disk growth. | -| searcher.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `searcher` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| searcher.containerSecurityContext | object | `{}` | Override container security context for the `searcher` container | +| searcher.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `searcher` container | +| searcher.defaultPodSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":100}` | Default security context for the `searcher` pod | | searcher.env | object | the chart will add some default environment values | Environment variables for the `searcher` container | | searcher.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `searcher` image | | searcher.image.name | string | `"searcher"` | Docker image name for the `searcher` image | | searcher.name | string | `"searcher"` | Name used by resources. Does not affect service names or PVCs. | | searcher.podDisruptionBudget | object | `{}` | Pod disruption budget for `searcher`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| searcher.podSecurityContext | object | `{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":100}` | Security context for the `searcher` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| searcher.podSecurityContext | object | `{}` | Override pod security context for the `searcher` pod | | searcher.replicaCount | int | `1` | Number of `searcher` pod | | searcher.resources | object | `{"limits":{"cpu":"2","memory":"2G"},"requests":{"cpu":"500m","memory":"500M"}}` | Resource requests & limits for the `searcher` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | searcher.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `searcher` | @@ -423,6 +465,7 @@ In addition to the documented values, all services also support the following va | searcher.storageSubPath | string | `""` | Optional subPath for the `searcher` primary data volume mount | | sgTestConnection | object | `{"enabled":true}` | Enable the busybox connection test after deployment | | sourcegraph.affinity | object | `{}` | Global Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | +| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers Merges with component defaults; component-specific overrides take precedence | | sourcegraph.disableKubernetesSecrets | bool | `false` | Disable the creation of Kubernetes secrets objects | | sourcegraph.gracefulShutdownTimeout | string | `"15s"` | Total time Sourcegraph services have for the pre-shutdown pause and graceful drain | | sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag | @@ -436,6 +479,7 @@ In addition to the documented values, all services also support the following va | sourcegraph.nodeSelector | object | `{}` | Global NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) | | sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods | | sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods | +| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods Merges with component defaults; component-specific overrides take precedence | | sourcegraph.preShutdownPause | string | `"5s"` | Time Sourcegraph services continue accepting requests after shutdown begins so Kubernetes endpoint changes can propagate | | sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) | | sourcegraph.revisionHistoryLimit | int | `10` | Global deployment clean up policy, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) | @@ -448,37 +492,43 @@ In addition to the documented values, all services also support the following va | storageClass.parameters | object | `{}` | Extra parameters of storageClass, consult your cloud provider persistent storage documentation | | storageClass.provisioner | string | `"kubernetes.io/gce-pd"` | Name of the storageClass provisioner, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#provisioner) and consult your cloud provider persistent storage documentation | | storageClass.type | string | `"pd-ssd"` | Value of `type` key in storageClass `parameters`, consult your cloud provider persistent storage documentation | -| syntacticCodeIntel.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `syntactic-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| syntacticCodeIntel.containerSecurityContext | object | `{}` | Override container security context for the `syntactic-code-intel-worker` container | +| syntacticCodeIntel.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `syntactic-code-intel-worker` container | +| syntacticCodeIntel.defaultPodSecurityContext | object | `{}` | Default pod security context for the `syntactic-code-intel-worker` pod | | syntacticCodeIntel.enabled | bool | `false` | | | syntacticCodeIntel.env | object | the chart will add some default environment values | Environment variables for the `syntactic-code-intel-worker` container | | syntacticCodeIntel.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `syntactic-code-intel-worker` image | | syntacticCodeIntel.image.name | string | `"syntactic-code-intel-worker"` | Docker image name for the `syntactic-code-intel-worker` image | | syntacticCodeIntel.name | string | `"syntactic-code-intel-worker"` | Name used by resources. Does not affect service names or PVCs. | | syntacticCodeIntel.podDisruptionBudget | object | `{}` | Pod disruption budget for `syntactic-code-intel-worker`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| syntacticCodeIntel.podSecurityContext | object | `{}` | Security context for the `syntactic-code-intel-worker` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| syntacticCodeIntel.podSecurityContext | object | `{}` | Override pod security context for the `syntactic-code-intel-worker` pod | | syntacticCodeIntel.replicaCount | int | `2` | Number of `syntactic-code-intel-worker` pod | | syntacticCodeIntel.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `syntactic-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | syntacticCodeIntel.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `syntactic-code-intel-worker` | | syntacticCodeIntel.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | -| syntectServer.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `syntect-server` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| syntectServer.containerSecurityContext | object | `{}` | Override container security context for the `syntect-server` container | +| syntectServer.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `syntect-server` container | +| syntectServer.defaultPodSecurityContext | object | `{}` | Default pod security context for the `syntect-server` pod | | syntectServer.env | object | the chart will add some default environment values | Environment variables for the `syntect-server` container | | syntectServer.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `syntect-server` image | | syntectServer.image.name | string | `"syntax-highlighter"` | Docker image name for the `syntect-server` image | | syntectServer.name | string | `"syntect-server"` | Name used by resources. Does not affect service names or PVCs. | | syntectServer.podDisruptionBudget | object | `{}` | Pod disruption budget for `syntect-server`. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| syntectServer.podSecurityContext | object | `{}` | Security context for the `syntect-server` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| syntectServer.podSecurityContext | object | `{}` | Override pod security context for the `syntect-server` pod | | syntectServer.replicaCount | int | `1` | Number of `syntect-server` pod | | syntectServer.resources | object | `{"limits":{"cpu":"4","memory":"6G"},"requests":{"cpu":"250m","memory":"2G"}}` | Resource requests & limits for the `syntect-server` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | syntectServer.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `syntect-server` | | syntectServer.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | | worker.blocklist | list | `[]` | List of jobs to block globally If replicas are configured, use this values to block jobs instead of manually setting WORKER_JOB_BLOCKLIST | -| worker.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | +| worker.containerSecurityContext | object | `{}` | Override container security context for the `worker` container | +| worker.defaultContainerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Default security context for the `worker` container | +| worker.defaultPodSecurityContext | object | `{}` | Default pod security context for the `worker` pod | | worker.env | object | the chart will add some default environment values | Environment variables for the `worker` container | | worker.image.defaultTag | string | `@sha256:`, pinned by each release | Docker image tag for the `worker` image | | worker.image.name | string | `"worker"` | Docker image name for the `worker` image | | worker.name | string | `"worker"` | Name used by resources. Does not affect service names or PVCs. | | worker.podDisruptionBudget | object | `{}` | Pod disruption budget for every `worker` deployment. Configure either `minAvailable` or `maxUnavailable` to enable it. | -| worker.podSecurityContext | object | `{}` | Security context for the `worker` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | +| worker.podSecurityContext | object | `{}` | Override pod security context for the `worker` pod | | worker.replicaCount | int | `1` | Number of `worker` pod | | worker.replicas | list | `[]` | Scale worker horizontally by configuring additional replicas dedicated to specific jobs. for each replica, configure the dedicated jobs to run on this replica. learn more from https://sourcegraph.com/docs/admin/workers#3-split-jobs-and-scale-independently | | worker.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl index d12f414ab..cf4ca4af9 100644 --- a/charts/sourcegraph/templates/_helpers.tpl +++ b/charts/sourcegraph/templates/_helpers.tpl @@ -368,40 +368,6 @@ Resolution order: {{- end -}} {{- end -}} -{{/* -Render the effective redis.conf for a service: the vendored file plus the -chart-managed directives. -Usage: include "sourcegraph.redis.conf" (list . "redisCache") - -The redis Deployments hash this output for their checksum/redis-config -annotation, so it must depend only on the config, never on release metadata -such as the chart version; otherwise every upgrade restarts redis. -*/}} -{{- define "sourcegraph.redis.conf" -}} -{{- $top := index . 0 -}} -{{- $service := index . 1 -}} -{{- $config := (index $top.Values $service).config -}} -{{- $dir := kebabcase $service -}} -{{- $body := $top.Files.Get (printf "files/%s/redis.conf" $dir) | trimSuffix "\n" -}} -{{- if not $body -}} -{{- fail (printf "no vendored redis.conf found at files/%s/redis.conf for service %s" $dir $service) -}} -{{- end -}} -{{- $overrides := list -}} -{{- with include "sourcegraph.redis.maxmemory" (list $top $service) -}} -{{- $overrides = append $overrides (printf "maxmemory %s" .) -}} -{{- end -}} -{{- with $config.maxmemoryPolicy -}} -{{- $overrides = append $overrides (printf "maxmemory-policy %s" .) -}} -{{- end -}} -{{- with $config.additionalConfig -}} -{{- $overrides = append $overrides (tpl . $top | trim) -}} -{{- end -}} -{{- if $overrides -}} -{{- $body = printf "%s\n\n# Chart-managed directives. Redis applies the last occurrence of a directive.\n%s" $body (join "\n" $overrides) -}} -{{- end -}} -{{- $body -}} -{{- end -}} - {{/* Fail the render when a service's extra volumes or volume mounts collide with the chart-managed redis config mount. Without this the collision only surfaces as an diff --git a/charts/sourcegraph/templates/_helpers/_securityContext.tpl b/charts/sourcegraph/templates/_helpers/_securityContext.tpl new file mode 100644 index 000000000..993de2e0a --- /dev/null +++ b/charts/sourcegraph/templates/_helpers/_securityContext.tpl @@ -0,0 +1,120 @@ +{{/* + +Security context helpers for container and pod security contexts. + +These helpers implement a 3-tier merge precedence: +1. Component default (e.g., .Values.frontend.defaultContainerSecurityContext) +2. Global override (e.g., .Values.sourcegraph.containerSecurityContext) +3. Component override (e.g., .Values.frontend.containerSecurityContext) + +Later values override earlier ones, allowing customers to: +- Set global security context settings that apply to all components +- Override specific components as needed +- Retain Sourcegraph's secure defaults when no overrides are specified + +Supports nested paths like "openTelemetry" "gateway" or "codeInsightsDB" "init". + +*/}} + +{{/* +Internal: walk the component path and merge default, global, and component +override security contexts. Returns the merged map as YAML. + +Parameters: + - $ (root context) + - default key, e.g. "defaultContainerSecurityContext" + - override key, e.g. "containerSecurityContext"; also the global key under .Values.sourcegraph + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergeSecurityContext" -}} +{{- $root := index . 0 -}} +{{- $defaultKey := index . 1 -}} +{{- $overrideKey := index . 2 -}} +{{- $component := $root.Values -}} +{{- range slice . 3 -}} +{{- $component = index $component . | default dict -}} +{{- end -}} +{{- $default := index $component $defaultKey | default dict -}} +{{- $global := index $root.Values.sourcegraph $overrideKey | default dict -}} +{{- $override := index $component $overrideKey | default dict -}} +{{- mustMergeOverwrite (deepCopy $default) $global $override | toYaml -}} +{{- end -}} + +{{/* +Merged container security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedContainerSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedContainerSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultContainerSecurityContext" "containerSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Merged pod security context as YAML. Pipe through fromYaml to read fields. + +Usage: + {{- $merged := include "sourcegraph.mergedPodSecurityContext" (list . "frontend") | fromYaml }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) +*/}} +{{- define "sourcegraph.mergedPodSecurityContext" -}} +{{- include "sourcegraph.mergeSecurityContext" (concat (list (index . 0) "defaultPodSecurityContext" "podSecurityContext") (slice . 1)) -}} +{{- end -}} + +{{/* +Internal: render a map as a "securityContext:" block, or nothing if empty. +The output includes a leading newline for proper YAML formatting. + +Parameters: + - merged security context map + - indent level (integer) +*/}} +{{- define "sourcegraph.renderSecurityContext" -}} +{{- $merged := index . 0 -}} +{{- $indent := int (index . 1) -}} +{{- if $merged }} +{{ "securityContext:" | indent $indent }} +{{ toYaml $merged | indent (int (add $indent 2)) -}} +{{- end -}} +{{- end -}} + +{{/* +Container security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.containerSecurityContext" (list . "frontend" 8) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.containerSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedContainerSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} + +{{/* +Pod security context with 3-tier merge, rendered as a "securityContext:" block. + +Usage: + {{- include "sourcegraph.podSecurityContext" (list . "frontend" 6) }} + +Parameters: + - $ (root context) + - component path segments (one or more strings) + - indent level (integer) as the last parameter +*/}} +{{- define "sourcegraph.podSecurityContext" -}} +{{- $last := sub (len .) 1 -}} +{{- $merged := include "sourcegraph.mergedPodSecurityContext" (slice . 0 $last) | fromYaml -}} +{{- include "sourcegraph.renderSecurityContext" (list $merged (index . $last)) -}} +{{- end -}} diff --git a/charts/sourcegraph/templates/_worker.tpl b/charts/sourcegraph/templates/_worker.tpl index 2b087e7f2..244b533d5 100644 --- a/charts/sourcegraph/templates/_worker.tpl +++ b/charts/sourcegraph/templates/_worker.tpl @@ -125,8 +125,7 @@ spec: resources: {{- toYaml $resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml $top.Values.worker.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list $top "worker" 8) }} volumeMounts: {{- if $top.Values.worker.extraVolumeMounts }} {{- toYaml $top.Values.worker.extraVolumeMounts | nindent 8 }} @@ -134,8 +133,7 @@ spec: {{- if $top.Values.worker.extraContainers }} {{- toYaml $top.Values.worker.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml $top.Values.worker.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list $top "worker" 6) }} {{- include "sourcegraph.nodeSelector" (list $top "worker" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list $top "worker" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list $top "worker") | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml index 2a330d383..98f7cc4d2 100644 --- a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml +++ b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml @@ -75,8 +75,7 @@ spec: resources: {{- toYaml .Values.blobstore.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.blobstore.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "blobstore" 8) }} volumeMounts: - name: blobstore-data mountPath: /data @@ -91,8 +90,7 @@ spec: {{- if .Values.blobstore.extraContainers }} {{- toYaml .Values.blobstore.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.blobstore.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "blobstore" 6) }} {{- include "sourcegraph.nodeSelector" (list . "blobstore" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "blobstore" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "blobstore") | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml b/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml index e9814a4e7..25779e459 100644 --- a/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml +++ b/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml @@ -42,6 +42,8 @@ spec: deploy: sourcegraph app: cadvisor spec: + {{- /* /dev/kmsg is only readable by a privileged container */}} + {{- $privileged := (include "sourcegraph.mergedContainerSecurityContext" (list . "cadvisor") | fromYaml).privileged }} {{- include "sourcegraph.renderServiceAccountName" (list . "cadvisor") | trim | nindent 6 }} containers: - name: cadvisor @@ -64,8 +66,7 @@ spec: resources: {{- toYaml .Values.cadvisor.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.cadvisor.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "cadvisor" 8) }} volumeMounts: - name: rootfs mountPath: /rootfs @@ -82,7 +83,7 @@ spec: - name: disk mountPath: /dev/disk readOnly: true - {{- if .Values.cadvisor.containerSecurityContext.privileged }} + {{- if $privileged }} - name: kmsg mountPath: /dev/kmsg readOnly: true @@ -99,8 +100,7 @@ spec: {{- end }} automountServiceAccountToken: false terminationGracePeriodSeconds: 30 - securityContext: - {{- toYaml .Values.cadvisor.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "cadvisor" 6) }} {{- include "sourcegraph.nodeSelector" (list . "cadvisor" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "cadvisor" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "cadvisor" ) | trim }}{{ . | nindent 6 }}{{- end }} @@ -125,7 +125,7 @@ spec: - name: disk hostPath: path: /dev/disk - {{- if .Values.cadvisor.containerSecurityContext.privileged }} + {{- if $privileged }} - name: kmsg hostPath: path: /dev/kmsg diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml index d0585e3fa..4d5c169c0 100644 --- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml +++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml @@ -54,8 +54,7 @@ spec: {{- if .Values.codeInsightsDB.storageSubPath }} subPath: {{ .Values.codeInsightsDB.storageSubPath }} {{- end }} - securityContext: - {{- toYaml .Values.codeInsightsDB.init.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "codeInsightsDB" "init" 8) }} {{- if not .Values.sourcegraph.localDevMode }} resources: {{- toYaml .Values.alpine.resources | nindent 10 }} @@ -88,8 +87,7 @@ spec: resources: {{- toYaml .Values.codeInsightsDB.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.codeInsightsDB.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "codeInsightsDB" 8) }} volumeMounts: - mountPath: /var/lib/postgresql/data/ name: disk @@ -120,14 +118,12 @@ spec: resources: {{- toYaml .Values.postgresExporter.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.postgresExporter.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "postgresExporter" 8) }} terminationMessagePolicy: FallbackToLogsOnError {{- if .Values.codeInsightsDB.extraContainers }} {{- toYaml .Values.codeInsightsDB.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.codeInsightsDB.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "codeInsightsDB" 6) }} {{- include "sourcegraph.nodeSelector" (list . "codeInsightsDB" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "codeInsightsDB" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "codeInsightsDB" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml index eff5c7275..3aec9eb9a 100644 --- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml +++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml @@ -54,8 +54,7 @@ spec: {{- if .Values.codeIntelDB.storageSubPath }} subPath: {{ .Values.codeIntelDB.storageSubPath }} {{- end }} - securityContext: - {{- toYaml .Values.alpine.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "alpine" 8) }} {{- if not .Values.sourcegraph.localDevMode }} resources: {{- toYaml .Values.alpine.resources | nindent 10 }} @@ -99,8 +98,7 @@ spec: resources: {{- toYaml .Values.codeIntelDB.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.codeIntelDB.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "codeIntelDB" 8) }} volumeMounts: - mountPath: /data name: disk @@ -131,15 +129,13 @@ spec: resources: {{- toYaml .Values.postgresExporter.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.postgresExporter.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "postgresExporter" 8) }} terminationMessagePolicy: FallbackToLogsOnError {{- if .Values.codeIntelDB.extraContainers }} {{- toYaml .Values.codeIntelDB.extraContainers | nindent 6 }} {{- end }} terminationGracePeriodSeconds: 120 - securityContext: - {{- toYaml .Values.codeIntelDB.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "codeIntelDB" 6) }} {{- include "sourcegraph.nodeSelector" (list . "codeIntelDB" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "codeIntelDB" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "codeIntelDB" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml index 41575281d..9a6b2c801 100644 --- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml +++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml @@ -71,8 +71,7 @@ spec: resources: {{- toYaml .Values.migrator.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.migrator.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "migrator" 8) }} volumeMounts: {{- if .Values.migrator.extraVolumeMounts }} {{- toYaml .Values.migrator.extraVolumeMounts | nindent 8 }} @@ -131,8 +130,7 @@ spec: resources: {{- toYaml .Values.frontend.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.frontend.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "frontend" 8) }} volumeMounts: - mountPath: /home/sourcegraph name: home-dir @@ -142,8 +140,7 @@ spec: {{- if .Values.frontend.extraContainers }} {{- toYaml .Values.frontend.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.frontend.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "frontend" 6) }} {{- include "sourcegraph.nodeSelector" (list . "frontend" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "frontend" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "frontend" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml index 4a4f7ccae..074351104 100644 --- a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml +++ b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml @@ -93,8 +93,7 @@ spec: resources: {{- toYaml .Values.gitserver.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.gitserver.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "gitserver" 8) }} volumeMounts: - mountPath: /tmp name: tmpdir @@ -113,8 +112,7 @@ spec: {{- if .Values.gitserver.extraContainers }} {{- toYaml .Values.gitserver.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.gitserver.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "gitserver" 6) }} {{- include "sourcegraph.nodeSelector" (list . "gitserver" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "gitserver" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "gitserver" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml index 1dfc52b51..bf07d8c2d 100644 --- a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml +++ b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml @@ -85,14 +85,12 @@ spec: resources: {{- toYaml .Values.grafana.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.grafana.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "grafana" 8) }} {{- if .Values.grafana.extraContainers }} {{- toYaml .Values.grafana.extraContainers | nindent 6 }} {{- end }} {{- include "sourcegraph.renderServiceAccountName" (list . "grafana") | trim | nindent 6 }} - securityContext: - {{- toYaml .Values.grafana.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "grafana" 6) }} {{- include "sourcegraph.nodeSelector" (list . "grafana" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "grafana" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "grafana" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml index 0b1b63178..08df63e53 100644 --- a/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml +++ b/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml @@ -84,8 +84,7 @@ spec: resources: {{- toYaml .Values.indexedSearch.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.indexedSearch.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "indexedSearch" 8) }} volumeMounts: - mountPath: /data name: data @@ -116,8 +115,7 @@ spec: resources: {{- toYaml .Values.indexedSearchIndexer.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.indexedSearchIndexer.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "indexedSearchIndexer" 8) }} volumeMounts: - mountPath: /data name: data @@ -130,8 +128,7 @@ spec: {{- if .Values.indexedSearch.extraContainers }} {{- toYaml .Values.indexedSearch.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.indexedSearch.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "indexedSearch" 6) }} {{- include "sourcegraph.nodeSelector" (list . "indexedSearch" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "indexedSearch" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "indexedSearch" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml index 75c8961e8..2b0931ac1 100644 --- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml +++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml @@ -86,8 +86,7 @@ spec: resources: {{- toYaml .Values.jaeger.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.jaeger.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "jaeger" 8) }} volumeMounts: - name: jaeger-config mountPath: /etc/jaeger/jaeger-config.yaml @@ -99,8 +98,7 @@ spec: {{- if .Values.jaeger.extraContainers }} {{- toYaml .Values.jaeger.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.jaeger.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "jaeger" 6) }} {{- include "sourcegraph.nodeSelector" (list . "jaeger" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "jaeger" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "jaeger" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml b/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml index db0bc0c3e..afe338eca 100644 --- a/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml +++ b/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml @@ -70,8 +70,7 @@ spec: resources: {{- toYaml .Values.nodeExporter.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.nodeExporter.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "nodeExporter" 8) }} volumeMounts: - name: rootfs mountPath: /host/root @@ -116,8 +115,7 @@ spec: {{- end }} automountServiceAccountToken: false terminationGracePeriodSeconds: 30 - securityContext: - {{- toYaml .Values.nodeExporter.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "nodeExporter" 6) }} {{- include "sourcegraph.nodeSelector" (list . "nodeExporter" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "nodeExporter" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "nodeExporter" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml index d93c64b62..2e0b24644 100644 --- a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml +++ b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml @@ -58,8 +58,7 @@ spec: {{- end }} resources: {{- toYaml .Values.openTelemetry.agent.resources | nindent 10 }} - securityContext: - {{- toYaml .Values.openTelemetry.agent.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "openTelemetry" "agent" 8) }} readinessProbe: httpGet: path: / @@ -82,6 +81,7 @@ spec: - name: config mountPath: /etc/otel-agent terminationGracePeriodSeconds: 120 + {{- include "sourcegraph.podSecurityContext" (list . "openTelemetry" "agent" 6) }} {{- include "sourcegraph.nodeSelector" (list . "openTelemetry" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "openTelemetry" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "openTelemetry" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml index 38d6d7c2f..17039b8f5 100644 --- a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml +++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml @@ -74,8 +74,7 @@ spec: {{- end }} resources: {{- toYaml .Values.openTelemetry.gateway.resources | nindent 10 }} - securityContext: - {{- toYaml .Values.openTelemetry.gateway.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "openTelemetry" "gateway" 8) }} readinessProbe: httpGet: path: / @@ -103,6 +102,7 @@ spec: mountPath: /tls {{- end }} terminationGracePeriodSeconds: 120 + {{- include "sourcegraph.podSecurityContext" (list . "openTelemetry" "gateway" 6) }} {{- include "sourcegraph.nodeSelector" (list . "openTelemetry" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "openTelemetry" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "openTelemetry" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml b/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml index adccd43fb..1218b8214 100644 --- a/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml +++ b/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml @@ -54,8 +54,7 @@ spec: {{- if .Values.pgsql.storageSubPath }} subPath: {{ .Values.pgsql.storageSubPath }} {{- end }} - securityContext: - {{- toYaml .Values.alpine.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "alpine" 8) }} {{- if not .Values.sourcegraph.localDevMode }} resources: {{- toYaml .Values.alpine.resources | nindent 10 }} @@ -99,8 +98,7 @@ spec: resources: {{- toYaml .Values.pgsql.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.pgsql.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "pgsql" 8) }} volumeMounts: - mountPath: /data name: disk @@ -133,15 +131,13 @@ spec: resources: {{- toYaml .Values.postgresExporter.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.postgresExporter.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "postgresExporter" 8) }} terminationMessagePolicy: FallbackToLogsOnError {{- if .Values.pgsql.extraContainers }} {{- toYaml .Values.pgsql.extraContainers | nindent 6 }} {{- end }} terminationGracePeriodSeconds: 120 - securityContext: - {{- toYaml .Values.pgsql.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "pgsql" 6) }} {{- include "sourcegraph.nodeSelector" (list . "pgsql" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "pgsql" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "pgsql" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml index 74e59a483..bd08aaf20 100644 --- a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml +++ b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml @@ -97,8 +97,7 @@ spec: resources: {{- toYaml .Values.preciseCodeIntel.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.preciseCodeIntel.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "preciseCodeIntel" 8) }} volumeMounts: - mountPath: /tmp name: tmpdir @@ -108,13 +107,13 @@ spec: {{- if .Values.preciseCodeIntel.extraContainers }} {{- toYaml .Values.preciseCodeIntel.extraContainers | nindent 6 }} {{- end }} - {{- $podSecurityContext := deepCopy .Values.preciseCodeIntel.podSecurityContext }} + {{- $podSecurityContext := include "sourcegraph.mergedPodSecurityContext" (list . "preciseCodeIntel") | fromYaml }} {{- if eq $storageType "pvc" }} {{- /* A freshly provisioned volume is root-owned, so the non-root worker needs fsGroup to write /tmp. */}} - {{- $podSecurityContext = merge $podSecurityContext (dict "fsGroup" (.Values.preciseCodeIntel.containerSecurityContext.runAsGroup | default 101) "fsGroupChangePolicy" "OnRootMismatch") }} + {{- $runAsGroup := (include "sourcegraph.mergedContainerSecurityContext" (list . "preciseCodeIntel") | fromYaml).runAsGroup | default 101 }} + {{- $podSecurityContext = merge $podSecurityContext (dict "fsGroup" $runAsGroup "fsGroupChangePolicy" "OnRootMismatch") }} {{- end }} - securityContext: - {{- toYaml $podSecurityContext | nindent 8 }} + {{- include "sourcegraph.renderSecurityContext" (list $podSecurityContext 6) }} {{- include "sourcegraph.nodeSelector" (list . "preciseCodeIntel" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "preciseCodeIntel" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "preciseCodeIntel" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml index 608379c47..fba2b2f9a 100644 --- a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml +++ b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml @@ -82,14 +82,12 @@ spec: resources: {{- toYaml .Values.prometheus.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.prometheus.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "prometheus" 8) }} {{- if .Values.prometheus.extraContainers }} {{- toYaml .Values.prometheus.extraContainers | nindent 6 }} {{- end }} terminationGracePeriodSeconds: 120 - securityContext: - {{- toYaml .Values.prometheus.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "prometheus" 6) }} {{- include "sourcegraph.nodeSelector" (list . "prometheus" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "prometheus" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "prometheus" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/redis/redis-cache.ConfigMap.yaml b/charts/sourcegraph/templates/redis/redis-cache.ConfigMap.yaml index fc2b350ed..bfecbc7e4 100644 --- a/charts/sourcegraph/templates/redis/redis-cache.ConfigMap.yaml +++ b/charts/sourcegraph/templates/redis/redis-cache.ConfigMap.yaml @@ -3,6 +3,20 @@ {{- fail "You can only define one of 'redisCache.config.existingConfig' and 'redisCache.config.additionalConfig' at a time" }} {{- end }} {{- if not .Values.redisCache.config.existingConfig -}} +{{- $body := .Files.Get "files/redis-cache/redis.conf" | trimSuffix "\n" -}} +{{- $overrides := list -}} +{{- with include "sourcegraph.redis.maxmemory" (list . "redisCache") -}} +{{- $overrides = append $overrides (printf "maxmemory %s" .) -}} +{{- end -}} +{{- with .Values.redisCache.config.maxmemoryPolicy -}} +{{- $overrides = append $overrides (printf "maxmemory-policy %s" .) -}} +{{- end -}} +{{- with .Values.redisCache.config.additionalConfig -}} +{{- $overrides = append $overrides (tpl . $ | trim) -}} +{{- end -}} +{{- if $overrides -}} +{{- $body = printf "%s\n\n# Chart-managed directives. Redis applies the last occurrence of a directive.\n%s" $body (join "\n" $overrides) -}} +{{- end -}} apiVersion: v1 kind: ConfigMap metadata: @@ -18,6 +32,6 @@ metadata: name: {{ .Values.redisCache.name }}-conf data: redis.conf: | - {{- include "sourcegraph.redis.conf" (list . "redisCache") | nindent 4 }} + {{- $body | nindent 4 }} {{- end }} {{- end }} diff --git a/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml b/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml index 8492a9624..842abfdcc 100644 --- a/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml +++ b/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml @@ -30,7 +30,7 @@ spec: annotations: kubectl.kubernetes.io/default-container: redis-cache {{- if and .Values.redisCache.config.enabled (not .Values.redisCache.config.existingConfig) }} - checksum/redis-config: {{ include "sourcegraph.redis.conf" (list . "redisCache") | sha256sum }} + checksum/redis-config: {{ include (print $.Template.BasePath "/redis/redis-cache.ConfigMap.yaml") . | sha256sum }} {{- end }} {{- if .Values.sourcegraph.podAnnotations }} {{- toYaml .Values.sourcegraph.podAnnotations | nindent 8 }} @@ -98,8 +98,7 @@ spec: resources: {{- toYaml .Values.redisCache.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.redisCache.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "redisCache" 8) }} volumeMounts: - mountPath: /redis-data name: redis-data @@ -131,13 +130,11 @@ spec: resources: {{- toYaml .Values.redisExporter.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.redisExporter.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "redisExporter" 8) }} {{- if .Values.redisCache.extraContainers }} {{- toYaml .Values.redisCache.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.redisCache.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "redisCache" 6) }} {{- include "sourcegraph.nodeSelector" (list . "redisCache" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "redisCache" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "redisCache" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/redis/redis-store.ConfigMap.yaml b/charts/sourcegraph/templates/redis/redis-store.ConfigMap.yaml index dca95755d..6cf4246c7 100644 --- a/charts/sourcegraph/templates/redis/redis-store.ConfigMap.yaml +++ b/charts/sourcegraph/templates/redis/redis-store.ConfigMap.yaml @@ -3,6 +3,20 @@ {{- fail "You can only define one of 'redisStore.config.existingConfig' and 'redisStore.config.additionalConfig' at a time" }} {{- end }} {{- if not .Values.redisStore.config.existingConfig -}} +{{- $body := .Files.Get "files/redis-store/redis.conf" | trimSuffix "\n" -}} +{{- $overrides := list -}} +{{- with include "sourcegraph.redis.maxmemory" (list . "redisStore") -}} +{{- $overrides = append $overrides (printf "maxmemory %s" .) -}} +{{- end -}} +{{- with .Values.redisStore.config.maxmemoryPolicy -}} +{{- $overrides = append $overrides (printf "maxmemory-policy %s" .) -}} +{{- end -}} +{{- with .Values.redisStore.config.additionalConfig -}} +{{- $overrides = append $overrides (tpl . $ | trim) -}} +{{- end -}} +{{- if $overrides -}} +{{- $body = printf "%s\n\n# Chart-managed directives. Redis applies the last occurrence of a directive.\n%s" $body (join "\n" $overrides) -}} +{{- end -}} apiVersion: v1 kind: ConfigMap metadata: @@ -18,6 +32,6 @@ metadata: name: {{ .Values.redisStore.name }}-conf data: redis.conf: | - {{- include "sourcegraph.redis.conf" (list . "redisStore") | nindent 4 }} + {{- $body | nindent 4 }} {{- end }} {{- end }} diff --git a/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml b/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml index c1a726a0f..c8533a727 100644 --- a/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml +++ b/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml @@ -30,7 +30,7 @@ spec: annotations: kubectl.kubernetes.io/default-container: redis-store {{- if and .Values.redisStore.config.enabled (not .Values.redisStore.config.existingConfig) }} - checksum/redis-config: {{ include "sourcegraph.redis.conf" (list . "redisStore") | sha256sum }} + checksum/redis-config: {{ include (print $.Template.BasePath "/redis/redis-store.ConfigMap.yaml") . | sha256sum }} {{- end }} {{- if .Values.sourcegraph.podAnnotations }} {{- toYaml .Values.sourcegraph.podAnnotations | nindent 8 }} @@ -97,8 +97,7 @@ spec: resources: {{- toYaml .Values.redisStore.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.redisStore.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "redisStore" 8) }} volumeMounts: - mountPath: /redis-data name: redis-data @@ -130,13 +129,11 @@ spec: resources: {{- toYaml .Values.redisExporter.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.redisExporter.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "redisExporter" 8) }} {{- if .Values.redisStore.extraContainers }} {{- toYaml .Values.redisStore.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.redisStore.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "redisStore" 6) }} {{- include "sourcegraph.nodeSelector" (list . "redisStore" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "redisStore" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "redisStore" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml b/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml index 76c71d47a..cb5d05a47 100644 --- a/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml +++ b/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml @@ -106,13 +106,11 @@ spec: resources: {{- toYaml .Values.searcher.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.searcher.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "searcher" 8) }} {{- if .Values.searcher.extraContainers }} {{- toYaml .Values.searcher.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.searcher.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "searcher" 6) }} {{- include "sourcegraph.nodeSelector" (list . "searcher" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "searcher" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "searcher" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml index b5ace0f20..05549b94c 100644 --- a/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml +++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml @@ -94,8 +94,7 @@ spec: resources: {{- toYaml .Values.syntacticCodeIntel.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.syntacticCodeIntel.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "syntacticCodeIntel" 8) }} volumeMounts: - mountPath: /tmp name: tmpdir @@ -105,8 +104,7 @@ spec: {{- if .Values.syntacticCodeIntel.extraContainers }} {{- toYaml .Values.syntacticCodeIntel.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.syntacticCodeIntel.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "syntacticCodeIntel" 6) }} {{- include "sourcegraph.nodeSelector" (list . "syntacticCodeIntel" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "syntacticCodeIntel" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "syntacticCodeIntel" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml index 1195f6ad9..25bf5978d 100644 --- a/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml +++ b/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml @@ -80,8 +80,7 @@ spec: resources: {{- toYaml .Values.syntectServer.resources | nindent 10 }} {{- end }} - securityContext: - {{- toYaml .Values.syntectServer.containerSecurityContext | nindent 10 }} + {{- include "sourcegraph.containerSecurityContext" (list . "syntectServer" 8) }} volumeMounts: {{- if .Values.syntectServer.extraVolumeMounts }} {{- toYaml .Values.syntectServer.extraVolumeMounts | nindent 8 }} @@ -89,8 +88,7 @@ spec: {{- if .Values.syntectServer.extraContainers }} {{- toYaml .Values.syntectServer.extraContainers | nindent 6 }} {{- end }} - securityContext: - {{- toYaml .Values.syntectServer.podSecurityContext | nindent 8 }} + {{- include "sourcegraph.podSecurityContext" (list . "syntectServer" 6) }} {{- include "sourcegraph.nodeSelector" (list . "syntectServer" ) | trim | nindent 6 }} {{- include "sourcegraph.affinity" (list . "syntectServer" ) | trim | nindent 6 }} {{- with include "sourcegraph.priorityClassName" (list . "syntectServer" ) | trim }}{{ . | nindent 6 }}{{- end }} diff --git a/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml b/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml index 7c2d86bf6..e8589ad5c 100644 --- a/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml +++ b/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml @@ -116,11 +116,10 @@ tests: - failedTemplate: errorMessage: 'preciseCodeIntel.storageType must be one of emptyDir, pvc; got "PVC"' -- it: should leave the pod securityContext untouched on the emptyDir branch +- it: should not set a pod securityContext on the emptyDir branch asserts: - - equal: + - notExists: path: spec.template.spec.securityContext - value: {} - it: should set fsGroup to the container runAsGroup on the pvc branch so /tmp is writable set: @@ -134,6 +133,21 @@ tests: fsGroup: 101 fsGroupChangePolicy: OnRootMismatch +- it: should set fsGroup to the global runAsGroup on the pvc branch + set: + sourcegraph: + containerSecurityContext: + runAsGroup: 3000 + preciseCodeIntel: + storageType: pvc + storageSize: 50Gi + asserts: + - equal: + path: spec.template.spec.securityContext + value: + fsGroup: 3000 + fsGroupChangePolicy: OnRootMismatch + - it: should keep a user-set fsGroup and other podSecurityContext fields on the pvc branch set: preciseCodeIntel: diff --git a/charts/sourcegraph/tests/redisConfigChecksum_test.yaml b/charts/sourcegraph/tests/redisConfigChecksum_test.yaml deleted file mode 100644 index a0b131525..000000000 --- a/charts/sourcegraph/tests/redisConfigChecksum_test.yaml +++ /dev/null @@ -1,165 +0,0 @@ -suite: redis config checksum -templates: - - templates/redis/redis-store.Deployment.yaml - - templates/redis/redis-cache.Deployment.yaml -tests: - # The checksum must cover the rendered redis.conf body and nothing else. - # Hashing the whole ConfigMap manifest pulls in the helm.sh/chart label, so - # every chart build changes it and restarts redis even when the config is - # byte-identical. These pin the hash for a fixed config, so any change that - # lets unrelated input back in fails here. - # - # Editing a vendored files/redis-*/redis.conf changes these hashes on purpose. - # Re-pin by rendering the ConfigMap for the same values and hashing its - # redis.conf body, e.g. - # helm template charts/sourcegraph --set redisStore.config.enabled=true \ - # --set redisStore.resources.limits.memory=7Gi \ - # -s templates/redis/redis-store.ConfigMap.yaml - - it: pins the redis-store checksum for a fixed config - templates: - - templates/redis/redis-store.Deployment.yaml - set: - redisStore.config.enabled: true - redisStore.resources.limits.memory: 7Gi - asserts: - - equal: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: &pinnedStoreChecksum f65e9a885e0fd9df5e9f4c3dc6dbcf5b05f11b997d375f5272f7a3c9397f65e5 - - - it: pins the redis-cache checksum for a fixed config - templates: - - templates/redis/redis-cache.Deployment.yaml - set: - redisCache.config.enabled: true - redisCache.resources.limits.memory: 10Gi - asserts: - - equal: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: 0a0f0bb343c5d37ed52bcebf58fd3dbe10f54423c9d920aa90ac8504ee108877 - - # The chart version is the specific input that caused the fleet-wide restarts: - # it is bumped on every release and reached the hash via the ConfigMap labels. - - it: does not change when only the chart version changes - templates: - - templates/redis/redis-cache.Deployment.yaml - chart: - version: 8.0.0 - appVersion: 8.0.0 - set: - redisCache.config: - enabled: true - maxmemory: 1gb - asserts: - - equal: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: &pinnedCacheChecksum 57f261f5131adbefd08fe4181b50b898b68f386949f8bbc10f747da37e178f74 - - - it: keeps the same checksum on a later chart version - templates: - - templates/redis/redis-cache.Deployment.yaml - chart: - version: 9.9.9 - appVersion: 9.9.9 - set: - redisCache.config: - enabled: true - maxmemory: 1gb - asserts: - - equal: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedCacheChecksum - - - it: changes when an explicit maxmemory changes - templates: - - templates/redis/redis-cache.Deployment.yaml - chart: - version: 9.9.9 - appVersion: 9.9.9 - set: - redisCache.config: - enabled: true - maxmemory: 2gb - asserts: - - notEqual: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedCacheChecksum - - # Unrelated input must not reach the hash. These are the regressions that - # caused redis to roll on every chart build. - - it: does not change when an unrelated global label changes - templates: - - templates/redis/redis-store.Deployment.yaml - set: - redisStore.config.enabled: true - redisStore.resources.limits.memory: 7Gi - sourcegraph.labels.team: platform - asserts: - - equal: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedStoreChecksum - - - it: does not change when the sourcegraph image tag changes - templates: - - templates/redis/redis-store.Deployment.yaml - set: - redisStore.config.enabled: true - redisStore.resources.limits.memory: 7Gi - sourcegraph.image.tag: some-new-build - asserts: - - equal: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedStoreChecksum - - # Real config changes must still roll redis, otherwise the annotation is useless. - - it: changes when the memory limit changes the derived maxmemory - templates: - - templates/redis/redis-store.Deployment.yaml - set: - redisStore.config.enabled: true - redisStore.resources.limits.memory: 14Gi - asserts: - - notEqual: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedStoreChecksum - - - it: changes when maxmemoryPolicy is set - templates: - - templates/redis/redis-store.Deployment.yaml - set: - redisStore.config.enabled: true - redisStore.resources.limits.memory: 7Gi - redisStore.config.maxmemoryPolicy: allkeys-lru - asserts: - - notEqual: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedStoreChecksum - - - it: changes when additionalConfig is set - templates: - - templates/redis/redis-store.Deployment.yaml - set: - redisStore.config.enabled: true - redisStore.resources.limits.memory: 7Gi - redisStore.config.additionalConfig: io-threads 4 - asserts: - - notEqual: - path: spec.template.metadata.annotations["checksum/redis-config"] - value: *pinnedStoreChecksum - - - it: is absent when the chart-managed config is disabled - set: - redisStore.config.enabled: false - redisCache.config.enabled: false - asserts: - - notExists: - path: spec.template.metadata.annotations["checksum/redis-config"] - - - it: is absent when an existingConfig is supplied - set: - redisStore.config.enabled: true - redisCache.config.enabled: true - redisStore.config.existingConfig: my-own-redis-conf - redisCache.config.existingConfig: my-own-redis-conf - asserts: - - notExists: - path: spec.template.metadata.annotations["checksum/redis-config"] diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 9b2f3b772..52bba4a14 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -49,6 +49,12 @@ sourcegraph: serviceLabels: {} # -- Disable the creation of Kubernetes secrets objects disableKubernetesSecrets: false + # -- Global container security context override applied to all containers + # Merges with component defaults; component-specific overrides take precedence + containerSecurityContext: {} + # -- Global pod security context override applied to all pods + # Merges with component defaults; component-specific overrides take precedence + podSecurityContext: {} # Generic application configuration options, used by most applications below # app: # Generally matches directory name @@ -79,7 +85,9 @@ sourcegraph: # # Set resource requests / limits # resources: {} # containerSecurityContext: {} +# learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) # podSecurityContext: {} +# learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) # # Add additional volumes and mounts to deployments # extraVolumeMounts: {} # extraVolumes: {} @@ -101,20 +109,22 @@ sourcegraph: # enabled: true alpine: - # Used in init containers + # Used in init containers for database statefulSets image: # -- Docker image tag for the `alpine` image # @default -- `@sha256:`, pinned by each release defaultTag: 8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963 # -- Docker image name for the `alpine` image name: "alpine-3.14" - # -- Security context for the `alpine` initContainer, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `alpine` initContainer + # Used in init containers for pgsql and codeintel-db statefulSets, not codeinsights-db + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 999 runAsGroup: 999 readOnlyRootFilesystem: true + # -- Override container security context for the `alpine` initContainer + containerSecurityContext: {} # -- Resource requests & limits for the `alpine` initContainer, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) resources: @@ -150,9 +160,8 @@ cadvisor: create: true # -- Name of the ServiceAccount to be created or an existing ServiceAccount name: cadvisor - # -- Security context for the `cadvisor` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `cadvisor` container + defaultContainerSecurityContext: # You may set `privileged` to `false and `cadvisor` will run with reduced privileges. # `cadvisor` requires root privileges in order to display provisioning metrics. # These metrics provide critical information to help you scale the Sourcegraph deployment. @@ -162,6 +171,12 @@ cadvisor: # You may also run `cadvisor` with reduced privileges by setting # `cadvisor.containerSecurityContext.privileged=false` in your override file privileged: true + # -- Override container security context for the `cadvisor` container + containerSecurityContext: {} + # -- Default pod security context for `cadvisor` + defaultPodSecurityContext: {} + # -- Override pod security context for `cadvisor` + podSecurityContext: {} codeInsightsDB: # -- Enable `codeinsights-db` PostgreSQL server @@ -197,21 +212,23 @@ codeInsightsDB: defaultTag: 8.1.2687@sha256:b7e2df5a6a63e323987eeaca23fe9f05278d4c97f96f1994b89dac3c60dedcd3 # -- Docker image name for the `codeinsights-db` image name: "postgresql-16-codeinsights" - # -- Security context for the `codeinsights-db` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `codeinsights-db` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 70 runAsGroup: 70 readOnlyRootFilesystem: true + # -- Override container security context for the `codeinsights-db` container + containerSecurityContext: {} init: - # -- Security context for the `alpine` initContainer, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `alpine` initContainer + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 70 runAsGroup: 70 readOnlyRootFilesystem: true + # -- Override container security context for the `alpine` initContainer + containerSecurityContext: {} # -- Configuration for the `pgsql-exporter` sidecar container postgresExporter: {} # -- Name used by resources. Does not affect service names or PVCs. @@ -225,12 +242,13 @@ codeInsightsDB: requests: cpu: "4" memory: 2Gi - # -- Security context for the `codeinsights-db` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `codeinsights-db` pod + defaultPodSecurityContext: runAsUser: 70 fsGroup: 70 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `codeinsights-db` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `codeinsights-db` create: false @@ -275,13 +293,14 @@ codeIntelDB: defaultTag: 8.1.2687@sha256:cc810cd21f1df7776aa270f49bdd50a4ec3375623ffae1f0238c20dec054bf03 # -- Docker image name for the `codeintel-db` image name: "postgresql-16" - # -- Security context for the `codeintel-db` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `codeintel-db` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 999 runAsGroup: 999 readOnlyRootFilesystem: true + # -- Override container security context for the `codeintel-db` container + containerSecurityContext: {} # -- Configuration for the `pgsql-exporter` sidecar container postgresExporter: {} # -- Name used by resources. Does not affect service names or PVCs. @@ -295,12 +314,13 @@ codeIntelDB: requests: cpu: "4" memory: 4Gi - # -- Security context for the `codeintel-db` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `codeintel-db` pod + defaultPodSecurityContext: runAsUser: 999 fsGroup: 999 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `codeintel-db` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `codeintel-db` create: false @@ -362,17 +382,19 @@ frontend: # - sourcegraph.example.com # secretName: sourcegraph-tls # optional tls: [] - # -- Security context for the `frontend` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `frontend` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `frontend` container + containerSecurityContext: {} # -- Disable the roleBinding resource for deployment environments blocking RBAC, ex. OpenShift's default "secure" SCC createRoleBinding: true - # -- Security context for the `frontend` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + # -- Default pod security context for the `frontend` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `frontend` pod podSecurityContext: {} # -- Enable creation of Role and RoleBinding (RBAC). Uses [view](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) ClusterRole if set to false privileged: true @@ -421,13 +443,14 @@ migrator: requests: cpu: 100m memory: 50M - # -- Security context for the `migrator` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `migrator` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `migrator` container + containerSecurityContext: {} gitserver: # -- Environment variables for the `gitserver` container @@ -445,13 +468,14 @@ gitserver: # It usually contains keys, such as `id_rsa` (private key) and `known_hosts`. # Learn more from [documentation](https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-ssh-to-clone-repositories) sshSecret: "" - # -- Security context for the `gitserver` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `gitserver` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `gitserver` container + containerSecurityContext: {} # -- Number of `gitserver` pod replicaCount: 1 # -- Pod disruption budget for `gitserver`. Configure either `minAvailable` or `maxUnavailable` to enable it. @@ -467,13 +491,14 @@ gitserver: memory: 8G # -- Name used by resources. Does not affect service names or PVCs. name: "gitserver" - # -- Security context for the `gitserver` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `gitserver` pod + defaultPodSecurityContext: runAsUser: 100 runAsGroup: 101 fsGroup: 101 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `gitserver` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `gitserver` create: false @@ -520,13 +545,14 @@ grafana: defaultTag: 8.1.2687@sha256:c24d2f1647dc59e499cface18fba62aff1bc0de152ea95036c8d876d35f5da74 # -- Docker image name for the `grafana` image name: "grafana" - # -- Security context for the `grafana` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `grafana` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 472 runAsGroup: 472 readOnlyRootFilesystem: true + # -- Override container security context for the `grafana` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "grafana" # -- Resource requests & limits for the `grafana` container, @@ -538,13 +564,14 @@ grafana: requests: cpu: 100m memory: 512Mi - # -- Security context for the `grafana` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `grafana` pod + defaultPodSecurityContext: runAsUser: 472 runAsGroup: 472 fsGroup: 472 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `grafana` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `grafana` create: true @@ -569,13 +596,14 @@ indexedSearch: defaultTag: 8.1.2687@sha256:4f9b1d38da5f6168ee91ed5e2d9c42f851148b12e1a71ee5040f566b6d663837 # -- Docker image name for the `zoekt-webserver` image name: "indexed-searcher" - # -- Security context for the `zoekt-webserver` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `zoekt-webserver` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `zoekt-webserver` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "indexed-search" # -- Number of `indexed-search` pod @@ -610,11 +638,12 @@ indexedSearch: requests: cpu: 500m memory: 2G - # -- Security context for the `indexed-search` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `indexed-search` pod + defaultPodSecurityContext: fsGroup: 101 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `indexed-search` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `indexed-search` create: false @@ -641,13 +670,14 @@ indexedSearchIndexer: defaultTag: 8.1.2687@sha256:1a53fc78048963cf2badc8e8b43fc606d62a2323d36bd631eb01e33910dd22cd # -- Docker image name for the `zoekt-indexserver` image name: "search-indexer" - # -- Security context for the `zoekt-indexserver` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `zoekt-indexserver` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `zoekt-indexserver` container + containerSecurityContext: {} # -- Resource requests & limits for the `zoekt-indexserver` container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) # zoekt-indexserver is CPU bound. The more CPU you allocate to it, the @@ -674,12 +704,13 @@ blobstore: defaultTag: 8.1.2687@sha256:7407a048bdfbd6e635874963b9f075f9e514d5b10ddd26cda76597a0bcd59ab2 # -- Docker image name for the `blobstore` image name: "blobstore" - # -- Security context for the `blobstore` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `blobstore` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 + # -- Override container security context for the `blobstore` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "blobstore" # -- Resource requests & limits for the `blobstore` container, @@ -691,13 +722,14 @@ blobstore: requests: cpu: "1" memory: 500M - # -- Security context for the `blobstore` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `blobstore` pod + defaultPodSecurityContext: runAsUser: 100 runAsGroup: 101 fsGroup: 101 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `blobstore` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `blobstore` create: false @@ -751,10 +783,17 @@ openTelemetry: create: false # -- Name of the ServiceAccount to be created or an existing ServiceAccount name: "" - containerSecurityContext: + # -- Default security context for the `otel-collector` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 + # -- Override container security context for the `otel-collector` container + containerSecurityContext: {} + # -- Default pod security context for the `otel-collector` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `otel-collector` pod + podSecurityContext: {} agent: # -- Name used by resources. Does not affect service names or PVCs. @@ -782,10 +821,17 @@ openTelemetry: create: false # -- Name of the ServiceAccount to be created or an existing ServiceAccount name: "" - containerSecurityContext: + # -- Default security context for the `otel-agent` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 + # -- Override container security context for the `otel-agent` container + containerSecurityContext: {} + # -- Default pod security context for the `otel-agent` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `otel-agent` pod + podSecurityContext: {} nodeExporter: # -- Enable `node-exporter` @@ -818,20 +864,22 @@ nodeExporter: extraArgs: [] # - --collector.diskstats.ignored-devices=^(ram|loop|fd|(h|s|v)d[a-z]|nvme\\d+n\\d+p)\\d+$ # - --collector.textfile.directory=/run/prometheus - # -- Security context for the `node-exporter` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `node-exporter` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 65534 runAsGroup: 65534 readOnlyRootFilesystem: true - # -- Security context for the `node-exporter` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Override container security context for the `node-exporter` container + containerSecurityContext: {} + # -- Default security context for the `node-exporter` pod + defaultPodSecurityContext: fsGroup: 65534 runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 + # -- Override pod security context for the `node-exporter` pod + podSecurityContext: {} pgsql: # -- Enable `pgsql` PostgreSQL server @@ -865,13 +913,14 @@ pgsql: defaultTag: 8.1.2687@sha256:cc810cd21f1df7776aa270f49bdd50a4ec3375623ffae1f0238c20dec054bf03 # -- Docker image name for the `pgsql` image name: "postgresql-16" - # -- Security context for the `pgsql` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `pgsql` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 999 runAsGroup: 999 readOnlyRootFilesystem: true + # -- Override container security context for the `pgsql` container + containerSecurityContext: {} # -- Configuration for the `pgsql-exporter` sidecar container postgresExporter: {} # -- Name used by resources. Does not affect service names or PVCs. @@ -885,14 +934,15 @@ pgsql: requests: cpu: "4" memory: 4Gi - # -- Security context for the `pgsql` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `pgsql` pod + defaultPodSecurityContext: # Required to prevent escalations to root. runAsUser: 999 runAsGroup: 999 fsGroup: 999 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `pgsql` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount for `pgsql` create: false @@ -912,6 +962,11 @@ postgresExporter: defaultTag: 8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d # -- Docker image name for the `pgsql-exporter` image name: "postgres_exporter" + # -- Default security context for the `pgsql-exporter` sidecar container + defaultContainerSecurityContext: + allowPrivilegeEscalation: false + # -- Override container security context for the `pgsql-exporter` sidecar container + containerSecurityContext: {} # -- Resource requests & limits for the `pgsql-exporter` sidecar container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) resources: @@ -935,17 +990,19 @@ syntacticCodeIntel: defaultTag: 8.1.2687@sha256:702609626636fd06c204a8a7e18941eb13df096784cea732d1c036069866cc40 # -- Docker image name for the `syntactic-code-intel-worker` image name: "syntactic-code-intel-worker" - # -- Security context for the `syntactic-code-intel-worker` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `syntactic-code-intel-worker` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `syntactic-code-intel-worker` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "syntactic-code-intel-worker" - # -- Security context for the `syntactic-code-intel-worker` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + # -- Default pod security context for the `syntactic-code-intel-worker` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `syntactic-code-intel-worker` pod podSecurityContext: {} # -- Number of `syntactic-code-intel-worker` pod replicaCount: 2 @@ -980,17 +1037,19 @@ preciseCodeIntel: defaultTag: 8.1.2687@sha256:560ef1edc769959af11f24d220b0dbd5c5c798be1d635e6e4fe06ff560b7835c # -- Docker image name for the `precise-code-intel-worker` image name: "precise-code-intel-worker" - # -- Security context for the `precise-code-intel-worker` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `precise-code-intel-worker` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `precise-code-intel-worker` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "precise-code-intel-worker" - # -- Security context for the `precise-code-intel-worker` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + # -- Default pod security context for the `precise-code-intel-worker` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `precise-code-intel-worker` pod podSecurityContext: {} # -- Number of `precise-code-intel-worker` pod replicaCount: 2 @@ -1038,15 +1097,16 @@ prometheus: defaultTag: 8.1.2687@sha256:6e52e5c1b47f21b31384a52155553be4d625fa410e07ab45a8f6faed7172a907 # -- Docker image name for the `prometheus` image name: "prometheus" - # -- Security context for the `prometheus` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `prometheus` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 100 # Read-only filesystem not supported for the prometheus container, # see [sourcegraph/issues/34012](https://github.com/sourcegraph/sourcegraph/issues/34012) for more information readOnlyRootFilesystem: false + # -- Override container security context for the `prometheus` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "prometheus" # -- Enable RBAC for `prometheus` @@ -1069,11 +1129,12 @@ prometheus: requests: cpu: 500m memory: 6G - # -- Security context for the `prometheus` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `prometheus` pod + defaultPodSecurityContext: fsGroup: 100 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `prometheus` pod + podSecurityContext: {} serviceAccount: # -- Enable creation of ServiceAccount create: true @@ -1102,13 +1163,14 @@ redisCache: existingSecret: "" # -- Endpoint to use for redis-cache. Supports either host:port or IANA specification endpoint: "redis-cache:6379" - # -- Security context for the `redis-cache` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `redis-cache` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 999 runAsGroup: 1000 readOnlyRootFilesystem: true + # -- Override container security context for the `redis-cache` container + containerSecurityContext: {} # -- Resource requests & limits for the `redis-cache` container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) resources: @@ -1120,11 +1182,12 @@ redisCache: memory: 7Gi # -- Name used by resources. Does not affect service names or PVCs. name: "redis-cache" - # -- Security context for the `redis-cache` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `redis-cache` pod + defaultPodSecurityContext: fsGroup: 1000 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `redis-cache` pod + podSecurityContext: {} # -- Pod disruption budget for `redis-cache`. Configure either `minAvailable` or `maxUnavailable` to enable it. podDisruptionBudget: {} serviceAccount: @@ -1172,13 +1235,14 @@ redisExporter: defaultTag: 8.1.2687@sha256:898666a0c7fc28b6b90f1f01893cb35668a97dbcc4f18056ca5f8d2ac89b2292 # -- Docker image name for the `redis-exporter` image name: "redis_exporter" - # -- Security context for the `redis-exporter` sidecar container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `redis-exporter` sidecar container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 999 runAsGroup: 1000 readOnlyRootFilesystem: true + # -- Override container security context for the `redis-exporter` sidecar container + containerSecurityContext: {} # -- Resource requests & limits for the `redis-exporter` sidecar container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) resources: @@ -1205,13 +1269,14 @@ redisStore: defaultTag: 8.1.2687@sha256:b733fceadfa1863671ab11704e354573241217c4aa604aba64533c7bae101127 # -- Docker image name for the `redis-store` image name: "redis-store" - # -- Security context for the `redis-store` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `redis-store` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 999 runAsGroup: 1000 readOnlyRootFilesystem: true + # -- Override container security context for the `redis-store` container + containerSecurityContext: {} # -- Resource requests & limits for the `redis-store` container, # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) resources: @@ -1223,11 +1288,12 @@ redisStore: memory: 7Gi # -- Name used by resources. Does not affect service names or PVCs. name: "redis-store" - # -- Security context for the `redis-store` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Default security context for the `redis-store` pod + defaultPodSecurityContext: fsGroup: 1000 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `redis-store` pod + podSecurityContext: {} # -- Pod disruption budget for `redis-store`. Configure either `minAvailable` or `maxUnavailable` to enable it. podDisruptionBudget: {} serviceAccount: @@ -1280,19 +1346,21 @@ searcher: defaultTag: 8.1.2687@sha256:acfbc9c127ebdbd4053ac835bcf90093f9d8bf4834a6275a549384db4eacd66f # -- Docker image name for the `searcher` image name: "searcher" - # -- Security context for the `searcher` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `searcher` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true - # -- Security context for the `searcher` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) - podSecurityContext: + # -- Override container security context for the `searcher` container + containerSecurityContext: {} + # -- Default security context for the `searcher` pod + defaultPodSecurityContext: runAsUser: 100 fsGroup: 101 fsGroupChangePolicy: "OnRootMismatch" + # -- Override pod security context for the `searcher` pod + podSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "searcher" # -- Number of `searcher` pod @@ -1360,17 +1428,19 @@ syntectServer: defaultTag: 8.1.2687@sha256:9bbe53c18c2d864358ba95e4c89d000df60759e5d9fc0814b30d576efde55d95 # -- Docker image name for the `syntect-server` image name: "syntax-highlighter" - # -- Security context for the `syntect-server` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `syntect-server` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `syntect-server` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "syntect-server" - # -- Security context for the `syntect-server` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + # -- Default pod security context for the `syntect-server` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `syntect-server` pod podSecurityContext: {} # -- Number of `syntect-server` pod replicaCount: 1 @@ -1431,15 +1501,17 @@ jaeger: logLevel: info # -- Default sampling probability (0.0 to 1.0) returned to services that query Jaeger for sampling config samplingDefaultProbability: 1.0 - # -- Security context for the `jaeger` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `jaeger` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true - # -- Security context for the `jaeger` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + # -- Override container security context for the `jaeger` container + containerSecurityContext: {} + # -- Default pod security context for the `jaeger` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `jaeger` pod podSecurityContext: {} query: # -- Name of jaeger `query` service @@ -1476,13 +1548,14 @@ worker: defaultTag: 8.1.2687@sha256:5aa40853fc6a8223c373f291ce940f7258d2e882e8ffca7e31af04ec2f2f7922 # -- Docker image name for the `worker` image name: "worker" - # -- Security context for the `worker` container, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) - containerSecurityContext: + # -- Default security context for the `worker` container + defaultContainerSecurityContext: allowPrivilegeEscalation: false runAsUser: 100 runAsGroup: 101 readOnlyRootFilesystem: true + # -- Override container security context for the `worker` container + containerSecurityContext: {} # -- Name used by resources. Does not affect service names or PVCs. name: "worker" # -- Environment variables for the `worker` container @@ -1490,8 +1563,9 @@ worker: env: DEPLOY_TYPE: value: helm - # -- Security context for the `worker` pod, - # learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) + # -- Default pod security context for the `worker` pod + defaultPodSecurityContext: {} + # -- Override pod security context for the `worker` pod podSecurityContext: {} # -- Number of `worker` pod replicaCount: 1 diff --git a/dev/README.md b/dev/README.md index 2dd67c8a1..fe4fc4781 100644 --- a/dev/README.md +++ b/dev/README.md @@ -1,6 +1,5 @@ # How to deploy this chart locally - !! Make sure you are pointing toward a local cluster From the root of the repo