Skip to content

Commit 5d3b274

Browse files
marcleblanc2marcleblanc2
committed
Update other Helm charts the same, and fix tests
1 parent 86bcfc4 commit 5d3b274

File tree

19 files changed

+351
-39
lines changed

19 files changed

+351
-39
lines changed

‎charts/sourcegraph-executor/dind/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,23 +52,30 @@ In addition to the documented values, the `executor` and `private-docker-registr
5252

5353
| Key | Type | Default | Description |
5454
|-----|------|---------|-------------|
55+
| dind.containerSecurityContext | object | `{}` | Override container security context for the dind container |
56+
| dind.defaultContainerSecurityContext | object | `{"privileged":true}` | Default container security context for the dind container |
5557
| dind.image.registry | string | `"index.docker.io"` | |
5658
| dind.image.repository | string | `"docker"` | |
5759
| dind.image.tag | string | `"20.10.22-dind"` | |
60+
| executor.containerSecurityContext | object | `{}` | Override container security context for the executor container |
61+
| executor.defaultContainerSecurityContext | object | `{}` | Default container security context for the executor container |
62+
| executor.defaultPodSecurityContext | object | `{}` | Default pod security context for the executor pod |
5863
| executor.enabled | bool | `true` | |
5964
| executor.env.EXECUTOR_FRONTEND_PASSWORD | object | `{"value":""}` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required. |
6065
| executor.env.EXECUTOR_FRONTEND_URL | object | `{"value":""}` | The external URL of the Sourcegraph instance. Required. |
6166
| executor.env.EXECUTOR_QUEUE_NAME | object | `{"value":""}` | The name of the queue to pull jobs from to. Possible values: batches and codeintel. **Either this or EXECUTOR_QUEUE_NAMES is required.** |
6267
| executor.env.EXECUTOR_QUEUE_NAMES | object | `{"value":""}` | The comma-separated list of names of multiple queues to pull jobs from to. Possible values: batches and codeintel. **Either this or EXECUTOR_QUEUE_NAME is required.** |
6368
| executor.image.defaultTag | string | `"6.0.0@sha256:0be94a7c91f8273db10fdf46718c6596340ab2acc570e7b85353806e67a27508"` | |
6469
| executor.image.name | string | `"executor"` | |
70+
| executor.podSecurityContext | object | `{}` | Override pod security context for the executor pod |
6571
| executor.replicaCount | int | `1` | |
6672
| privateDockerRegistry.enabled | bool | `true` | Whether to deploy the private registry. Only one registry is needed when deploying multiple executors. More information: https://docs.sourcegraph.com/admin/executors/deploy_executors#using-private-registries |
6773
| privateDockerRegistry.image.registry | string | `"index.docker.io"` | |
6874
| privateDockerRegistry.image.repository | string | `"docker/regisry"` | |
6975
| privateDockerRegistry.image.tag | int | `2` | |
7076
| privateDockerRegistry.storageSize | string | `"10Gi"` | |
7177
| sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) |
78+
| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers. Merges with component defaults; component-specific overrides take precedence. |
7279
| sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag |
7380
| sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy |
7481
| sourcegraph.image.repository | string | `"index.docker.io/sourcegraph"` | Global docker image registry or prefix |
@@ -79,6 +86,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
7986
| sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) |
8087
| sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods |
8188
| sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods |
89+
| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods. Merges with component defaults; component-specific overrides take precedence. |
8290
| sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) |
8391
| sourcegraph.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
8492
| storageClass.allowedTopologies | object | `{}` | Persistent volumes topology configuration, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies) |

‎charts/sourcegraph-executor/dind/templates/_helpers/_securityContext.tpl‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{{/*
2+
3+
Security context helpers for container and pod security contexts.
4+
5+
These helpers implement a 3-tier merge precedence:
6+
1. Component default (e.g., .Values.executor.defaultContainerSecurityContext)
7+
2. Global override (e.g., .Values.sourcegraph.containerSecurityContext)
8+
3. Component override (e.g., .Values.executor.containerSecurityContext)
9+
10+
Later values override earlier ones, allowing customers to:
11+
- Set global security context settings that apply to all components
12+
- Override specific components as needed
13+
- Retain Sourcegraph's secure defaults when no overrides are specified
14+
15+
*/}}
16+
17+
{{/*
18+
Container security context with 3-tier merge.
19+
Outputs "securityContext:" key with merged values, or nothing if empty.
20+
The output includes a leading newline for proper YAML formatting.
21+
22+
Usage:
23+
{{- include "sourcegraph.containerSecurityContext" (list . "executor" 8) }}
24+
25+
Parameters:
26+
- $ (root context)
27+
- component path segments (one or more strings)
28+
- indent level (integer) as the last parameter
29+
*/}}
30+
{{- define "sourcegraph.containerSecurityContext" -}}
31+
{{- $root := index . 0 -}}
32+
{{- $indent := index . (sub (len .) 1) | int -}}
33+
{{- $path := slice . 1 (sub (len .) 1) -}}
34+
{{- $default := $root.Values -}}
35+
{{- range $path -}}
36+
{{- $default = index $default . | default dict -}}
37+
{{- end -}}
38+
{{- $default = $default.defaultContainerSecurityContext | default dict -}}
39+
{{- $global := $root.Values.sourcegraph.containerSecurityContext | default dict -}}
40+
{{- $override := $root.Values -}}
41+
{{- range $path -}}
42+
{{- $override = index $override . | default dict -}}
43+
{{- end -}}
44+
{{- $override = $override.containerSecurityContext | default dict -}}
45+
{{- $merged := mustMergeOverwrite (deepCopy $default) $global $override -}}
46+
{{- if $merged | keys | len | ne 0 }}
47+
{{ "securityContext:" | indent $indent }}
48+
{{ toYaml $merged | indent (add $indent 2 | int) -}}
49+
{{- end -}}
50+
{{- end -}}
51+
52+
{{/*
53+
Pod security context with 3-tier merge.
54+
Outputs "securityContext:" key with merged values, or nothing if empty.
55+
The output includes a leading newline for proper YAML formatting.
56+
57+
Usage:
58+
{{- include "sourcegraph.podSecurityContext" (list . "executor" 6) }}
59+
60+
Parameters:
61+
- $ (root context)
62+
- component path segments (one or more strings)
63+
- indent level (integer) as the last parameter
64+
*/}}
65+
{{- define "sourcegraph.podSecurityContext" -}}
66+
{{- $root := index . 0 -}}
67+
{{- $indent := index . (sub (len .) 1) | int -}}
68+
{{- $path := slice . 1 (sub (len .) 1) -}}
69+
{{- $default := $root.Values -}}
70+
{{- range $path -}}
71+
{{- $default = index $default . | default dict -}}
72+
{{- end -}}
73+
{{- $default = $default.defaultPodSecurityContext | default dict -}}
74+
{{- $global := $root.Values.sourcegraph.podSecurityContext | default dict -}}
75+
{{- $override := $root.Values -}}
76+
{{- range $path -}}
77+
{{- $override = index $override . | default dict -}}
78+
{{- end -}}
79+
{{- $override = $override.podSecurityContext | default dict -}}
80+
{{- $merged := mustMergeOverwrite (deepCopy $default) $global $override -}}
81+
{{- if $merged | keys | len | ne 0 }}
82+
{{ "securityContext:" | indent $indent }}
83+
{{ toYaml $merged | indent (add $indent 2 | int) -}}
84+
{{- end -}}
85+
{{- end -}}

‎charts/sourcegraph-executor/dind/templates/executor/executor.Deployment.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
apiVersion: apps/v1
33
kind: Deployment
44
metadata:
5+
name: {{ include "executor.name" . }}
56
annotations:
67
description: Runs sourcegraph executors
78
kubectl.kubernetes.io/default-container: executor
@@ -44,10 +45,12 @@ spec:
4445
{{- end }}
4546
{{- include "executor.labels" . | nindent 8 }}
4647
spec:
48+
{{- include "sourcegraph.podSecurityContext" (list . "executor" 6) }}
4749
containers:
4850
- name: executor
4951
image: {{ include "sourcegraph.image" (list . "executor") }}
5052
imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
53+
{{- include "sourcegraph.containerSecurityContext" (list . "executor" 10) }}
5154
livenessProbe:
5255
httpGet:
5356
path: /healthz
@@ -87,8 +90,7 @@ spec:
8790
- name: dind
8891
image: "{{ .Values.dind.image.registry}}/{{ .Values.dind.image.repository}}:{{ .Values.dind.image.tag}}"
8992
imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
90-
securityContext:
91-
privileged: true
93+
{{- include "sourcegraph.containerSecurityContext" (list . "dind" 10) }}
9294
command:
9395
- 'dockerd'
9496
- '--tls=false'

‎charts/sourcegraph-executor/dind/templates/executor/executor.Service.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ metadata:
1313
{{- if .Values.executor.serviceLabels }}
1414
{{- toYaml .Values.executor.serviceLabels | nindent 4 }}
1515
{{- end }}
16-
name: executor
16+
name: {{ include "executor.name" . }}
1717
spec:
1818
ports:
1919
- name: http-debug

‎charts/sourcegraph-executor/dind/tests/executor_test.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,19 @@ tests:
88
set:
99
executor:
1010
enabled: true
11+
env:
12+
EXECUTOR_QUEUE_NAME:
13+
value: "test"
1114
asserts:
1215
- containsDocument:
1316
kind: Deployment
1417
apiVersion: apps/v1
15-
name: executor
18+
name: executor-test
1619
template: executor/executor.Deployment.yaml
1720
- containsDocument:
1821
kind: Service
1922
apiVersion: v1
20-
name: executor
23+
name: executor-test
2124
template: executor/executor.Service.yaml
2225

2326
- it: should not render any resources if executor is disabled

‎charts/sourcegraph-executor/dind/tests/privateDockerRegistry_test.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
suite: privateDockerRegistry
22
templates:
3-
- private-docker-registry.Deployment.yaml
4-
- private-docker-registry.PersistentVolumeClaim.yaml
5-
- private-docker-registry.Service.yaml
3+
- private-docker-registry/private-docker-registry.Deployment.yaml
4+
- private-docker-registry/private-docker-registry.PersistentVolumeClaim.yaml
5+
- private-docker-registry/private-docker-registry.Service.yaml
66
tests:
77
- it: should render the Deployment, Service and PVC if registry is enabled
88
set:
@@ -13,17 +13,17 @@ tests:
1313
kind: Deployment
1414
apiVersion: apps/v1
1515
name: private-docker-registry
16-
template: private-docker-registry.Deployment.yaml
16+
template: private-docker-registry/private-docker-registry.Deployment.yaml
1717
- containsDocument:
1818
kind: Service
1919
apiVersion: v1
2020
name: private-docker-registry
21-
template: private-docker-registry.Service.yaml
21+
template: private-docker-registry/private-docker-registry.Service.yaml
2222
- containsDocument:
2323
kind: PersistentVolumeClaim
2424
apiVersion: v1
2525
name: private-docker-registry
26-
template: private-docker-registry.PersistentVolumeClaim.yaml
26+
template: private-docker-registry/private-docker-registry.PersistentVolumeClaim.yaml
2727

2828
- it: should not render any resources if registry is disabled
2929
set:
@@ -33,6 +33,6 @@ tests:
3333
- hasDocuments:
3434
count: 0
3535
templates:
36-
- private-docker-registry.Deployment.yaml
37-
- private-docker-registry.PersistentVolumeClaim.yaml
38-
- private-docker-registry.Service.yaml
36+
- private-docker-registry/private-docker-registry.Deployment.yaml
37+
- private-docker-registry/private-docker-registry.PersistentVolumeClaim.yaml
38+
- private-docker-registry/private-docker-registry.Service.yaml

‎charts/sourcegraph-executor/dind/values.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@ sourcegraph:
3232
podLabels: {}
3333
# -- Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets)
3434
priorityClassName: ""
35+
# -- Global container security context override applied to all containers.
36+
# Merges with component defaults; component-specific overrides take precedence.
37+
containerSecurityContext: {}
38+
# -- Global pod security context override applied to all pods.
39+
# Merges with component defaults; component-specific overrides take precedence.
40+
podSecurityContext: {}
3541

3642

3743
storageClass:
@@ -60,6 +66,14 @@ executor:
6066
defaultTag: 6.0.0@sha256:0be94a7c91f8273db10fdf46718c6596340ab2acc570e7b85353806e67a27508
6167
name: "executor"
6268
replicaCount: 1
69+
# -- Default container security context for the executor container
70+
defaultContainerSecurityContext: {}
71+
# -- Override container security context for the executor container
72+
containerSecurityContext: {}
73+
# -- Default pod security context for the executor pod
74+
defaultPodSecurityContext: {}
75+
# -- Override pod security context for the executor pod
76+
podSecurityContext: {}
6377
env:
6478
# -- The external URL of the Sourcegraph instance. Required.
6579
EXECUTOR_FRONTEND_URL:
@@ -79,6 +93,11 @@ dind:
7993
registry: index.docker.io
8094
repository: docker
8195
tag: 20.10.22-dind
96+
# -- Default container security context for the dind container
97+
defaultContainerSecurityContext:
98+
privileged: true
99+
# -- Override container security context for the dind container
100+
containerSecurityContext: {}
82101

83102
privateDockerRegistry:
84103
# -- Whether to deploy the private registry. Only one registry is needed when deploying multiple executors.

‎charts/sourcegraph-executor/k8s/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,10 @@ In addition to the documented values, the `executor` and `private-docker-registr
5656
| executor.configureRbac | bool | `true` | Whether to configure the necessary RBAC resources. Required only once for all executor deployments. |
5757
| executor.debug.keepJobs | string | `"false"` | If true, Kubernetes jobs will not be deleted after they complete. Not recommended for production use as it can hit cluster limits. |
5858
| executor.debug.keepWorkspaces | string | `"false"` | |
59+
| executor.defaultContainerSecurityContext | object | `{"privileged":false}` | Default container security context for the executor container |
60+
| executor.defaultPodSecurityContext | object | `{}` | Default pod security context for the executor pod |
5961
| executor.dockerAddHostGateway | string | `"false"` | For local deployments the host is 'host.docker.internal' and this needs to be true |
62+
| executor.enabled | bool | `true` | Whether to deploy the executor |
6063
| executor.extraEnv | string | `nil` | Sets extra environment variables on the executor deployment. See `values.yaml` for the format. |
6164
| executor.frontendExistingSecret | string | `""` | Name of existing k8s Secret to use for frontend password The name of the secret must match `executor.name`, i.e., the name of the helm release used to deploy the helm chart. The k8s Secret must contain the key `EXECUTOR_FRONTEND_PASSWORD` matching the site config `executors.accessToken` value. `executor.frontendPassword` is ignored if this is enabled. |
6265
| executor.frontendPassword | string | `""` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required if `executor.frontendExistingSecret`` is not configured. |
@@ -86,17 +89,19 @@ In addition to the documented values, the `executor` and `private-docker-registr
8689
| executor.maximumRuntimePerJob | string | `"30m"` | |
8790
| executor.namespace | string | `"default"` | The namespace in which jobs are generated by the executor. |
8891
| executor.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) |
92+
| executor.podSecurityContext | object | `{}` | Override pod security context for the executor pod |
8993
| executor.queueName | string | `""` | The name of the queue to pull jobs from to. Possible values: batches and codeintel. **Either this or queueNames is required.** |
9094
| executor.queueNames | list | `[]` | The names of multiple queues to pull jobs from to. Possible values: batches and codeintel. **Either this or queueName is required.** |
9195
| executor.replicas | int | `1` | |
9296
| executor.resources.limits.cpu | string | `"1"` | |
9397
| executor.resources.limits.memory | string | `"1Gi"` | |
9498
| executor.resources.requests.cpu | string | `"500m"` | |
9599
| executor.resources.requests.memory | string | `"200Mi"` | |
96-
| executor.securityContext | object | `{"fsGroup":null,"privileged":false,"runAsGroup":null,"runAsUser":null}` | The containerSecurityContext for the executor image |
100+
| executor.securityContext | object | `{}` | Override container security context for the executor container. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
97101
| executor.storageSize | string | `"10Gi"` | The storage size of the PVC attached to the executor deployment. |
98102
| executor.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
99103
| sourcegraph.affinity | object | `{}` | Affinity, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) |
104+
| sourcegraph.containerSecurityContext | object | `{}` | Global container security context override applied to all containers. Merges with component defaults; component-specific overrides take precedence. |
100105
| sourcegraph.image.defaultTag | string | `"{{ .Chart.AppVersion }}"` | Global docker image tag |
101106
| sourcegraph.image.pullPolicy | string | `"IfNotPresent"` | Global docker image pull policy |
102107
| sourcegraph.image.repository | string | `"index.docker.io/sourcegraph"` | Global docker image registry or prefix |
@@ -108,6 +113,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
108113
| sourcegraph.nodeSelector | object | `{}` | NodeSelector, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) |
109114
| sourcegraph.podAnnotations | object | `{}` | Add extra annotations to attach to all pods |
110115
| sourcegraph.podLabels | object | `{}` | Add extra labels to attach to all pods |
116+
| sourcegraph.podSecurityContext | object | `{}` | Global pod security context override applied to all pods. Merges with component defaults; component-specific overrides take precedence. |
111117
| sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) |
112118
| sourcegraph.tolerations | list | `[]` | Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
113119
| storageClass.allowedTopologies | object | `{}` | Persistent volumes topology configuration, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies) |

0 commit comments

Comments
 (0)