Skip to content

Commit 3debc55

Browse files
authored
Merge branch 'main' into sg-next-jan1-2025
2 parents aae7620 + bae5020 commit 3debc55

File tree

9 files changed

+986
-55
lines changed

9 files changed

+986
-55
lines changed

docs/admin/external_services/object_storage.mdx

Lines changed: 52 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
# Using a managed object storage service (S3 or GCS)
22

3-
By default, Sourcegraph will use a `sourcegraph/blobstore` server bundled with the instance to temporarily store code graph indexes uploaded by users.
3+
By default, Sourcegraph will use a `sourcegraph/blobstore` server bundled with the instance to temporarily store [code graph indexes](../../code-search/code-navigation/precise_code_navigation) uploaded by users as well as the results of [search jobs](../../code-search/types/search-jobs).
44

55
You can alternatively configure your instance to instead store this data in an S3 or GCS bucket. Doing so may decrease your hosting costs as persistent volumes are often more expensive than the same storage space in an object store service.
66

7-
To target a managed object storage service, you will need to set a handful of environment variables for configuration and authentication to the target service. **If you are running a sourcegraph/server deployment, set the environment variables on the server container. Otherwise, if running via Docker-compose or Kubernetes, set the environment variables on the `frontend`, `worker`, and `precise-code-intel-worker` containers.**
7+
## Code Graph Indexes
8+
9+
To target a managed object storage service for storing [code graph index uploads](../../code-search/code-navigation/precise_code_navigation), you will need to set a handful of environment variables for configuration and authentication to the target service.
10+
11+
- If you are running a `sourcegraph/server` deployment, set the environment variables on the server container
12+
- If you are running via Docker-compose or Kubernetes, set the environment variables on the `frontend`, `worker`, and `precise-code-intel-worker` containers
813

914
### Using S3
1015

1116
To target an S3 bucket you've already provisioned, set the following environment variables. Authentication can be done through [an access and secret key pair](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) (and optional session token), or via the EC2 metadata API.
1217

13-
**_Warning:_** Remember never to commit aws access keys in git. Consider using a secret handling service offered by your cloud provider.
18+
<Callout type="warning"> Never commit AWS access keys in Git. You should consider using a secret handling service offered by your cloud provider. </Callout>
1419

1520
- `PRECISE_CODE_INTEL_UPLOAD_BACKEND=S3`
1621
- `PRECISE_CODE_INTEL_UPLOAD_BUCKET=<my bucket name>`
@@ -21,9 +26,9 @@ To target an S3 bucket you've already provisioned, set the following environment
2126
- `PRECISE_CODE_INTEL_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS=true` (optional; set to use EC2 metadata API over static credentials)
2227
- `PRECISE_CODE_INTEL_UPLOAD_AWS_REGION=us-east-1` (default)
2328

24-
**_Note:_** If a non-default region is supplied, ensure that the subdomain of the endpoint URL (_the `AWS_ENDPOINT` value_) matches the target region.
29+
<Callout type="note"> If a non-default region is supplied, ensure that the subdomain of the endpoint URL (_the `AWS_ENDPOINT` value_) matches the target region. </Callout>
2530

26-
> NOTE: You don't need to set the `PRECISE_CODE_INTEL_UPLOAD_AWS_ACCESS_KEY_ID` environment variable when using `PRECISE_CODE_INTEL_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS=true` because role credentials will be automatically resolved. Attach the IAM role to the EC2 instances hosting the `frontend`, `worker`, and `precise-code-intel-worker` containers in a multi-node environment.
31+
<Callout type="tip"> You don't need to set the `PRECISE_CODE_INTEL_UPLOAD_AWS_ACCESS_KEY_ID` environment variable when using `PRECISE_CODE_INTEL_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS=true` because role credentials will be automatically resolved. Attach the IAM role to the EC2 instances hosting the `frontend`, `worker`, and `precise-code-intel-worker` containers in a multi-node environment. </Callout>
2732

2833

2934
### Using GCS
@@ -42,3 +47,45 @@ If you would like to allow your Sourcegraph instance to control the creation and
4247

4348
- `PRECISE_CODE_INTEL_UPLOAD_MANAGE_BUCKET=true`
4449
- `PRECISE_CODE_INTEL_UPLOAD_TTL=168h` (default)
50+
51+
## Search Job Results
52+
53+
To target a third party managed object storage service for storing [search job results](../../code-search/types/search-jobs), you must set a handful of environment variables for configuration and authentication to the target service.
54+
55+
- If you are running a `sourcegraph/server` deployment, set the environment variables on the server container
56+
- If you are running via Docker-compose or Kubernetes, set the environment variables on the `frontend` and `worker` containers
57+
58+
### Using S3
59+
60+
Set the following environment variables to target an S3 bucket you've already provisioned. Authentication can be done through [an access and secret key pair](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) (and optionally through session token) or via the EC2 metadata API.
61+
62+
<Callout type="warning"> Never commit AWS access keys in Git. You should consider using a secret handling service offered by your cloud provider.</Callout>
63+
64+
- `SEARCH_JOBS_UPLOAD_BACKEND=S3`
65+
- `SEARCH_JOBS_UPLOAD_BUCKET=<my bucket name>`
66+
- `SEARCH_JOBS_UPLOAD_AWS_ENDPOINT=https://s3.us-east-1.amazonaws.com`
67+
- `SEARCH_JOBS_UPLOAD_AWS_ACCESS_KEY_ID=<your access key>`
68+
- `SEARCH_JOBS_UPLOAD_AWS_SECRET_ACCESS_KEY=<your secret key>`
69+
- `SEARCH_JOBS_UPLOAD_AWS_SESSION_TOKEN=<your session token>` (optional)
70+
- `SEARCH_JOBS_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS=true` (optional; set to use EC2 metadata API over static credentials)
71+
- `SEARCH_JOBS_UPLOAD_AWS_REGION=us-east-1` (default)
72+
73+
<Callout type="note"> If a non-default region is supplied, ensure that the subdomain of the endpoint URL (the `AWS_ENDPOINT` value) matches the target region.</Callout>
74+
75+
<Callout type="tip"> You don't need to set the `SEARCH_JOBS_UPLOAD_AWS_ACCESS_KEY_ID` environment variable when using `SEARCH_JOBS_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS=true` because role credentials will be automatically resolved.</Callout>
76+
77+
### Using GCS
78+
79+
Set the following environment variables to target a GCS bucket you've already provisioned. Authentication is done through a service account key, either as a path to a volume-mounted file or the contents read in as an environment variable payload.
80+
81+
- `SEARCH_JOBS_UPLOAD_BACKEND=GCS`
82+
- `SEARCH_JOBS_UPLOAD_BUCKET=<my bucket name>`
83+
- `SEARCH_JOBS_UPLOAD_GCP_PROJECT_ID=<my project id>`
84+
- `SEARCH_JOBS_UPLOAD_GOOGLE_APPLICATION_CREDENTIALS_FILE=</path/to/file>`
85+
- `SEARCH_JOBS_UPLOAD_GOOGLE_APPLICATION_CREDENTIALS_FILE_CONTENT=<{"my": "content"}>`
86+
87+
### Provisioning buckets
88+
89+
If you would like to allow your Sourcegraph instance to control the creation and lifecycle configuration management of the target buckets, set the following environment variables:
90+
91+
- `SEARCH_JOBS_UPLOAD_MANAGE_BUCKET=true`

docs/admin/how-to/index.mdx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,4 @@
2828
- [Migrating code intelligence data from LSIF to SCIP (Sourcegraph 4.5 -> 4.6)](/admin/how-to/lsif_scip_migration)
2929
- [How to export search results](/admin/how-to/export-search-results)
3030
- [How to debug / confirm blobstore is healthy](/admin/how-to/blobstore_debugging)
31+
- [How to handle postgresql 12 to 16 drift](/admin/how-to/postgresql-12-to-16-drift)
Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
# PostgreSQL 12 to 16 Schema Drift
2+
3+
In Sourcegraph versions `5.10.x` and `5.11.x` we support both PostgreSQL 12 and 16. However, Sourcegraph's database management tool `migrator` expects the database schema of the various Sourcegraph databases to be in an exact expected state. The upgrade from PostgreSQL 12 to 16 is opinionated and automatically mutates the schema without running our application defined migrations. Starting in Sourcegraph `5.10.0` we expect databases to be in PosttgresSQL 16 and as such our tooling will identify schema drift in PostgreSQL 12 databases. This drift does not impact the functionality of the Sourcegraph instance but will stop migrator's multiversion `upgrade` command and `autoupgrade` from executing.
4+
5+
The drift takes the following general form, dropping table prefixes to columns in views, and changing `uuid` types to `gen_random_uuid()`:
6+
```diff
7+
Schema drift detected in 8 objects:
8+
9+
webhooks.uuid:
10+
Problem: Unexpected properties of column webhooks."uuid"
11+
Solution: alter the column
12+
Statement: ALTER TABLE webhooks ALTER COLUMN uuid SET DEFAULT public.gen_random_uuid();
13+
14+
batch_spec_workspace_execution_queue:
15+
Problem: Unexpected definition of view "batch_spec_workspace_execution_queue"
16+
Solution: redefine the view
17+
Diff:
18+
(
19+
"""
20+
... // 6 identical lines
21+
ORDER BY (rank() OVER (PARTITION BY queue.user_id ORDER BY exec.created_at, exec.id)), queue.latest_dequeue NULLS FIRST
22+
)
23+
- SELECT id,
24+
+ SELECT queue_candidates.id,
25+
row_number() OVER () AS place_in_global_queue,
26+
- place_in_user_queue
27+
+ queue_candidates.place_in_user_queue
28+
FROM queue_candidates;
29+
"""
30+
)
31+
32+
codeintel_configuration_policies:
33+
Problem: Unexpected definition of view "codeintel_configuration_policies"
34+
Solution: redefine the view
35+
Diff:
36+
(
37+
"""
38+
- SELECT id,
39+
- repository_id,
40+
- name,
41+
- type,
42+
- pattern,
43+
- retention_enabled,
44+
- retention_duration_hours,
45+
- retain_intermediate_commits,
46+
- indexing_enabled,
47+
- index_commit_max_age_hours,
48+
- index_intermediate_commits,
49+
- protected,
50+
- repository_patterns,
51+
- last_resolved_at,
52+
- embeddings_enabled
53+
+ SELECT lsif_configuration_policies.id,
54+
+ lsif_configuration_policies.repository_id,
55+
+ lsif_configuration_policies.name,
56+
+ lsif_configuration_policies.type,
57+
+ lsif_configuration_policies.pattern,
58+
+ lsif_configuration_policies.retention_enabled,
59+
+ lsif_configuration_policies.retention_duration_hours,
60+
+ lsif_configuration_policies.retain_intermediate_commits,
61+
+ lsif_configuration_policies.indexing_enabled,
62+
+ lsif_configuration_policies.index_commit_max_age_hours,
63+
+ lsif_configuration_policies.index_intermediate_commits,
64+
+ lsif_configuration_policies.protected,
65+
+ lsif_configuration_policies.repository_patterns,
66+
+ lsif_configuration_policies.last_resolved_at,
67+
+ lsif_configuration_policies.embeddings_enabled
68+
FROM lsif_configuration_policies;
69+
"""
70+
)
71+
72+
codeintel_configuration_policies_repository_pattern_lookup:
73+
Problem: Unexpected definition of view "codeintel_configuration_policies_repository_pattern_lookup"
74+
Solution: redefine the view
75+
Diff:
76+
(
77+
"""
78+
- SELECT policy_id,
79+
- repo_id
80+
+ SELECT lsif_configuration_policies_repository_pattern_lookup.policy_id,
81+
+ lsif_configuration_policies_repository_pattern_lookup.repo_id
82+
FROM lsif_configuration_policies_repository_pattern_lookup;
83+
"""
84+
)
85+
86+
lsif_dumps:
87+
Problem: Unexpected definition of view "lsif_dumps"
88+
Solution: redefine the view
89+
Diff:
90+
strings.Join({
91+
" SELECT ",
92+
+ "u.",
93+
"id,\n ",
94+
+ "u.",
95+
"commit,\n ",
96+
- "root,\n queued_at,\n uploaded_at,\n state,\n ",
97+
+ "u.root,\n u.queued_at,\n u.uploaded_at,\n u.state,\n u.",
98+
"failure_message,\n ",
99+
+ "u.",
100+
"started_at,\n ",
101+
+ "u.",
102+
"finished_at,\n ",
103+
+ "u.",
104+
"repository_id,\n ",
105+
+ "u.",
106+
"indexer,\n ",
107+
+ "u.",
108+
"indexer_version,\n ",
109+
+ "u.",
110+
"num_parts,\n ",
111+
+ "u.",
112+
"uploaded_parts,\n ",
113+
+ "u.",
114+
"process_after,\n ",
115+
+ "u.",
116+
"num_resets,\n ",
117+
+ "u.",
118+
"upload_size,\n ",
119+
+ "u.",
120+
"num_failures,\n ",
121+
+ "u.",
122+
"associated_index_id,\n ",
123+
+ "u.",
124+
"expired,\n ",
125+
+ "u.",
126+
"last_retention_scan_at,\n ",
127+
+ "u.",
128+
"finished_at AS processed_at\n FROM lsif_uploads u\n WHERE ((",
129+
+ "u.",
130+
"state = 'completed'::text) OR (",
131+
+ "u.",
132+
"state = 'deleting'::text));",
133+
}, "")
134+
135+
outbound_webhooks_with_event_types:
136+
Problem: Unexpected definition of view "outbound_webhooks_with_event_types"
137+
Solution: redefine the view
138+
Diff:
139+
(
140+
"""
141+
- SELECT id,
142+
- created_by,
143+
- created_at,
144+
- updated_by,
145+
- updated_at,
146+
- encryption_key_id,
147+
- url,
148+
- secret,
149+
+ SELECT outbound_webhooks.id,
150+
+ outbound_webhooks.created_by,
151+
+ outbound_webhooks.created_at,
152+
+ outbound_webhooks.updated_by,
153+
+ outbound_webhooks.updated_at,
154+
+ outbound_webhooks.encryption_key_id,
155+
+ outbound_webhooks.url,
156+
+ outbound_webhooks.secret,
157+
array_to_json(ARRAY( SELECT json_build_object('id', outbound_webhook_event_types.id, 'outbound_webhook_id', outbound_webhook_event_types.outbound_webhook_id, 'event_type', outbound_webhook_event_types.event_type, 'scope', outbound_webhook_event_types.scope) AS json_build_object
158+
FROM outbound_webhook_event_types
159+
... // 2 identical lines
160+
"""
161+
)
162+
163+
site_config:
164+
Problem: Unexpected definition of view "site_config"
165+
Solution: redefine the view
166+
Diff:
167+
(
168+
"""
169+
- SELECT site_id,
170+
- initialized
171+
+ SELECT global_state.site_id,
172+
+ global_state.initialized
173+
FROM global_state;
174+
"""
175+
)
176+
```
177+
178+
## Solutions for Handling Schema Drift
179+
180+
If you're confident that your instance is seeing database drift associated with the PG12 to PG16 upgrade, you can run a nultiversion upgrade via migrator `upgrade` or run `autoupgrade` using the following options.
181+
182+
To run `autoupgrade` via the frontend, set the `SRC_AUTOUPGRADE_IGNORE_DRIFT=true` environment variable in the frontend container.
183+
184+
To run migrators `upgrade` command add the `--skip-drift-check` flag to migrator's entrycommand as below:
185+
```yaml
186+
command: ['upgrade', '-from', '5.5.0', '-to', '5.10.0', '--skip-drift-check=true']             
187+
```
188+
189+
If you have any concerns about the drift, please reach out to us at [email protected]

docs/admin/postgres.mdx

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,14 @@ Sourcegraph uses several PostgreSQL databases to support various functionality.
88

99
## Version requirements
1010

11-
We support Postgres 16 and above. Older versions of Sourcegraph supported 12 see our [Postgres 12 deprecation notice](/admin/postgres12_end_of_life_notice) for more details.
11+
We support Postgres 16 and above. Older versions of Sourcegraph supported 12 see our [Postgres 12 deprecation notice](/admin/postgres12_end_of_life_notice) for more details. Starting in Sourcegraph 6.0.0, sourcegraph services will no longer connect to a PostgreSQL 12 or lower database. Instead displaying an error message in container logs for services attempting to connect to a PostgreSQL database below version 16.
12+
```
13+
migrator | ✱ Sourcegraph migrator 6.0.0
14+
migrator | ⚠️ Failed to check for migrator update: unexpected status code 404. Continuing...
15+
migrator | Attempting connection to frontend...
16+
migrator | {"SeverityText":"FATAL","Timestamp":1738107940979396426,"InstrumentationScope":"migrator","Caller":"migrator/main.go:24","Function":"main.main","Body":"new db handle: Sourcegraph requires PostgreSQL 16+. For more information about PostgreSQL requirements and upgrade guides, visit https://sourcegraph.com/docs/admin/postgres","Resource":{"service.name":"migrator","service.version":"6.0.0","service.instance.id":"23097a97-50f4-4b42-80b5-83802baffeb4"},"Attributes":{}}
17+
migrator exited with code 1
18+
```
1219

1320
## Role requirements
1421

@@ -29,11 +36,27 @@ vector
2936

3037
### Upgrading Built-in PostgreSQL
3138

32-
Sourcegraph deployments come packaged with containers using the `postgresql-16` image for `pgsql` and `codeintel-db` deployments and `postgresql-16-codeinsights` for `codeinsights`. These images contain an entryscript which will detect and upgrade Postgres instances at version 12 (our previous images Postgres version). See the (Postgres 12 end of life notice)[/admin/prostgres12_end_of_life_notice#] for more details.
39+
Starting in version `5.10.0`, Sourcegraph begins supporting PostgreSQL 16. For admins deploying our built-in PostgreSQL, we facilitate the upgrade of PostgreSQL using entrypoint scripts packaged in the new `postgresql-16` and `postgresql-16-codeinsights` container images which become standard in our deployment repos in `5.10.0`. The database container images are renamed as follows:
40+
41+
**postgres-12-alpine → postgresql-16**
42+
43+
**codeintel-db → postgresql-16**
44+
45+
**codeinsights-db → postgresql-16-codeinsights**
3346

3447
> WARNING: Upgrading the PostgreSQL database requires stopping your Sourcegraph deployment which will result in **downtime**.
3548
>
36-
> Additionally, once the upgrade process is started via the database container, interrupting the container before the upgrade is complete could result in corrupting the underlying Postgres database. We strongly advise taking a backup before the upgrade.
49+
> Once the database upgrade process is started, containers running the upgrade should not be stopped or restarted.
50+
51+
When our `postgresql-16` images start, if they detect a PostgresSQL 12 database in their attached volume, they will automatically attempt to upgrade the database to PostgreSQL 16.
52+
53+
We have the following advisements to admins:
54+
- Container orchestration management systems (e.g. Kubernetes) may restart containers at any time, **it is recommended that you take a backup of your database before starting the upgrade process.**
55+
- Review your deployment types [upgrade notes](/admin/updates#upgrades-index) before upgrading. The PostgreSQL upgrade process mutates the database schema in a way that may Sourcegraph `v5.10.0` and `v5.11.0` may not recognize. [Learn more about pg12 to pg16 schema drift here](/admin/how-to/postgres_12_to_16_drift).
56+
57+
For additional assistance with PostgreSQL upgrades, please contact [email protected].
58+
59+
#### Upgrade entryscript `--link` option
3760

3861
The `PG_UPGRADE_EXTRA_ARGS` env var can be set in the built-in `postgresql-16` and `postgresql-16-codeinsights` deployments to provide extra arguments to the `pg_upgrade` command.
3962

docs/admin/updates/docker_compose.mdx

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ For upgrade procedures or general info about sourcegraph versioning see the link
1111
>
1212
> ***If the notes indicate a patch release exists, target the highest one.***
1313
14-
## Unreleased
14+
## v6.0.0
15+
16+
- Sourcegraph 6.0.0 no longer supports PostgreSQL 12, admins must upgrade to PostgreSQL 16. See our [postgres 12 end of life](/admin/postgres12_end_of_life_notice) notice! As well as [supporting documentation](/admin/postgres) and advisements on how to upgrade.
1517

1618
## v5.9.0 ➔ v5.10.1164
1719

docs/admin/updates/kubernetes.mdx

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@ For upgrade procedures or general info about sourcegraph versioning see the link
1212
>
1313
> ***If the notes indicate a patch release exists, target the highest one.***
1414
15+
## v6.0.0
1516

16-
## Unreleased
17+
- Sourcegraph 6.0.0 no longer supports PostgreSQL 12, admins must upgrade to PostgreSQL 16. See our [postgres 12 end of life](/admin/postgres12_end_of_life_notice) notice! As well as [supporting documentation](/admin/postgres) and advisements on how to upgrade.
1718

1819
## v5.9.0 ➔ v5.10.1164
1920

0 commit comments

Comments
 (0)