Skip to content

Inline Role YAML #1134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 14, 2025
Merged

Inline Role YAML #1134

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c37308a
Inline Role YAML
pjlast May 14, 2025
2ccad0c
Redirect one search link to the public snapshot
pjlast May 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 44 additions & 3 deletions docs/admin/executors/deploy_executors_kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,48 @@ Executors interact with the Kubernetes API to manage the lifecycle of individual
| `batch` | `jobs` | `create`, `delete` | Executors create Job pods to run processes. Once Jobs are completed, they are cleaned up. |
| | `pods`, `pods/log` | `get`, `list`, `watch` | Executors need to look up and steam logs from the Job Pods. |

See the [example Role YAML](https://sourcegraph.com/github.com/sourcegraph/sourcegraph@main/-/blob/cmd/executor/kubernetes/batches/executor-batches.Role.yml) for more details on the exact RBAC requirements for native Kubernetes Executors.
Here's an example Role YAML to demonstrate the RBAC requirements for native Kubernetes Executors:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: sg-executor-batches-role
namespace: default
rules:
- apiGroups:
- batch
resources:
- jobs
verbs:
- create
- delete
- apiGroups:
- ""
resources:
- pods
- pods/log
verbs:
- get
- list
- watch
# Secrets are required post 5.5, when all pods run a single job
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- delete
# PVCs are required if KUBERNETES_JOB_VOLUME_TYPE is "pvc"
# - apiGroups:
# - ""
# resources:
# - persistentvolumeclaims
# verbs:
# - create
# - delete
```

## Deployment

Expand Down Expand Up @@ -94,5 +135,5 @@ The Executor Docker image is available on Docker Hub at [`sourcegraph/executor-k
### Example Configuration YAML

See
the [local development YAMLs](https://sourcegraph.com/github.com/sourcegraph/sourcegraph@main/-/blob/cmd/executor/kubernetes)
for an example of how to configure the Executor in Kubernetes.
the [local development YAMLs](https://sourcegraph.com/github.com/sourcegraph/sourcegraph-public-snapshot@main/-/blob/cmd/executor/kubernetes)
for an example of how to configure the Executor in Kubernetes.