marcleblanc2 · Nov 13, 2026 · Nov 11, 2026 · Nov 11, 2026
diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
@@ -9,6 +9,7 @@ Use `**BREAKING**:` to denote a breaking change
 ## Unreleased
 
 - The `correct-data-dir-permissions` init containers of `pgsql`, `codeintel-db`, and `codeinsights-db` now run the database's own image instead of `sourcegraph/alpine-3.14`, which was based on an end-of-life Alpine release. The chart no longer pulls `alpine-3.14`, so private registries no longer need to mirror it. `alpine.image` has been removed and is ignored if set; `alpine.containerSecurityContext`, `alpine.resources`, and `codeInsightsDB.init.containerSecurityContext` still apply.
+- Added `sourcegraph.selectorLabelsOverride`, `<serviceName>.extraSelectorLabels`, and `storageLabels` on `gitserver`, `grafana`, `indexedSearch`, and `searcher`, so the chart can render the selectors and volume claim templates of workloads created outside it, such as with Kustomize, and a Helm release can take them over without deleting them. All default to empty, so existing releases render the same selectors. Never change them on an installed release: Kubernetes does not allow changing these fields. See [Adopting existing workloads](README.md#adopting-existing-workloads).
 - Fixed `frontend.command` and `migrator.command` rendering a list as a single element, e.g. `["sh", "-c", "<script>"]` became `[sh -c <script>]`, so the container failed to start. Both are now rendered as YAML lists and documented in `values.yaml`. A string holding a YAML list, the only form that worked before, still renders unchanged.
 - Added `openTelemetry.gateway.command` to replace the `otel-collector` container's command, e.g. with a shell wrapper that exports an exporter API key read from a mounted file
 - Fixed `precise-code-intel-worker` and `syntactic-code-intel-worker` ignoring the chart's Redis connection settings. They now get `REDIS_CACHE_ENDPOINT` and `REDIS_STORE_ENDPOINT` from `redisCache.connection` and `redisStore.connection`, like `frontend`, `gitserver`, `searcher`, and `worker`, and restart when they change. Previously they always used their built-in default `redis-store:6379`, which does not exist on instances with external Redis. If you worked around this by setting either variable in `preciseCodeIntel.env` or `syntacticCodeIntel.env`, remove it when upgrading.

diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
@@ -63,6 +63,49 @@ Chart-managed config changes restart the Redis pod through a checksum
 annotation. Changes to an existing ConfigMap or Secret require a manual pod
 restart because `subPath` mounts do not update in running containers.
 
+## Adopting existing workloads
+
+Kubernetes does not allow changing the `spec.selector` of a Deployment,
+StatefulSet, or DaemonSet, or the `volumeClaimTemplates` of a StatefulSet. To
+move workloads that were created another way, such as with Kustomize, into a
+Helm release without deleting them, make the chart render the same values for
+those fields:
+
+- `sourcegraph.selectorLabelsOverride` replaces the default
+  `app.kubernetes.io/name` and `app.kubernetes.io/instance` selector labels on
+  every component.
+- `<serviceName>.extraSelectorLabels` adds selector labels to one component.
+- `<serviceName>.storageLabels` adds labels to the volume claim template of
+  `gitserver`, `grafana`, `indexedSearch`, or `searcher`. Match the rest of the
+  template with `storageSize` and `storageClass.name`.
+
+```yaml
+sourcegraph:
+  selectorLabelsOverride:
+    example.com/project: sourcegraph
+gitserver:
+  extraSelectorLabels:
+    example.com/service: gitserver
+  storageLabels:
+    example.com/project: sourcegraph
+    example.com/service: gitserver
+```
+
+The same labels are rendered in each workload's selector and pod labels and in
+the Service and PodDisruptionBudget selectors. The chart keeps adding the
+labels it sets itself, such as `app: gitserver`, so the existing workloads must
+already have them; the values above cannot set `app`, `deploy`, `group`,
+`type`, or `worker-replica`.
+
+Set these values on the first install and never change them on an installed
+release: Kubernetes rejects the upgrade. Before installing, compare the
+`helm template` output with `kubectl get -o yaml` for each workload.
+
+Helm only takes over an existing object that has the
+`app.kubernetes.io/managed-by: Helm` label and the `meta.helm.sh/release-name`
+and `meta.helm.sh/release-namespace` annotations, or when installing with
+`--take-ownership` (Helm 3.17 or later).
+
 ## Configuration Options
 
 Reference the below chart for all available configuration parameters.
@@ -83,6 +126,7 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.env` - consult `values.yaml` file
 - `<serviceName>.extraInitContainers` - add init containers to the pod, which run before any init containers the chart defines
 - `<serviceName>.extraServicePorts` - add ports to the service's primary Service. The OpenTelemetry and Jaeger values are `openTelemetry.gateway.*`, `openTelemetry.agent.extraInitContainers`, `jaeger.extraInitContainers`, `jaeger.collector.extraServicePorts`, and `jaeger.query.extraServicePorts`
+- `<serviceName>.extraSelectorLabels` - add labels to the service's workload selector, pod labels, and Service and PodDisruptionBudget selectors. See [Adopting existing workloads](#adopting-existing-workloads)
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.
@@ -194,6 +238,7 @@ In addition to the documented values, all services also support the following va
 | gitserver.sshSecret | string | `""` | Name of existing Secret that contains SSH credentials to clone repositories. It usually contains keys, such as `id_rsa` (private key) and `known_hosts`. Learn more from [documentation](https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-ssh-to-clone-repositories) |
 | gitserver.storageAccessModes | list | `["ReadWriteOnce"]` | Access modes for the `gitserver` PVC. Set to `["ReadWriteOncePod"]` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) so Kubernetes mounts the volume with `-o context` instead of recursively relabeling every file on each pod start |
 | gitserver.storageAnnotations | object | `{}` | Optional annotations to add to the `gitserver` PVC |
+| gitserver.storageLabels | object | `{}` | Labels to add to the `repos` volume claim template of the `gitserver` StatefulSet. Kubernetes does not allow changing them on an installed StatefulSet. See [Adopting existing workloads](#adopting-existing-workloads) |
 | gitserver.storageSize | string | `"200Gi"` | PVC Storage Request for `gitserver` data volume |
 | gitserver.storageSubPath | string | `""` | Optional subPath for the `gitserver` primary data volume mount |
 | grafana.auth | object | `{"database":"","existingSecret":"","host":"","password":"","port":"","sslmode":"","user":""}` | NOTE: Create a separate user in the pgsql database with read-only perms on the minimum set of tables |
@@ -215,6 +260,7 @@ In addition to the documented values, all services also support the following va
 | grafana.serviceAccount.create | bool | `true` | Enable creation of ServiceAccount for `grafana` |
 | grafana.serviceAccount.name | string | `"grafana"` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | grafana.storageAnnotations | object | `{}` | Optional annotations to add to the `grafana` PVC |
+| grafana.storageLabels | object | `{}` | Labels to add to the `grafana-data` volume claim template of the `grafana` StatefulSet. Kubernetes does not allow changing them on an installed StatefulSet. See [Adopting existing workloads](#adopting-existing-workloads) |
 | grafana.storageSize | string | `"2Gi"` | PVC Storage Request for `grafana` data volume |
 | grafana.storageSubPath | string | `""` | Optional subPath for the `grafana` primary data volume mount |
 | indexedSearch.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `zoekt-webserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
@@ -231,6 +277,7 @@ In addition to the documented values, all services also support the following va
 | indexedSearch.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `indexed-search` |
 | indexedSearch.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | indexedSearch.storageAnnotations | object | `{}` | Optional annotations to add to the `indexed-search` PVC |
+| indexedSearch.storageLabels | object | `{}` | Labels to add to the `data` volume claim template of the `indexed-search` StatefulSet. Kubernetes does not allow changing them on an installed StatefulSet. See [Adopting existing workloads](#adopting-existing-workloads) |
 | indexedSearch.storageSize | string | `"200Gi"` | PVC Storage Request for `indexed-search` data volume The size of disk to used for search indexes. This should typically be gitserver disk size multiplied by the number of gitserver shards. |
 | indexedSearch.storageSubPath | string | `""` | Optional subPath for the `indexed-search` primary data volume mount |
 | indexedSearchIndexer.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":101,"runAsUser":100}` | Security context for the `zoekt-indexserver` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
@@ -421,6 +468,7 @@ In addition to the documented values, all services also support the following va
 | searcher.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `searcher` |
 | searcher.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
 | searcher.storageAnnotations | object | `{}` | Optional annotations to add to the `searcher` PVC |
+| searcher.storageLabels | object | `{}` | Labels to add to the `cache` volume claim template of the `searcher` StatefulSet. Kubernetes does not allow changing them on an installed StatefulSet. See [Adopting existing workloads](#adopting-existing-workloads) |
 | searcher.storageSize | string | `"26Gi"` | Size of the PVC for searcher pods to store cache data. Unless `autoCacheSize` is enabled, this must be a Kubernetes quantity (e.g. `150G`, `100Gi`, `1Ti`) of at least `3M`, so the chart can derive `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB` from it |
 | searcher.storageSubPath | string | `""` | Optional subPath for the `searcher` primary data volume mount |
 | sgTestConnection | object | `{"enabled":true}` | Enable the busybox connection test after deployment |
@@ -441,6 +489,7 @@ In addition to the documented values, all services also support the following va
 | sourcegraph.preShutdownPause | string | `"5s"` | Time Sourcegraph services continue accepting requests after shutdown begins so Kubernetes endpoint changes can propagate |
 | sourcegraph.priorityClassName | string | `""` | Assign a priorityClass to all pods (daemonSets, deployments, and statefulSets) |
 | sourcegraph.revisionHistoryLimit | int | `10` | Global deployment clean up policy, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| sourcegraph.selectorLabelsOverride | object | `{}` | Labels that replace `app.kubernetes.io/name` and `app.kubernetes.io/instance` in every component's workload selector, pod labels, and Service and PodDisruptionBudget selectors. Only for adopting workloads created outside this chart, whose selectors Kubernetes does not allow changing: set it on the first install and never change it afterwards. Use `<serviceName>.extraSelectorLabels` for labels that differ per component. See [Adopting existing workloads](#adopting-existing-workloads) |
 | sourcegraph.serviceLabels | object | `{}` | Add extra labels to all services |
 | sourcegraph.terminationGracePeriodSeconds | int | `30` | Time Kubernetes allows Sourcegraph services to shut down before forced termination |
 | sourcegraph.tolerations | list | `[]` | Global Tolerations, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |

diff --git a/charts/sourcegraph/README.md.gotmpl b/charts/sourcegraph/README.md.gotmpl
@@ -63,6 +63,49 @@ Chart-managed config changes restart the Redis pod through a checksum
 annotation. Changes to an existing ConfigMap or Secret require a manual pod
 restart because `subPath` mounts do not update in running containers.
 
+## Adopting existing workloads
+
+Kubernetes does not allow changing the `spec.selector` of a Deployment,
+StatefulSet, or DaemonSet, or the `volumeClaimTemplates` of a StatefulSet. To
+move workloads that were created another way, such as with Kustomize, into a
+Helm release without deleting them, make the chart render the same values for
+those fields:
+
+- `sourcegraph.selectorLabelsOverride` replaces the default
+  `app.kubernetes.io/name` and `app.kubernetes.io/instance` selector labels on
+  every component.
+- `<serviceName>.extraSelectorLabels` adds selector labels to one component.
+- `<serviceName>.storageLabels` adds labels to the volume claim template of
+  `gitserver`, `grafana`, `indexedSearch`, or `searcher`. Match the rest of the
+  template with `storageSize` and `storageClass.name`.
+
+```yaml
+sourcegraph:
+  selectorLabelsOverride:
+    example.com/project: sourcegraph
+gitserver:
+  extraSelectorLabels:
+    example.com/service: gitserver
+  storageLabels:
+    example.com/project: sourcegraph
+    example.com/service: gitserver
+```
+
+The same labels are rendered in each workload's selector and pod labels and in
+the Service and PodDisruptionBudget selectors. The chart keeps adding the
+labels it sets itself, such as `app: gitserver`, so the existing workloads must
+already have them; the values above cannot set `app`, `deploy`, `group`,
+`type`, or `worker-replica`.
+
+Set these values on the first install and never change them on an installed
+release: Kubernetes rejects the upgrade. Before installing, compare the
+`helm template` output with `kubectl get -o yaml` for each workload.
+
+Helm only takes over an existing object that has the
+`app.kubernetes.io/managed-by: Helm` label and the `meta.helm.sh/release-name`
+and `meta.helm.sh/release-namespace` annotations, or when installing with
+`--take-ownership` (Helm 3.17 or later).
+
 ## Configuration Options
 
 Reference the below chart for all available configuration parameters.
@@ -83,6 +126,7 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.env` - consult `values.yaml` file
 - `<serviceName>.extraInitContainers` - add init containers to the pod, which run before any init containers the chart defines
 - `<serviceName>.extraServicePorts` - add ports to the service's primary Service. The OpenTelemetry and Jaeger values are `openTelemetry.gateway.*`, `openTelemetry.agent.extraInitContainers`, `jaeger.extraInitContainers`, `jaeger.collector.extraServicePorts`, and `jaeger.query.extraServicePorts`
+- `<serviceName>.extraSelectorLabels` - add labels to the service's workload selector, pod labels, and Service and PodDisruptionBudget selectors. See [Adopting existing workloads](#adopting-existing-workloads)
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.

diff --git a/charts/sourcegraph/templates/_helpers.tpl b/charts/sourcegraph/templates/_helpers.tpl
@@ -17,7 +17,8 @@ Common labels
 */}}
 {{- define "sourcegraph.labels" -}}
 helm.sh/chart: {{ include "sourcegraph.chart" . }}
-{{ include "sourcegraph.selectorLabels" . }}
+app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
@@ -28,11 +29,46 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 
 {{/*
-Selector labels
+Selector labels, shared by a component's workload selector, pod labels, and
+Service and PodDisruptionBudget selectors, so they cannot drift apart.
+
+Pass the root context and the component's values:
+
+{{ include "sourcegraph.selectorLabels" (list . .Values.frontend) }}
 */}}
 {{- define "sourcegraph.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "sourcegraph.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
+{{- $top := index . 0 -}}
+{{- if not $top.Values.sourcegraph.selectorLabelsOverride -}}
+app.kubernetes.io/name: {{ include "sourcegraph.name" $top }}
+app.kubernetes.io/instance: {{ $top.Release.Name }}
+{{- end }}
+{{- with include "sourcegraph.customSelectorLabels" . }}
+{{ . }}
+{{- end }}
+{{- end }}
+
+{{/*
+The selector labels set in values: sourcegraph.selectorLabelsOverride, which
+replaces the default selector labels on every component, merged with the
+component's extraSelectorLabels. Empty by default.
+
+These exist to adopt workloads created outside this chart, whose selectors
+are immutable. The chart sets the labels in $chartLabels itself, so
+overriding one would stop a selector from matching its pods.
+*/}}
+{{- define "sourcegraph.customSelectorLabels" -}}
+{{- $top := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- $chartLabels := list "app" "deploy" "group" "type" "worker-replica" -}}
+{{- $labels := mergeOverwrite (dict) ($top.Values.sourcegraph.selectorLabelsOverride | default dict) ($component.extraSelectorLabels | default dict) -}}
+{{- range $chartLabel := $chartLabels -}}
+{{- if hasKey $labels $chartLabel -}}
+{{- fail (printf "sourcegraph.selectorLabelsOverride and <serviceName>.extraSelectorLabels must not set the label %q, which the chart sets itself" $chartLabel) -}}
+{{- end -}}
+{{- end -}}
+{{- with $labels -}}
+{{ toYaml . }}
+{{- end -}}
 {{- end }}
 
 {{/*

diff --git a/charts/sourcegraph/templates/_worker.tpl b/charts/sourcegraph/templates/_worker.tpl
@@ -29,7 +29,7 @@ spec:
   revisionHistoryLimit: {{ $top.Values.sourcegraph.revisionHistoryLimit }}
   selector:
     matchLabels:
-      {{- include "sourcegraph.selectorLabels" $top | nindent 6 }}
+      {{- include "sourcegraph.selectorLabels" (list $top $top.Values.worker) | nindent 6 }}
       app: worker
       {{- if $suffix }}
       worker-replica: {{ $name | quote }}
@@ -51,7 +51,7 @@ spec:
       {{- toYaml $top.Values.worker.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" $top | nindent 8 }}
+      {{- include "sourcegraph.selectorLabels" (list $top $top.Values.worker) | nindent 8 }}
       {{- if $top.Values.sourcegraph.podLabels }}
       {{- toYaml $top.Values.sourcegraph.podLabels | nindent 8 }}
       {{- end }}

diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
@@ -18,7 +18,7 @@ spec:
   revisionHistoryLimit: {{ .Values.sourcegraph.revisionHistoryLimit }}
   selector:
     matchLabels:
-      {{- include "sourcegraph.selectorLabels" . | nindent 6 }}
+      {{- include "sourcegraph.selectorLabels" (list . .Values.blobstore) | nindent 6 }}
       app: blobstore
   strategy:
     type: Recreate
@@ -33,7 +33,7 @@ spec:
       {{- toYaml .Values.blobstore.podAnnotations | nindent 8 }}
       {{- end }}
       labels:
-      {{- include "sourcegraph.selectorLabels" . | nindent 8 }}
+      {{- include "sourcegraph.selectorLabels" (list . .Values.blobstore) | nindent 8 }}
       {{- if .Values.sourcegraph.podLabels }}
       {{- toYaml .Values.sourcegraph.podLabels | nindent 8 }}
       {{- end }}

diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
@@ -23,7 +23,7 @@ spec:
   {{- toYaml . | nindent 2 }}
   {{- end }}
   selector:
-    {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
+    {{- include "sourcegraph.selectorLabels" (list . .Values.blobstore) | nindent 4 }}
     app: blobstore
   type: {{ .Values.blobstore.serviceType | default "ClusterIP" }}
 {{- end }}