fix/resources: Drop unused ports, Services, Role verbs, and settings - #1016

Summary

I checked every object, port, and setting the four charts render against what actually uses it, and opened this PR to remove the eight things that are not used

These values go with them and are ignored if still set: openTelemetry.agent.hostPorts.httpZpages, jaeger.config.samplingDefaultProbability, executor.log.trace, and the undocumented executor.serviceAnnotations, executor.serviceLabels, and executor.serviceType.

Upgrade impact

• No admin action needed
• No change to system behaviour
• Helm deletes the executor-<queueName> Service
• The k8s executor, dind executor, otel-agent, and jaeger pods restart once
• Executor metrics are not affected: they go to frontend with each heartbeat, and Prometheus scrapes them from worker-executors

Evidence

• k8s executor, on test instances m and m5: no process listens on 6060, connecting to the pod or the Service on 6060 fails, and worker-executors:6996/metrics returns 200
• k8s executor Role: 30 days of EKS audit logs for its ServiceAccount on m and m5 show 365 requests, all create/delete on Jobs and Secrets, watch on Pods, or get on pods/log
• otel-agent, on m5: listens on 127.0.0.1:55679 only, and connecting on the pod IP or node IP fails. kubectl port-forward still reaches zpages
• Jaeger 2.17.0 (the pinned image's version), run locally with this PR's config: starts cleanly, accepts a trace, and shows it in the UI. 16686/metrics returns 404
• lint.sh, helm unittest, and helm-docs pass. helm template against main differs only in the removed lines

Review

Reviewed on 2026-11-13 (review thread), at bc281c3. No open issues.

Tested on the EKS test instance m5, by upgrading from main to this branch merged onto main:

• k8s executor: the Service is deleted, the Role is narrowed to what the table says, the executor logs no Forbidden, and a batch spec completes on main and on this branch
• otel-agent: only ports 4317, 4318, and 8888 remain, and the node's port 55679 is closed
• Jaeger: starts with no errors, and a span posted to an otel-agent node port shows up in the Jaeger UI
• Prometheus: the loaded config has no kubernetes-services job once the pod restarts, and the other targets are unchanged. On main nothing restarts the pod for a config change; Render sourcegraph.labels on every object, and add storage and ServiceAccount labels #1008 and fix/rbac: Fix Prometheus' defaults, privileged: false, and scope discovery down to the same namespace #1015 add that
• dind executor: port 2375 is gone from the sidecar and the executor still sends heartbeats. A batch spec fails the same way on main and on this branch (step.docker.step.0.post exits 1), so that is a problem with the test instance, not this PR

Not tested: an auto-indexing job (not enabled on the instance), and traces sent by Sourcegraph itself (the instance's collector is configured to log traces, not forward them).

Small ones, none blocking:

• No test asserts that the removed objects, ports, and values stay removed
• The zpages extension still runs in otel-agent, on localhost only