Repository navigation
Remove unused ports, Role verbs, and settings from the charts - #1017
Closed
marcleblanc2 wants to merge 5 commits into
Closed
marcleblanc2 wants to merge 5 commits into
marcleblanc2 wants to merge 5 commits into
Conversation
Neither port has a listener reachable from outside its pod: - otel-agent zpages binds localhost:55679, so hostPort 55679 only reserved the port on every node - dockerd in the dind sidecar binds 127.0.0.1:2375, and the executor reaches it over localhost Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp <amp@ampcode.com>
Nothing ever asked Jaeger for sampling strategies: no Service exposed 5778, Sourcegraph and zoekt used a constant sampler while they had Jaeger clients, and both use OpenTelemetry since Sourcegraph 4.0. jaeger.config.samplingDefaultProbability is removed with it. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp <amp@ampcode.com>
marcleblanc2
changed the title
The executor watches Pods, gets pods/log, and creates and deletes Jobs, Secrets, and PVCs. It has not called get or list on Pods, Secrets, or PVCs since Sourcegraph 5.1; 30 days of EKS audit logs on two test instances show no such calls. SRC_TRACE_LOG has been unread since Sourcegraph 5.2. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp <amp@ampcode.com>
marcleblanc2
changed the title
marcleblanc2
changed the title
marcleblanc2
added a commit
that referenced
this pull request
Nov 13, 2026
The cleanup CronJob runs as sg-executor and lists Jobs, Secrets, and PVCs, and kubectl delete gets each one first. #1017 removes get and list on Secrets and PVCs from the executor's Role, since the executor never calls them, which would leave the CronJob with 403s. Grant get and list on all three in a rule rendered only with executor.cleanup.enabled, instead of on Jobs for every install. kubectl delete also waits by default, which lists and watches an object that lingers, such as a PVC held by its protection finalizer. The Role has no watch, so delete with --wait=false. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp <amp@ampcode.com>
marcleblanc2
changed the title
The jaeger pod asked Prometheus to scrape port 16686, which serves the UI and returns 404 for /metrics. The kubernetes-services job probed through a blackbox exporter the chart does not ship, and no Service opts in. Amp-Thread-ID: https://ampcode.com/threads/T-01a1d269-2788-7075-b66b-b87e3087047d Co-authored-by: Amp <amp@ampcode.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Following #1016, I checked every object and port the four charts render against what uses it. Almost everything is used. This PR removes the five things that are not.
otel-agentport 55679 (http-zpages) and itshostPortlocalhostonly, so the port was never reachable from outside the pod. It just reserved 55679 on every nodedindsidecardockerdlistens on127.0.0.1only, and the executor reaches it overlocalhostremote_samplingextension and port 5778getandliston Pods, Secrets, and PVCs in the k8s executor's RoleSRC_TRACE_LOGin the k8s executor's ConfigMapThree values go with them and are ignored if still set:
openTelemetry.agent.hostPorts.httpZpages,jaeger.config.samplingDefaultProbability, andexecutor.log.trace.Upgrade impact
otel-agent,jaeger, and dind executor pods restart onceEvidence
m5:otel-agentlistens on127.0.0.1:55679only, and connecting to 55679 on the pod IP or node IP fails.kubectl port-forwardstill reaches zpagesmandm5: 365 requests, all create/delete on Jobs and Secrets, watch on Pods, or get onpods/loglint.sh,helm unittest, and helm-docs pass.helm templateagainstmaindiffers only in the removed linesNot tested: a live
helm upgrade, the dind executor, or Jaeger on a cluster.Heads-up for other PRs
getandliston Secrets and PVCs. It now grants them itself when cleanup is enabled (ce2cf93on that branch), so the two PRs work in either merge orderFound, not changed
jaeger.serviceAccount.create: truefails the render: the template reads.Values.tracing/metricskubernetes-servicesjob probes through ablackboxexporter the chart doesn't shipThe full inventory is in the Amp thread.
Changelog
http-zpagesport andhostPortfrom theotel-agentDaemonSet;openTelemetry.agent.hostPorts.httpZpagesno longer has any effectdindsidecarremote_samplingextension and port 5778;jaeger.config.samplingDefaultProbabilityno longer has any effectSRC_TRACE_LOGsetting andexecutor.log.tracevalue