From 79de2e2158d4f31dcad1e07cc181c2d4bfdeb377 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Thu, 6 Aug 2026 23:51:37 -0600 Subject: [PATCH] gitserver: make PVC access modes configurable via storageAccessModes The gitserver StatefulSet volumeClaimTemplate hardcoded accessModes: [ReadWriteOnce]. On SELinux-enforcing nodes (Bottlerocket, EKS Auto Mode), every gitserver pod (re)start makes containerd recursively relabel every file on the repos volume with the new container's MCS categories, because the volume cannot use the -o context mount option. On a volume with millions of git objects this holds the pod in ContainerCreating for 15-30+ minutes. Since Kubernetes 1.36, SELinuxMountReadWriteOncePod is GA: a ReadWriteOncePod PVC (plus a pinned seLinuxOptions.level and a CSI driver with seLinuxMount: true) is mounted with -o context and skips the relabel walk entirely. Adds gitserver.storageAccessModes, defaulting to the previous hardcoded [ReadWriteOnce], so existing deployments are unchanged. Amp-Thread-ID: https://ampcode.com/threads/T-019fdaa3-9594-762b-8593-8de01deb566e Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 1 + charts/sourcegraph/README.md | 1 + .../sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml | 2 +- charts/sourcegraph/values.yaml | 2 ++ 4 files changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index 1ed7b2c3..4bc4ff48 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -8,6 +8,7 @@ Use `**BREAKING**:` to denote a breaking change ## Unreleased +- Added `gitserver.storageAccessModes` (default `["ReadWriteOnce"]`) to allow `["ReadWriteOncePod"]`, which lets Kubernetes mount the repos volume with `-o context` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) instead of recursively relabeling every file on each pod start. Changing this on an existing deployment requires recreating the StatefulSet and PVC, as both fields are immutable. - Added `searcher.autoCacheSize` (default `false`) to omit the `SEARCHER_CACHE_SIZE_MB` and `SYMBOLS_CACHE_SIZE_MB` env vars, letting `searcher` auto-size its cache to ~45% of the live cache volume so it tracks PVC expansion instead of staying frozen to the initial `storageSize` - Added support for ordering trace processors via `openTelemetry.gateway.config.traces.tracePipelineProcessors`, falling back to processors ordered by name when unset - Removed the unused executor controller `/data` PersistentVolumeClaim from the Kubernetes-native executor chart (`sourcegraph-executor/k8s`), along with the now-orphaned `storageClass` and `executor.storageSize` values and the vestigial `EXECUTOR_KUBERNETES_PERSISTENCE_VOLUME_NAME` env var. Since single-job-pod became the only k8s execution mode, job pods use their own ephemeral `emptyDir` volume and the controller writes nothing to `/data`. diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index 8a51554b..c6232ba3 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -130,6 +130,7 @@ In addition to the documented values, all services also support the following va | gitserver.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `gitserver` | | gitserver.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | | gitserver.sshSecret | string | `""` | Name of existing Secret that contains SSH credentials to clone repositories. It usually contains keys, such as `id_rsa` (private key) and `known_hosts`. Learn more from [documentation](https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-ssh-to-clone-repositories) | +| gitserver.storageAccessModes | list | `["ReadWriteOnce"]` | Access modes for the `gitserver` PVC. Set to `["ReadWriteOncePod"]` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) so Kubernetes mounts the volume with `-o context` instead of recursively relabeling every file on each pod start | | gitserver.storageAnnotations | object | `{}` | Optional annotations to add to the `gitserver` PVC | | gitserver.storageSize | string | `"200Gi"` | PVC Storage Request for `gitserver` data volume | | gitserver.storageSubPath | string | `""` | Optional subPath for the `gitserver` primary data volume mount | diff --git a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml index 99d1eca7..01197c2c 100644 --- a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml +++ b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml @@ -133,7 +133,7 @@ spec: {{- end }} spec: accessModes: - - ReadWriteOnce + {{- toYaml .Values.gitserver.storageAccessModes | nindent 6 }} resources: requests: # The size of disk used to mirror your git repositories. diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index d260444e..e74a6efe 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -454,6 +454,8 @@ gitserver: create: false # -- Name of the ServiceAccount to be created or an existing ServiceAccount name: "" + # -- Access modes for the `gitserver` PVC. Set to `["ReadWriteOncePod"]` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) so Kubernetes mounts the volume with `-o context` instead of recursively relabeling every file on each pod start + storageAccessModes: ["ReadWriteOnce"] # -- PVC Storage Request for `gitserver` data volume storageSize: 200Gi # -- Optional subPath for the `gitserver` primary data volume mount