From 704048708f3dc11f7e77cd7f91aab892b1ab07e9 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Fri, 4 Sep 2026 18:44:12 -0600 Subject: [PATCH] Add grafana.initContainers for native sidecars Grafana provisions datasources within ~1s of starting and exits if a `$__file{}` referenced by datasources.yml doesn't exist yet. A sidecar under `grafana.extraContainers` that writes that file races grafana on pod start, and grafana crash-loops until the file appears. `grafana.initContainers` lets the sidecar be a native sidecar init container (`restartPolicy: Always`) with a startupProbe on the file, so the kubelet holds grafana until the file is written. Amp-Thread-ID: https://ampcode.com/threads/T-01a06eff-f826-72a5-9ee6-29e07f496a87 Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 1 + charts/sourcegraph/README.md | 1 + charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml | 4 ++++ charts/sourcegraph/values.yaml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index fb16ae74..05e0666b 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -10,6 +10,7 @@ Use `**BREAKING**:` to denote a breaking change - Corrected the external object storage examples to configure the shared store for frontend, worker, precise code intel, syntactic code intel, gitserver, and searcher, including credentials or workload service accounts as required. - Removed the unused application ports from the precise and syntactic code intel worker Deployments and Services; health checks and Prometheus metrics continue to use the debug server on port 6060. +- Added `grafana.initContainers`, so a native sidecar (`restartPolicy: Always`) can be started before `grafana`, e.g. to write a datasource credential file that `datasources.yml` reads with `$__file{}` - Added `gitserver.storageAccessModes` (default `["ReadWriteOnce"]`) to allow `["ReadWriteOncePod"]`, which lets Kubernetes mount the repos volume with `-o context` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) instead of recursively relabeling every file on each pod start. Changing this on an existing deployment requires recreating the StatefulSet and PVC, as both fields are immutable. - Added configurable pre-shutdown pauses, graceful-shutdown timeouts, and termination grace periods for application services - Added optional `syntectServer.podDisruptionBudget` support diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index ae7695dd..028cfd3f 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -153,6 +153,7 @@ In addition to the documented values, all services also support the following va | grafana.existingConfig | string | `""` | Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key. | | grafana.image.defaultTag | string | `"6.0.0@sha256:e40236d0143d0735ff87374afce95b878b8cde448ef65cfdc7008056a03097e8"` | Docker image tag for the `grafana` image | | grafana.image.name | string | `"grafana"` | Docker image name for the `grafana` image | +| grafana.initContainers | list | `[]` | Init containers for the `grafana` pod. Use `restartPolicy: Always` for a native sidecar that must be started before `grafana`, such as one that writes a datasource credential file read by `datasources.yml` | | grafana.name | string | `"grafana"` | Name used by resources. Does not affect service names or PVCs. | | grafana.podSecurityContext | object | `{"fsGroup":472,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":472,"runAsUser":472}` | Security context for the `grafana` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) | | grafana.resources | object | `{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"100m","memory":"512Mi"}}` | Resource requests & limits for the `grafana` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | diff --git a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml index 2d6812fa..1dfc52b5 100644 --- a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml +++ b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml @@ -42,6 +42,10 @@ spec: app: grafana deploy: sourcegraph spec: + {{- with .Values.grafana.initContainers }} + initContainers: + {{- toYaml . | nindent 6 }} + {{- end }} containers: - name: grafana image: {{ include "sourcegraph.image" (list . "grafana") }} diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 5389a712..85a14dca 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -507,6 +507,8 @@ grafana: sslmode: "" # -- Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key. existingConfig: "" # Name of an existing configmap + # -- Init containers for the `grafana` pod. Use `restartPolicy: Always` for a native sidecar that must be started before `grafana`, such as one that writes a datasource credential file read by `datasources.yml` + initContainers: [] image: # -- Docker image tag for the `grafana` image defaultTag: 6.0.0@sha256:e40236d0143d0735ff87374afce95b878b8cde448ef65cfdc7008056a03097e8