From 33970cf5f5428a3bf2a3eafca3ca06a92db25bc0 Mon Sep 17 00:00:00 2001 From: Dinesh Kumar <5300055+devdinu@users.noreply.github.com> Date: Thu, 8 Oct 2026 12:30:42 -0700 Subject: [PATCH] fix(precise-code-intel): decouple tmpdir PVC from storageClass The /tmp scratch volume is a generic ephemeral volume, so its claim is created and deleted with the pod. It took its class from storageClass.name, which is reclaimPolicy Retain for stateful data. Each worker restart therefore left a Released PV and its backing disk behind, and the disks accumulated until the cloud provider's SSD quota rejected new claims. The claim now reads preciseCodeIntel.storageClassName, which defaults to empty so the cluster default class applies. Cluster defaults are reclaimPolicy Delete, so the volume is reclaimed with the pod. The value is deliberately not a concrete class name, since those differ per cloud provider. storageType defaults to emptyDir, so the default render is unchanged. --- charts/sourcegraph/README.md | 3 ++- .../precise-code-intel/worker.Deployment.yaml | 4 ++- .../tests/preciseCodeIntelStorage_test.yaml | 27 ++++++++++++++++--- charts/sourcegraph/values.yaml | 11 +++++--- 4 files changed, 37 insertions(+), 8 deletions(-) diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md index 38e5c730..b55aa5e2 100644 --- a/charts/sourcegraph/README.md +++ b/charts/sourcegraph/README.md @@ -341,8 +341,9 @@ In addition to the documented values, all services also support the following va | preciseCodeIntel.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `precise-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) | | preciseCodeIntel.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `precise-code-intel-worker` | | preciseCodeIntel.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount | +| preciseCodeIntel.storageClassName | string | `""` | StorageClass for the `/tmp` scratch PVC when storageType is `pvc`. Empty uses the cluster default class. The claim is per-pod and discarded with the pod, so this class must use `reclaimPolicy: Delete`; `storageClass` is `Retain` for stateful data and is not used here. | | preciseCodeIntel.storageSize | string | `""` | Size of the `/tmp` scratch volume. Required when storageType is `pvc`. When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty for unlimited). | -| preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC on `storageClass.name`, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. | +| preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. | | priorityClasses | list | `[]` | Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) Sample class definition: - name: gitserver-class value: 100 preemptionPolicy: Never description: "gitserver priority class" | | prometheus.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":false,"runAsGroup":100,"runAsUser":100}` | Security context for the `prometheus` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) | | prometheus.createRoleBinding | bool | `true` | Disable the creation of a RoleBinding object, for customers who block all RBAC resource creation | diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml index 758eaa9e..74e59a48 100644 --- a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml +++ b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml @@ -135,7 +135,9 @@ spec: resources: requests: storage: {{ required "preciseCodeIntel.storageSize is required when preciseCodeIntel.storageType is pvc" .Values.preciseCodeIntel.storageSize }} - storageClassName: {{ .Values.storageClass.name }} + {{- with .Values.preciseCodeIntel.storageClassName }} + storageClassName: {{ . }} + {{- end }} {{- else if .Values.preciseCodeIntel.storageSize }} emptyDir: sizeLimit: {{ .Values.preciseCodeIntel.storageSize }} diff --git a/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml b/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml index f60651af..7c2d86bf 100644 --- a/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml +++ b/charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml @@ -47,7 +47,6 @@ tests: resources: requests: storage: 50Gi - storageClassName: sourcegraph # /tmp mount is unchanged, so no TMPDIR redirect is needed - contains: path: spec.template.spec.containers[0].volumeMounts @@ -55,17 +54,39 @@ tests: mountPath: /tmp name: tmpdir -- it: should follow storageClass.name like every other PVC in the chart +# The per-pod claim needs a Delete-policy class; storageClass is Retain. +- it: should omit storageClassName by default so the cluster default class is used + set: + preciseCodeIntel: + storageType: pvc + storageSize: 50Gi + asserts: + - notExists: + path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName + +- it: should not inherit storageClass.name + set: + storageClass: + name: custom-ssd + preciseCodeIntel: + storageType: pvc + storageSize: 50Gi + asserts: + - notExists: + path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName + +- it: should use preciseCodeIntel.storageClassName when set set: storageClass: name: custom-ssd preciseCodeIntel: storageType: pvc storageSize: 50Gi + storageClassName: premium-rwo asserts: - equal: path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName - value: custom-ssd + value: premium-rwo - it: should fail when storageSize is omitted on the pvc branch set: diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml index 73362f75..c96683f9 100644 --- a/charts/sourcegraph/values.yaml +++ b/charts/sourcegraph/values.yaml @@ -982,14 +982,19 @@ preciseCodeIntel: # -- Backing store for the `/tmp` scratch volume, used for large SCIP upload # processing. One of: emptyDir, pvc. # emptyDir: node ephemeral storage, i.e. the node boot disk. - # pvc: per-pod PVC on `storageClass.name`, discarded with the pod. The pod - # `fsGroup` defaults to the container `runAsGroup` so the non-root worker can - # write to the volume; set `podSecurityContext.fsGroup` to override it. + # pvc: per-pod PVC, discarded with the pod. The pod `fsGroup` defaults to the + # container `runAsGroup` so the non-root worker can write to the volume; set + # `podSecurityContext.fsGroup` to override it. storageType: emptyDir # -- Size of the `/tmp` scratch volume. Required when storageType is `pvc`. # When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty # for unlimited). storageSize: "" + # -- StorageClass for the `/tmp` scratch PVC when storageType is `pvc`. + # Empty uses the cluster default class. The claim is per-pod and discarded + # with the pod, so this class must use `reclaimPolicy: Delete`; `storageClass` + # is `Retain` for stateful data and is not used here. + storageClassName: "" prometheus: # -- Enable `prometheus` (recommended)