Fix precise-code-intel tmpdir PVC reclaim policy

charts/sourcegraph/README.md

@@ -341,8 +341,9 @@ In addition to the documented values, all services also support the following va
 | preciseCodeIntel.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `precise-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
 | preciseCodeIntel.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `precise-code-intel-worker` |
 | preciseCodeIntel.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
+| preciseCodeIntel.storageClassName | string | `""` | StorageClass for the `/tmp` scratch PVC when storageType is `pvc`. Empty uses the cluster default class. The claim is per-pod and discarded with the pod, so this class must use `reclaimPolicy: Delete`; `storageClass` is `Retain` for stateful data and is not used here. |
 | preciseCodeIntel.storageSize | string | `""` | Size of the `/tmp` scratch volume. Required when storageType is `pvc`. When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty for unlimited). |
-| preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC on `storageClass.name`, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. |
+| preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. |
 | priorityClasses | list | `[]` | Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) Sample class definition: - name: gitserver-class   value: 100   preemptionPolicy: Never   description: "gitserver priority class" |
 | prometheus.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":false,"runAsGroup":100,"runAsUser":100}` | Security context for the `prometheus` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | prometheus.createRoleBinding | bool | `true` | Disable the creation of a RoleBinding object, for customers who block all RBAC resource creation |

charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml

@@ -135,7 +135,9 @@ spec:
               resources:
                 requests:
                   storage: {{ required "preciseCodeIntel.storageSize is required when preciseCodeIntel.storageType is pvc" .Values.preciseCodeIntel.storageSize }}
-              storageClassName: {{ .Values.storageClass.name }}
+              {{- with .Values.preciseCodeIntel.storageClassName }}
+              storageClassName: {{ . }}
+              {{- end }}
         {{- else if .Values.preciseCodeIntel.storageSize }}
         emptyDir:
           sizeLimit: {{ .Values.preciseCodeIntel.storageSize }}

charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml

@@ -47,25 +47,46 @@ tests:
               resources:
                 requests:
                   storage: 50Gi
-              storageClassName: sourcegraph
   # /tmp mount is unchanged, so no TMPDIR redirect is needed
   - contains:
       path: spec.template.spec.containers[0].volumeMounts
       content:
         mountPath: /tmp
         name: tmpdir
 
-- it: should follow storageClass.name like every other PVC in the chart
+# The per-pod claim needs a Delete-policy class; storageClass is Retain.
+- it: should omit storageClassName by default so the cluster default class is used
+  set:
+    preciseCodeIntel:
+      storageType: pvc
+      storageSize: 50Gi
+  asserts:
+  - notExists:
+      path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName
+
+- it: should not inherit storageClass.name
+  set:
+    storageClass:
+      name: custom-ssd
+    preciseCodeIntel:
+      storageType: pvc
+      storageSize: 50Gi
+  asserts:
+  - notExists:
+      path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName
+
+- it: should use preciseCodeIntel.storageClassName when set
   set:
     storageClass:
       name: custom-ssd
     preciseCodeIntel:
       storageType: pvc
       storageSize: 50Gi
+      storageClassName: premium-rwo
   asserts:
   - equal:
       path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName
-      value: custom-ssd
+      value: premium-rwo
 
 - it: should fail when storageSize is omitted on the pvc branch
   set:

charts/sourcegraph/values.yaml

@@ -982,14 +982,19 @@ preciseCodeIntel:
   # -- Backing store for the `/tmp` scratch volume, used for large SCIP upload
   # processing. One of: emptyDir, pvc.
   # emptyDir: node ephemeral storage, i.e. the node boot disk.
-  # pvc: per-pod PVC on `storageClass.name`, discarded with the pod. The pod
-  # `fsGroup` defaults to the container `runAsGroup` so the non-root worker can
-  # write to the volume; set `podSecurityContext.fsGroup` to override it.
+  # pvc: per-pod PVC, discarded with the pod. The pod `fsGroup` defaults to the
+  # container `runAsGroup` so the non-root worker can write to the volume; set
+  # `podSecurityContext.fsGroup` to override it.
   storageType: emptyDir
   # -- Size of the `/tmp` scratch volume. Required when storageType is `pvc`.
   # When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty
   # for unlimited).
   storageSize: ""
+  # -- StorageClass for the `/tmp` scratch PVC when storageType is `pvc`.
+  # Empty uses the cluster default class. The claim is per-pod and discarded
+  # with the pod, so this class must use `reclaimPolicy: Delete`; `storageClass`
+  # is `Retain` for stateful data and is not used here.
+  storageClassName: ""
 
 prometheus:
   # -- Enable `prometheus` (recommended)