From 538e3794f8ee878b0485bb18b87455a459e75192 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Tue, 28 Jul 2026 18:07:38 -0600 Subject: [PATCH 1/2] Simplifying external blobstore examples, and adding GCP examples --- charts/sourcegraph/examples/aws/override.yaml | 4 +- .../aws-s3-access-key-authentication.yaml | 47 +++++++++++++++++ .../aws-s3-irsa-authentication.yaml | 50 +++++++++++++++++++ .../gcp-gcs-service-account-key.yaml | 39 +++++++++++++++ .../gcp-gcs-workload-identity.yaml | 35 +++++++++++++ .../external-object-storage/override.yaml | 45 ----------------- 6 files changed, 174 insertions(+), 46 deletions(-) create mode 100644 charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml create mode 100644 charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml create mode 100644 charts/sourcegraph/examples/external-object-storage/gcp-gcs-service-account-key.yaml create mode 100644 charts/sourcegraph/examples/external-object-storage/gcp-gcs-workload-identity.yaml delete mode 100644 charts/sourcegraph/examples/external-object-storage/override.yaml diff --git a/charts/sourcegraph/examples/aws/override.yaml b/charts/sourcegraph/examples/aws/override.yaml index 058f04e9a..595db2731 100644 --- a/charts/sourcegraph/examples/aws/override.yaml +++ b/charts/sourcegraph/examples/aws/override.yaml @@ -145,7 +145,9 @@ migrator: executor: frontendUrl: "http://sourcegraph-frontend:30080" # Use cluster-local DNS name, to avoid paying extra for network traffic frontendPassword: "long_random_password_which_matches_in_site_config" - queueNames: [ "batches", "codeintel" ] + queueNames: + - "batches" + - "codeintel" ################################################################################ # Extra resources diff --git a/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml b/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml new file mode 100644 index 000000000..572c3aeb0 --- /dev/null +++ b/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml @@ -0,0 +1,47 @@ +# Override file demonstrating the use of external Object Storage services +# Learn more from the tutorial below +# - https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-object-storage + +# Using an AWS S3 bucket, with access key authentication + +# Disable deployment of the built-in object storage +blobstore: + enabled: false + +# Use YAML anchors and aliases to keep override file clean +x-object-storage-env: &objectStorageEnv + SOURCEGRAPH_UPLOAD_BACKEND: + value: S3 # Either S3 or GCS + SOURCEGRAPH_UPLOAD_BUCKET: + value: sourcegraph-bucket + SOURCEGRAPH_UPLOAD_AWS_ENDPOINT: # Optional + value: https://s3.us-east-1.amazonaws.com + SOURCEGRAPH_UPLOAD_AWS_REGION: + value: us-east-1 + SOURCEGRAPH_UPLOAD_MANAGE_BUCKET: + value: "false" + SOURCEGRAPH_UPLOAD_AWS_ACCESS_KEY_ID: + secretKeyRef: + name: sourcegraph-s3-credentials # Pre-existing Kubernetes secret, not created by this Helm chart + key: SOURCEGRAPH_UPLOAD_AWS_ACCESS_KEY_ID + SOURCEGRAPH_UPLOAD_AWS_SECRET_ACCESS_KEY: + secretKeyRef: + name: sourcegraph-s3-credentials + key: SOURCEGRAPH_UPLOAD_AWS_SECRET_ACCESS_KEY + +# Apply the needed configs to the pods which use blob storage +frontend: + env: + <<: *objectStorageEnv + +preciseCodeIntel: + env: + <<: *objectStorageEnv + +syntacticCodeIntel: + env: + <<: *objectStorageEnv + +worker: + env: + <<: *objectStorageEnv diff --git a/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml b/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml new file mode 100644 index 000000000..578e15576 --- /dev/null +++ b/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml @@ -0,0 +1,50 @@ +# Override file demonstrating the use of external Object Storage services +# Learn more from the tutorial below +# - https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-object-storage + +# Using an AWS S3 bucket, with IRSA authentication + +# Disable deployment of the built-in object storage +blobstore: + enabled: false + +# Use YAML anchors and aliases to keep override file clean +x-object-storage-env: &objectStorageEnv + SOURCEGRAPH_UPLOAD_BACKEND: + value: S3 # Either S3 or GCS + SOURCEGRAPH_UPLOAD_BUCKET: + value: sourcegraph-bucket + SOURCEGRAPH_UPLOAD_AWS_ENDPOINT: # Optional + value: https://s3.us-east-1.amazonaws.com + SOURCEGRAPH_UPLOAD_AWS_REGION: + value: us-east-1 + SOURCEGRAPH_UPLOAD_MANAGE_BUCKET: + value: "false" + SOURCEGRAPH_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS: + value: "true" + +# Pods must run using a Kubernetes service account with the IRSA role annotation +x-service-account: &serviceAccount + create: false + name: sourcegraph-irsa + +# Apply the needed configs to the pods which use blob storage +frontend: + env: + <<: *objectStorageEnv + serviceAccount: *serviceAccount + +preciseCodeIntel: + env: + <<: *objectStorageEnv + serviceAccount: *serviceAccount + +syntacticCodeIntel: + env: + <<: *objectStorageEnv + serviceAccount: *serviceAccount + +worker: + env: + <<: *objectStorageEnv + serviceAccount: *serviceAccount diff --git a/charts/sourcegraph/examples/external-object-storage/gcp-gcs-service-account-key.yaml b/charts/sourcegraph/examples/external-object-storage/gcp-gcs-service-account-key.yaml new file mode 100644 index 000000000..a161f1a6e --- /dev/null +++ b/charts/sourcegraph/examples/external-object-storage/gcp-gcs-service-account-key.yaml @@ -0,0 +1,39 @@ +# Override file demonstrating the use of external Object Storage services +# Learn more from the tutorial below +# - https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-object-storage + +# Using a GCP GCS bucket, with an application credentials file from a service account + +# Disable deployment of the built-in object storage +blobstore: + enabled: false + +# Use YAML anchors and aliases to keep override file clean +x-object-storage-env: &objectStorageEnv + SOURCEGRAPH_UPLOAD_BACKEND: + value: GCS + SOURCEGRAPH_UPLOAD_BUCKET: + value: sourcegraph-bucket + SOURCEGRAPH_UPLOAD_MANAGE_BUCKET: + value: "false" + SOURCEGRAPH_UPLOAD_GOOGLE_APPLICATION_CREDENTIALS_FILE_CONTENT: + secretKeyRef: + name: sourcegraph-gcs-credentials # Pre-existing Kubernetes secret, not created by this Helm chart + key: SOURCEGRAPH_UPLOAD_GOOGLE_APPLICATION_CREDENTIALS_FILE_CONTENT + +# Apply the needed configs to the pods which use blob storage +frontend: + env: + <<: *objectStorageEnv + +preciseCodeIntel: + env: + <<: *objectStorageEnv + +syntacticCodeIntel: + env: + <<: *objectStorageEnv + +worker: + env: + <<: *objectStorageEnv diff --git a/charts/sourcegraph/examples/external-object-storage/gcp-gcs-workload-identity.yaml b/charts/sourcegraph/examples/external-object-storage/gcp-gcs-workload-identity.yaml new file mode 100644 index 000000000..0e0557c84 --- /dev/null +++ b/charts/sourcegraph/examples/external-object-storage/gcp-gcs-workload-identity.yaml @@ -0,0 +1,35 @@ +# Override file demonstrating the use of external Object Storage services +# Learn more from the tutorial below +# - https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-object-storage + +# Using a GCP GCS bucket, with workload identity authentication + +# Disable deployment of the built-in object storage +blobstore: + enabled: false + +# Use YAML anchors and aliases to keep override file clean +x-object-storage-env: &objectStorageEnv + SOURCEGRAPH_UPLOAD_BACKEND: + value: GCS + SOURCEGRAPH_UPLOAD_BUCKET: + value: sourcegraph-bucket + SOURCEGRAPH_UPLOAD_MANAGE_BUCKET: + value: "false" + +# Apply the needed configs to the pods which use blob storage +frontend: + env: + <<: *objectStorageEnv + +preciseCodeIntel: + env: + <<: *objectStorageEnv + +syntacticCodeIntel: + env: + <<: *objectStorageEnv + +worker: + env: + <<: *objectStorageEnv diff --git a/charts/sourcegraph/examples/external-object-storage/override.yaml b/charts/sourcegraph/examples/external-object-storage/override.yaml deleted file mode 100644 index db79f6398..000000000 --- a/charts/sourcegraph/examples/external-object-storage/override.yaml +++ /dev/null @@ -1,45 +0,0 @@ -# Override file demonstrating the use of external Object Storage services -# Learn more from the tutorial below -# - https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-external-object-storage - -# Disable deployment of the built-in object storage -blobstore: - enabled: false - -# we use YAML anchors and alias to keep override file clean -objectStorageEnv: &objectStorageEnv - PRECISE_CODE_INTEL_UPLOAD_BACKEND: - value: S3 # external object stoage type, one of "S3" or "GCS" - PRECISE_CODE_INTEL_UPLOAD_BUCKET: - value: lsif-uploads # external object storage bucket name - PRECISE_CODE_INTEL_UPLOAD_AWS_ENDPOINT: - value: https://s3.us-east-1.amazonaws.com - PRECISE_CODE_INTEL_UPLOAD_AWS_REGION: - value: us-east-1 - - # If using access key for authentication - PRECISE_CODE_INTEL_UPLOAD_AWS_ACCESS_KEY_ID: - secretKeyRef: # Pre-existing secret, not created by this chart - name: sourcegraph-s3-credentials - key: PRECISE_CODE_INTEL_UPLOAD_AWS_ACCESS_KEY_ID - PRECISE_CODE_INTEL_UPLOAD_AWS_SECRET_ACCESS_KEY: - secretKeyRef: # Pre-existing secret, not created by this chart - name: sourcegraph-s3-credentials - key: PRECISE_CODE_INTEL_UPLOAD_AWS_SECRET_ACCESS_KEY - - # If using IRSA for role-based authentication on the Kubernetes service account - # Do not set ACCESS_KEY_ID or SECRET_ACCESS_KEY; omitting them triggers fallback to IRSA - PRECISE_CODE_INTEL_UPLOAD_AWS_USE_EC2_ROLE_CREDENTIALS: - value: "true" - -frontend: - env: - <<: *objectStorageEnv - -preciseCodeIntel: - env: - <<: *objectStorageEnv - -syntacticCodeIntel: - env: - <<: *objectStorageEnv From fad54520095f980f33dbd06aeb5f0f96df9b0499 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Tue, 28 Jul 2026 18:16:30 -0600 Subject: [PATCH 2/2] Remove references to GCS in AWS examples --- .../aws-s3-access-key-authentication.yaml | 2 +- .../external-object-storage/aws-s3-irsa-authentication.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml b/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml index 572c3aeb0..3d9809cc1 100644 --- a/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml +++ b/charts/sourcegraph/examples/external-object-storage/aws-s3-access-key-authentication.yaml @@ -11,7 +11,7 @@ blobstore: # Use YAML anchors and aliases to keep override file clean x-object-storage-env: &objectStorageEnv SOURCEGRAPH_UPLOAD_BACKEND: - value: S3 # Either S3 or GCS + value: S3 SOURCEGRAPH_UPLOAD_BUCKET: value: sourcegraph-bucket SOURCEGRAPH_UPLOAD_AWS_ENDPOINT: # Optional diff --git a/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml b/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml index 578e15576..180e0d2ed 100644 --- a/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml +++ b/charts/sourcegraph/examples/external-object-storage/aws-s3-irsa-authentication.yaml @@ -11,7 +11,7 @@ blobstore: # Use YAML anchors and aliases to keep override file clean x-object-storage-env: &objectStorageEnv SOURCEGRAPH_UPLOAD_BACKEND: - value: S3 # Either S3 or GCS + value: S3 SOURCEGRAPH_UPLOAD_BUCKET: value: sourcegraph-bucket SOURCEGRAPH_UPLOAD_AWS_ENDPOINT: # Optional