Allow precise-code-intel-worker /tmp scratch on a per-pod PVC

charts/sourcegraph/README.md

@@ -341,6 +341,8 @@ In addition to the documented values, all services also support the following va
 | preciseCodeIntel.resources | object | `{"limits":{"cpu":"2","memory":"4G"},"requests":{"cpu":"500m","memory":"2G"}}` | Resource requests & limits for the `precise-code-intel-worker` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
 | preciseCodeIntel.serviceAccount.create | bool | `false` | Enable creation of ServiceAccount for `precise-code-intel-worker` |
 | preciseCodeIntel.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
+| preciseCodeIntel.storageSize | string | `""` | Size of the `/tmp` scratch volume. Required when storageType is `pvc`. When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty for unlimited). |
+| preciseCodeIntel.storageType | string | `"emptyDir"` | Backing store for the `/tmp` scratch volume, used for large SCIP upload processing. One of: emptyDir, pvc. emptyDir: node ephemeral storage, i.e. the node boot disk. pvc: per-pod PVC on `storageClass.name`, discarded with the pod. The pod `fsGroup` defaults to the container `runAsGroup` so the non-root worker can write to the volume; set `podSecurityContext.fsGroup` to override it. |
 | priorityClasses | list | `[]` | Additional priorityClasses minimize re-scheduling downtime for StatefulSets. Each StatefulSets might use different priority class. learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) Sample class definition: - name: gitserver-class   value: 100   preemptionPolicy: Never   description: "gitserver priority class" |
 | prometheus.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":false,"runAsGroup":100,"runAsUser":100}` | Security context for the `prometheus` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
 | prometheus.createRoleBinding | bool | `true` | Disable the creation of a RoleBinding object, for customers who block all RBAC resource creation |

charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml

@@ -45,6 +45,10 @@ spec:
         deploy: sourcegraph
         app: precise-code-intel-worker
     spec:
+      {{- $storageType := .Values.preciseCodeIntel.storageType | default "emptyDir" }}
+      {{- if not (has $storageType (list "emptyDir" "pvc")) }}
+      {{- fail (printf "preciseCodeIntel.storageType must be one of emptyDir, pvc; got %q" $storageType) }}
+      {{- end }}
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "preciseCodeIntel") | nindent 6 }}
       containers:
       - name: precise-code-intel-worker
@@ -104,8 +108,13 @@ spec:
       {{- if .Values.preciseCodeIntel.extraContainers }}
         {{- toYaml .Values.preciseCodeIntel.extraContainers | nindent 6 }}
       {{- end }}
+      {{- $podSecurityContext := deepCopy .Values.preciseCodeIntel.podSecurityContext }}
+      {{- if eq $storageType "pvc" }}
+      {{- /* A freshly provisioned volume is root-owned, so the non-root worker needs fsGroup to write /tmp. */}}
+      {{- $podSecurityContext = merge $podSecurityContext (dict "fsGroup" (.Values.preciseCodeIntel.containerSecurityContext.runAsGroup | default 101) "fsGroupChangePolicy" "OnRootMismatch") }}
+      {{- end }}
       securityContext:
-        {{- toYaml .Values.preciseCodeIntel.podSecurityContext | nindent 8 }}
+        {{- toYaml $podSecurityContext | nindent 8 }}
       {{- include "sourcegraph.nodeSelector" (list . "preciseCodeIntel" ) | trim | nindent 6 }}
       {{- include "sourcegraph.affinity" (list . "preciseCodeIntel" ) | trim | nindent 6 }}
       {{- with include "sourcegraph.priorityClassName" (list . "preciseCodeIntel" ) | trim }}{{ . | nindent 6 }}{{- end }}
@@ -117,7 +126,22 @@ spec:
       {{- include "sourcegraph.renderServiceAccountName" (list . "preciseCodeIntel") | trim | nindent 6 }}
       volumes:
       - name: tmpdir
+        {{- if eq $storageType "pvc" }}
+        ephemeral:
+          volumeClaimTemplate:
+            spec:
+              accessModes:
+              - ReadWriteOnce
+              resources:
+                requests:
+                  storage: {{ required "preciseCodeIntel.storageSize is required when preciseCodeIntel.storageType is pvc" .Values.preciseCodeIntel.storageSize }}
+              storageClassName: {{ .Values.storageClass.name }}
+        {{- else if .Values.preciseCodeIntel.storageSize }}
+        emptyDir:
+          sizeLimit: {{ .Values.preciseCodeIntel.storageSize }}
+        {{- else }}
         emptyDir: {}
+        {{- end }}
       {{- if .Values.preciseCodeIntel.extraVolumes }}
       {{- toYaml .Values.preciseCodeIntel.extraVolumes | nindent 6 }}
       {{- end }}

charts/sourcegraph/tests/preciseCodeIntelStorage_test.yaml

@@ -0,0 +1,130 @@
+---
+suite: preciseCodeIntelStorage
+templates:
+- precise-code-intel/worker.Deployment.yaml
+tests:
+- it: should back tmpdir with a plain emptyDir by default
+  asserts:
+  - contains:
+      path: spec.template.spec.volumes
+      content:
+        name: tmpdir
+        emptyDir: {}
+  - contains:
+      path: spec.template.spec.containers[0].volumeMounts
+      content:
+        mountPath: /tmp
+        name: tmpdir
+
+- it: should set sizeLimit when storageSize is set on the emptyDir branch
+  set:
+    preciseCodeIntel:
+      storageType: emptyDir
+      storageSize: 20Gi
+  asserts:
+  - contains:
+      path: spec.template.spec.volumes
+      content:
+        name: tmpdir
+        emptyDir:
+          sizeLimit: 20Gi
+
+- it: should back tmpdir with a per-pod PVC when storageType=pvc
+  set:
+    preciseCodeIntel:
+      storageType: pvc
+      storageSize: 50Gi
+  asserts:
+  - contains:
+      path: spec.template.spec.volumes
+      content:
+        name: tmpdir
+        ephemeral:
+          volumeClaimTemplate:
+            spec:
+              accessModes:
+              - ReadWriteOnce
+              resources:
+                requests:
+                  storage: 50Gi
+              storageClassName: sourcegraph
+  # /tmp mount is unchanged, so no TMPDIR redirect is needed
+  - contains:
+      path: spec.template.spec.containers[0].volumeMounts
+      content:
+        mountPath: /tmp
+        name: tmpdir
+
+- it: should follow storageClass.name like every other PVC in the chart
+  set:
+    storageClass:
+      name: custom-ssd
+    preciseCodeIntel:
+      storageType: pvc
+      storageSize: 50Gi
+  asserts:
+  - equal:
+      path: spec.template.spec.volumes[0].ephemeral.volumeClaimTemplate.spec.storageClassName
+      value: custom-ssd
+
+- it: should fail when storageSize is omitted on the pvc branch
+  set:
+    preciseCodeIntel:
+      storageType: pvc
+  asserts:
+  - failedTemplate:
+      errorMessage: preciseCodeIntel.storageSize is required when preciseCodeIntel.storageType is pvc
+
+- it: should fall back to emptyDir when storageType is absent
+  set:
+    preciseCodeIntel:
+      storageType: null
+  asserts:
+  - contains:
+      path: spec.template.spec.volumes
+      content:
+        name: tmpdir
+        emptyDir: {}
+
+- it: should fail on an unknown storageType
+  set:
+    preciseCodeIntel:
+      storageType: PVC
+      storageSize: 50Gi
+  asserts:
+  - failedTemplate:
+      errorMessage: 'preciseCodeIntel.storageType must be one of emptyDir, pvc; got "PVC"'
+
+- it: should leave the pod securityContext untouched on the emptyDir branch
+  asserts:
+  - equal:
+      path: spec.template.spec.securityContext
+      value: {}
+
+- it: should set fsGroup to the container runAsGroup on the pvc branch so /tmp is writable
+  set:
+    preciseCodeIntel:
+      storageType: pvc
+      storageSize: 50Gi
+  asserts:
+  - equal:
+      path: spec.template.spec.securityContext
+      value:
+        fsGroup: 101
+        fsGroupChangePolicy: OnRootMismatch
+
+- it: should keep a user-set fsGroup and other podSecurityContext fields on the pvc branch
+  set:
+    preciseCodeIntel:
+      storageType: pvc
+      storageSize: 50Gi
+      podSecurityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+  asserts:
+  - equal:
+      path: spec.template.spec.securityContext
+      value:
+        fsGroup: 2000
+        fsGroupChangePolicy: OnRootMismatch
+        runAsNonRoot: true

charts/sourcegraph/values.yaml

@@ -979,6 +979,17 @@ preciseCodeIntel:
     create: false
     # -- Name of the ServiceAccount to be created or an existing ServiceAccount
     name: ""
+  # -- Backing store for the `/tmp` scratch volume, used for large SCIP upload
+  # processing. One of: emptyDir, pvc.
+  # emptyDir: node ephemeral storage, i.e. the node boot disk.
+  # pvc: per-pod PVC on `storageClass.name`, discarded with the pod. The pod
+  # `fsGroup` defaults to the container `runAsGroup` so the non-root worker can
+  # write to the volume; set `podSecurityContext.fsGroup` to override it.
+  storageType: emptyDir
+  # -- Size of the `/tmp` scratch volume. Required when storageType is `pvc`.
+  # When storageType is `emptyDir` this sets `sizeLimit` (optional, leave empty
+  # for unlimited).
+  storageSize: ""
 
 prometheus:
   # -- Enable `prometheus` (recommended)