From c3daceca4e634cdade5fd05d276a257e1c1e8d68 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 15:53:05 -0600 Subject: [PATCH 1/5] Add outbound HTTP proxy example override Shows how to route outbound traffic (telemetry, pings, update checks, license verification, code hosts, auth providers) through an HTTP proxy with HTTP_PROXY / HTTPS_PROXY / NO_PROXY, matching the guidance at https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 1 + .../outbound-http-proxy/override.yaml | 39 +++++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 charts/sourcegraph/examples/outbound-http-proxy/override.yaml diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index e0186812..3817746f 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -8,6 +8,7 @@ Use `**BREAKING**:` to denote a breaking change ## Unreleased +- Added an `outbound-http-proxy` example, which routes outbound traffic from frontend, gitserver, migrator, and worker through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` - Added opt-in Redis config management through `redisCache.config.enabled` and `redisStore.config.enabled` (both default to `false`). Default deployments retain their image configs, custom mounts, authentication, and memory settings. When enabled, the chart mounts `/etc/redis/redis.conf` and supports `existingConfig`, `maxmemory`, `maxmemoryRatio`, `maxmemoryPolicy`, and `additionalConfig`. See [Enabling Redis config management](README.md#enabling-redis-config-management) before opting in, especially when using custom images or Secret-mounted configs. - With Redis config management enabled, the chart sizes `maxmemory` at 75% of `resources.limits.memory` to leave room for overhead; this reduces, but does not eliminate, OOM risk. Ratios must be greater than 0 and less than 1. Auto-sizing is skipped in local development mode or when the limit is absent or unrecognised. At the default 7Gi limit, opting in lowers the effective cap from 6GiB to 5.25GiB: `redis-cache` evicts earlier, but `redis-store` uses `noeviction`, so its write-error ceiling drops too. Set `redisStore.config.maxmemory: 6gb` to keep the old ceiling if the pod has sufficient memory. - Added a `network-policy` example, which limits Executor and Executor job pods to the frontend API diff --git a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml new file mode 100644 index 00000000..dbd54759 --- /dev/null +++ b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml @@ -0,0 +1,39 @@ +# Override file for routing outbound HTTP(S) traffic through an HTTP proxy +# ex. telemetry, pings, update checks, and license verification to services.sourcegraph.com, +# and connections to code hosts, auth providers, and LLM providers outside your private network +# See https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration + +# Reusable block of environment variables, for all services which initiate outbound connections +# This key is not read by the chart, it only holds the YAML anchor +proxyEnvVars: &proxy-env-vars + HTTP_PROXY: + value: http://proxy.example.com:8080 + HTTPS_PROXY: + value: http://proxy.example.com:8080 + # Bypass the proxy for traffic between Sourcegraph's own services + # If pods fail their readiness or health checks after adding the proxy, also add the cluster's pod and service CIDR ranges, ex. 10.10.0.0/16,10.20.0.0/16 + NO_PROXY: + value: blobstore,codeinsights-db,codeintel-db,sourcegraph-frontend-internal,sourcegraph-frontend,gitserver,grafana,indexed-search-indexer,indexed-search,jaeger-query,pgsql,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher,syntect-server,worker-executors,worker,cloud-sql-proxy,localhost,127.0.0.1,.svc,.svc.cluster.local,kubernetes.default.svc + +frontend: + env: + <<: *proxy-env-vars + # To proxy only pings and update checks, instead of all outbound traffic, + # set this var alone, and drop the HTTP_PROXY / HTTPS_PROXY / NO_PROXY vars + # TELEMETRY_HTTP_PROXY: + # value: http://proxy.example.com:8080 + +gitserver: + env: + <<: *proxy-env-vars + +migrator: + env: + <<: *proxy-env-vars + +worker: + env: + <<: *proxy-env-vars + +# Executors are deployed from the separate sourcegraph-executor chart +# Add the same env vars to its executor.extraEnv list From 080f791fa0e08896c1b3ff19c492772511f9fc43 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:07:03 -0600 Subject: [PATCH 2/5] Drop migrator from outbound HTTP proxy example migrator only connects to Postgres, so the proxy env vars have no effect on it. Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 2 +- .../examples/outbound-http-proxy/override.yaml | 11 ----------- 2 files changed, 1 insertion(+), 12 deletions(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index 3817746f..f8fbfd07 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -8,7 +8,7 @@ Use `**BREAKING**:` to denote a breaking change ## Unreleased -- Added an `outbound-http-proxy` example, which routes outbound traffic from frontend, gitserver, migrator, and worker through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` +- Added an `outbound-http-proxy` example, which routes outbound traffic from frontend, gitserver, and worker through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` - Added opt-in Redis config management through `redisCache.config.enabled` and `redisStore.config.enabled` (both default to `false`). Default deployments retain their image configs, custom mounts, authentication, and memory settings. When enabled, the chart mounts `/etc/redis/redis.conf` and supports `existingConfig`, `maxmemory`, `maxmemoryRatio`, `maxmemoryPolicy`, and `additionalConfig`. See [Enabling Redis config management](README.md#enabling-redis-config-management) before opting in, especially when using custom images or Secret-mounted configs. - With Redis config management enabled, the chart sizes `maxmemory` at 75% of `resources.limits.memory` to leave room for overhead; this reduces, but does not eliminate, OOM risk. Ratios must be greater than 0 and less than 1. Auto-sizing is skipped in local development mode or when the limit is absent or unrecognised. At the default 7Gi limit, opting in lowers the effective cap from 6GiB to 5.25GiB: `redis-cache` evicts earlier, but `redis-store` uses `noeviction`, so its write-error ceiling drops too. Set `redisStore.config.maxmemory: 6gb` to keep the old ceiling if the pod has sufficient memory. - Added a `network-policy` example, which limits Executor and Executor job pods to the frontend API diff --git a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml index dbd54759..dd49d8b3 100644 --- a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml +++ b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml @@ -18,22 +18,11 @@ proxyEnvVars: &proxy-env-vars frontend: env: <<: *proxy-env-vars - # To proxy only pings and update checks, instead of all outbound traffic, - # set this var alone, and drop the HTTP_PROXY / HTTPS_PROXY / NO_PROXY vars - # TELEMETRY_HTTP_PROXY: - # value: http://proxy.example.com:8080 gitserver: env: <<: *proxy-env-vars -migrator: - env: - <<: *proxy-env-vars - worker: env: <<: *proxy-env-vars - -# Executors are deployed from the separate sourcegraph-executor chart -# Add the same env vars to its executor.extraEnv list From 03e19e9b4fcafdf99e82b2c4846d9d70388a4db0 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:33:07 -0600 Subject: [PATCH 3/5] Tidy comments in outbound HTTP proxy example --- .../sourcegraph/examples/outbound-http-proxy/override.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml index dd49d8b3..3405f1af 100644 --- a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml +++ b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml @@ -1,16 +1,15 @@ # Override file for routing outbound HTTP(S) traffic through an HTTP proxy -# ex. telemetry, pings, update checks, and license verification to services.sourcegraph.com, +# ex. telemetry, update checks, and license verification to services.sourcegraph.com, # and connections to code hosts, auth providers, and LLM providers outside your private network # See https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration -# Reusable block of environment variables, for all services which initiate outbound connections -# This key is not read by the chart, it only holds the YAML anchor +# Reusable block of environment variables, for services which initiate outbound connections proxyEnvVars: &proxy-env-vars HTTP_PROXY: value: http://proxy.example.com:8080 HTTPS_PROXY: value: http://proxy.example.com:8080 - # Bypass the proxy for traffic between Sourcegraph's own services + # Skip the proxy for local traffic # If pods fail their readiness or health checks after adding the proxy, also add the cluster's pod and service CIDR ranges, ex. 10.10.0.0/16,10.20.0.0/16 NO_PROXY: value: blobstore,codeinsights-db,codeintel-db,sourcegraph-frontend-internal,sourcegraph-frontend,gitserver,grafana,indexed-search-indexer,indexed-search,jaeger-query,pgsql,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher,syntect-server,worker-executors,worker,cloud-sql-proxy,localhost,127.0.0.1,.svc,.svc.cluster.local,kubernetes.default.svc From d5c4680d2f4c166a576245bebf65541b2433b04b Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:40:17 -0600 Subject: [PATCH 4/5] Write NO_PROXY as a folded block, one entry per line YAML folds the lines into a single comma-and-space-separated value, which both Go's httpproxy and libcurl parse, and is easier to read. --- .../outbound-http-proxy/override.yaml | 28 ++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml index 3405f1af..b115e10b 100644 --- a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml +++ b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml @@ -11,8 +11,34 @@ proxyEnvVars: &proxy-env-vars value: http://proxy.example.com:8080 # Skip the proxy for local traffic # If pods fail their readiness or health checks after adding the proxy, also add the cluster's pod and service CIDR ranges, ex. 10.10.0.0/16,10.20.0.0/16 + # Each line needs a trailing comma, as YAML folds these lines into one line, separated by spaces NO_PROXY: - value: blobstore,codeinsights-db,codeintel-db,sourcegraph-frontend-internal,sourcegraph-frontend,gitserver,grafana,indexed-search-indexer,indexed-search,jaeger-query,pgsql,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher,syntect-server,worker-executors,worker,cloud-sql-proxy,localhost,127.0.0.1,.svc,.svc.cluster.local,kubernetes.default.svc + value: >- + blobstore, + cloud-sql-proxy, + codeinsights-db, + codeintel-db, + gitserver, + grafana, + indexed-search, + indexed-search-indexer, + jaeger-query, + pgsql, + precise-code-intel-worker, + prometheus, + redis-cache, + redis-store, + searcher, + sourcegraph-frontend, + sourcegraph-frontend-internal, + syntect-server, + worker, + worker-executors, + localhost, + 127.0.0.1, + .svc, + .svc.cluster.local, + kubernetes.default.svc frontend: env: From 1155c3aa1bc55208b948bfbafd158385941ca766 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 17:08:16 -0600 Subject: [PATCH 5/5] Comment out gitserver, note NO_PROXY additions for internal hosts Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- charts/sourcegraph/CHANGELOG.md | 2 +- .../examples/outbound-http-proxy/override.yaml | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md index f8fbfd07..f7d8f00b 100644 --- a/charts/sourcegraph/CHANGELOG.md +++ b/charts/sourcegraph/CHANGELOG.md @@ -8,7 +8,7 @@ Use `**BREAKING**:` to denote a breaking change ## Unreleased -- Added an `outbound-http-proxy` example, which routes outbound traffic from frontend, gitserver, and worker through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` +- Added an `outbound-http-proxy` example, which routes outbound traffic from frontend and worker through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` - Added opt-in Redis config management through `redisCache.config.enabled` and `redisStore.config.enabled` (both default to `false`). Default deployments retain their image configs, custom mounts, authentication, and memory settings. When enabled, the chart mounts `/etc/redis/redis.conf` and supports `existingConfig`, `maxmemory`, `maxmemoryRatio`, `maxmemoryPolicy`, and `additionalConfig`. See [Enabling Redis config management](README.md#enabling-redis-config-management) before opting in, especially when using custom images or Secret-mounted configs. - With Redis config management enabled, the chart sizes `maxmemory` at 75% of `resources.limits.memory` to leave room for overhead; this reduces, but does not eliminate, OOM risk. Ratios must be greater than 0 and less than 1. Auto-sizing is skipped in local development mode or when the limit is absent or unrecognised. At the default 7Gi limit, opting in lowers the effective cap from 6GiB to 5.25GiB: `redis-cache` evicts earlier, but `redis-store` uses `noeviction`, so its write-error ceiling drops too. Set `redisStore.config.maxmemory: 6gb` to keep the old ceiling if the pod has sufficient memory. - Added a `network-policy` example, which limits Executor and Executor job pods to the frontend API diff --git a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml index b115e10b..612846eb 100644 --- a/charts/sourcegraph/examples/outbound-http-proxy/override.yaml +++ b/charts/sourcegraph/examples/outbound-http-proxy/override.yaml @@ -10,6 +10,7 @@ proxyEnvVars: &proxy-env-vars HTTPS_PROXY: value: http://proxy.example.com:8080 # Skip the proxy for local traffic + # Add your internal code hosts, auth providers, image registries, etc. which are reachable without the proxy # If pods fail their readiness or health checks after adding the proxy, also add the cluster's pod and service CIDR ranges, ex. 10.10.0.0/16,10.20.0.0/16 # Each line needs a trailing comma, as YAML folds these lines into one line, separated by spaces NO_PROXY: @@ -44,9 +45,10 @@ frontend: env: <<: *proxy-env-vars -gitserver: - env: - <<: *proxy-env-vars +# Uncomment if connections to code hosts outside your private network need to use the proxy +# gitserver: +# env: +# <<: *proxy-env-vars worker: env: