feat: persistence improvements (#1853)

mzglinski · web-flow · commit 93e598a8e1da · 2025-10-09T07:45:13.000-07:00
diff --git a/charts/sentry/templates/geoip/deployment-geoip-job.yaml b/charts/sentry/templates/geoip/deployment-geoip-job.yaml
@@ -8,7 +8,15 @@ metadata:
     "helm.sh/hook-weight": "9"
 spec:
   template:
+    metadata:
+      {{- if .Values.geodata.annotations }}
+      annotations:
+{{ toYaml .Values.geodata.annotations | indent 8 }}
+      {{- end }}
     spec:
+      {{- if .Values.serviceAccount.enabled }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}-geoip
+      {{- end }}
       initContainers:
         - name: init-create-geoip-dir
           image: busybox
diff --git a/charts/sentry/templates/geoip/pvc-geoip.yaml b/charts/sentry/templates/geoip/pvc-geoip.yaml
@@ -8,15 +8,17 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
-  annotations:
-    "helm.sh/hook": "pre-install,pre-upgrade"
-    "helm.sh/hook-weight": "-1"
 spec:
   accessModes:
-    - ReadWriteMany
+{{- range .Values.geodata.persistence.accessModes }}
+    - {{ . | quote }}
+{{- end }}
   resources:
     requests:
       storage: {{ .Values.geodata.persistence.size }}
+{{- if and (.Values.geodata.persistence.lookupVolumeName) (lookup "v1" "PersistentVolumeClaim" .Release.Namespace "data-sentry-geoip") }}
+  volumeName: {{ (lookup "v1" "PersistentVolumeClaim" .Release.Namespace "data-sentry-geoip").spec.volumeName }}
+{{- end }}        
 {{- if .Values.geodata.persistence.storageClass }}
   storageClassName: {{ .Values.geodata.persistence.storageClass | quote }}
 {{- end }}
diff --git a/charts/sentry/templates/geoip/secret-geoip-env.yaml b/charts/sentry/templates/geoip/secret-geoip-env.yaml
diff --git a/charts/sentry/templates/geoip/serviceaccount-geoip.yaml b/charts/sentry/templates/geoip/serviceaccount-geoip.yaml
@@ -0,0 +1,11 @@
+{{- if and .Values.geodata.accountID .Values.serviceAccount.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}-geoip
+{{- if .Values.serviceAccount.annotations }}
+  annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }}
+{{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end }}
+
diff --git a/charts/sentry/templates/pvc.yaml b/charts/sentry/templates/pvc.yaml
@@ -15,6 +15,9 @@ spec:
   resources:
     requests:
       storage: {{ .Values.filestore.filesystem.persistence.size | quote }}
+{{- if and (.Values.filestore.filesystem.persistence.lookupVolumeName) (lookup "v1" "PersistentVolumeClaim" .Release.Namespace (printf "%s-data" (include "sentry.fullname" .))) }}
+  volumeName: {{ (lookup "v1" "PersistentVolumeClaim" .Release.Namespace (printf "%s-data" (include "sentry.fullname" .))).spec.volumeName }}
+{{- end }}          
 {{- if .Values.filestore.filesystem.persistence.storageClass }}
 {{- if (eq "-" .Values.filestore.filesystem.persistence.storageClass) }}
   storageClassName: ""
diff --git a/charts/sentry/templates/relay/deployment-relay.yaml b/charts/sentry/templates/relay/deployment-relay.yaml
@@ -163,6 +163,7 @@ spec:
           {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
           - name: {{ .Values.geodata.volumeName }}
             mountPath: {{ .Values.geodata.mountPath }}
+            readOnly: true
           {{- end }}
 {{- if .Values.relay.volumeMounts }}
 {{ toYaml .Values.relay.volumeMounts | indent 10 }}
@@ -212,7 +213,7 @@ spec:
       {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
       - name: {{ .Values.geodata.volumeName }}
         persistentVolumeClaim:
-          claimName: {{ .Values.geodata.volumeName }}
+          claimName: data-sentry-geoip
       {{- end }}
 {{- if .Values.relay.volumes }}
 {{ toYaml .Values.relay.volumes | indent 6 }}
diff --git a/charts/sentry/templates/sentry/vroom/pvc-vroom.yaml b/charts/sentry/templates/sentry/vroom/pvc-vroom.yaml
@@ -21,6 +21,9 @@ spec:
   resources:
     requests:
       storage: {{ .Values.vroom.persistence.size | quote }}
+  {{- if and (.Values.vroom.persistence.lookupVolumeName) (lookup "v1" "PersistentVolumeClaim" .Release.Namespace "sentry-vroom-pvc") }}
+  volumeName: {{ (lookup "v1" "PersistentVolumeClaim" .Release.Namespace "sentry-vroom-pvc").spec.volumeName }}
+  {{- end }}            
   {{- if .Values.vroom.persistence.storageClassName }}
   storageClassName: {{ .Values.vroom.persistence.storageClassName | quote }}
   {{- end }}
diff --git a/charts/sentry/templates/sentry/web/deployment-sentry-web.yaml b/charts/sentry/templates/sentry/web/deployment-sentry-web.yaml
@@ -121,6 +121,7 @@ spec:
         {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
         - name: {{ .Values.geodata.volumeName }}
           mountPath: {{ .Values.geodata.mountPath }}
+          readOnly: true
         {{- end }}
         {{- if and (eq .Values.filestore.backend "gcs") .Values.filestore.gcs.secretName }}
         - name: sentry-google-cloud-key
@@ -200,7 +201,7 @@ spec:
       {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
       - name: {{ .Values.geodata.volumeName }}
         persistentVolumeClaim:
-          claimName: {{ .Values.geodata.volumeName }}
+          claimName: data-sentry-geoip
       {{- end }}
 {{- if .Values.sentry.web.volumes }}
 {{ toYaml .Values.sentry.web.volumes | indent 6 }}
diff --git a/charts/sentry/templates/sentry/worker/deployment-sentry-worker-events.yaml b/charts/sentry/templates/sentry/worker/deployment-sentry-worker-events.yaml
@@ -116,6 +116,7 @@ spec:
         {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
         - name: {{ .Values.geodata.volumeName }}
           mountPath: {{ .Values.geodata.mountPath }}
+          readOnly: true
         {{- end }}
         {{- if and (eq .Values.filestore.backend "gcs") .Values.filestore.gcs.secretName }}
         - name: sentry-google-cloud-key
@@ -173,7 +174,7 @@ spec:
       {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
       - name: {{ .Values.geodata.volumeName }}
         persistentVolumeClaim:
-          claimName: {{ .Values.geodata.volumeName }}
+          claimName: data-sentry-geoip
       {{- end }}
       {{- if .Values.sentry.workerEvents.priorityClassName }}
       priorityClassName: "{{ .Values.sentry.workerEvents.priorityClassName }}"
diff --git a/charts/sentry/templates/sentry/worker/deployment-sentry-worker-transactions.yaml b/charts/sentry/templates/sentry/worker/deployment-sentry-worker-transactions.yaml
@@ -116,6 +116,7 @@ spec:
         {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
         - name: {{ .Values.geodata.volumeName }}
           mountPath: {{ .Values.geodata.mountPath }}
+          readOnly: true
         {{- end }}
         {{- if and (eq .Values.filestore.backend "gcs") .Values.filestore.gcs.secretName }}
         - name: sentry-google-cloud-key
@@ -176,7 +177,7 @@ spec:
       {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
       - name: {{ .Values.geodata.volumeName }}
         persistentVolumeClaim:
-          claimName: {{ .Values.geodata.volumeName }}
+          claimName: data-sentry-geoip
       {{- end }}
 {{- if .Values.sentry.workerTransactions.volumes }}
 {{ toYaml .Values.sentry.workerTransactions.volumes | indent 6 }}
diff --git a/charts/sentry/templates/sentry/worker/deployment-sentry-worker.yaml b/charts/sentry/templates/sentry/worker/deployment-sentry-worker.yaml
@@ -123,6 +123,7 @@ spec:
         {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
         - name: {{ .Values.geodata.volumeName }}
           mountPath: {{ .Values.geodata.mountPath }}
+          readOnly: true
         {{- end }}
         {{- if and (eq .Values.filestore.backend "gcs") .Values.filestore.gcs.secretName }}
         - name: sentry-google-cloud-key
@@ -189,7 +190,7 @@ spec:
       {{- if and .Values.geodata.volumeName .Values.geodata.accountID }}
       - name: {{ .Values.geodata.volumeName }}
         persistentVolumeClaim:
-          claimName: {{ .Values.geodata.volumeName }}
+          claimName: data-sentry-geoip
       {{- end }}
 {{- if .Values.global.volumes }}
 {{ toYaml .Values.global.volumes | indent 6 }}
diff --git a/charts/sentry/templates/symbolicator/deployment-symbolicator.yaml b/charts/sentry/templates/symbolicator/deployment-symbolicator.yaml
@@ -173,8 +173,14 @@ spec:
       - name: config
         configMap:
           name: {{ template "sentry.fullname" . }}-symbolicator
+      {{- if .Values.symbolicator.api.persistence.enabled }}
+      - name: symbolicator-data
+        persistentVolumeClaim:
+          claimName: sentry-symbolicator-pvc
+      {{- else }}
       - name: symbolicator-data
         emptyDir: {}
+      {{- end }}
       {{- if and (eq .Values.filestore.backend "gcs") .Values.filestore.gcs.secretName }}
       - name: sentry-google-cloud-key
         secret:
diff --git a/charts/sentry/templates/symbolicator/pvc-symbolicator.yaml b/charts/sentry/templates/symbolicator/pvc-symbolicator.yaml
@@ -0,0 +1,30 @@
+{{- if .Values.symbolicator.enabled }}
+{{- if .Values.symbolicator.api.usedeployment }}
+{{- if .Values.symbolicator.api.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sentry-symbolicator-pvc
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "sentry.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    component: symbolicator
+spec:
+  accessModes:
+{{- range .Values.symbolicator.api.persistence.accessModes }}
+    - {{ . | quote }}
+{{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.symbolicator.api.persistence.size | quote }}
+  {{- if and (.Values.symbolicator.api.persistence.lookupVolumeName) (lookup "v1" "PersistentVolumeClaim" .Release.Namespace "sentry-symbolicator-pvc") }}
+  volumeName: {{ (lookup "v1" "PersistentVolumeClaim" .Release.Namespace "sentry-symbolicator-pvc").spec.volumeName }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+
diff --git a/charts/sentry/values.yaml b/charts/sentry/values.yaml
@@ -104,6 +104,9 @@ vroom:
   # podLabels: {}
   persistence:
     enabled: true  # Set true for using PersistentVolumeClaim, false for emptyDir
+    ## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve
+    ## the current value of 'spec.volumeName' and incorporate it into the template.
+    lookupVolumeName: true
     accessModes:
       - ReadWriteOnce
     # storageClassName: standard
@@ -221,13 +224,18 @@ geodata:
   accountID: ""
   licenseKey: ""
   editionIDs: ""
+  annotations: {}
   persistence:
     ## If defined, storageClassName: <storageClass>
     ## If undefined (the default) or set to null, no storageClassName spec is
     ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
     ##   GKE, AWS & OpenStack)
     # storageClass: "" # for example: csi-s3
     size: 1Gi
+    accessModes: ["ReadWriteMany"]
+    ## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve
+    ## the current value of 'spec.volumeName' and incorporate it into the template.
+    lookupVolumeName: true
   volumeName: ""  # for example: data-sentry-geoip
   # mountPath of the volume containing the database
   mountPath: ""  # for example: /usr/share/GeoIP
@@ -2194,6 +2202,9 @@ symbolicator:
       accessModes: ["ReadWriteOnce"]
       # storageClassName: standard
       size: "10Gi"
+      ## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve
+      ## the current value of 'spec.volumeName' and incorporate it into the template.
+      lookupVolumeName: true
     replicas: 1
     env: []
     probeInitialDelaySeconds: 10
@@ -2412,6 +2423,10 @@ filestore:
       ## be used
       existingClaim: ""
 
+      ## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve
+      ## the current value of 'spec.volumeName' and incorporate it into the template.
+      lookupVolumeName: true
+
   gcs: {}
     ## Point this at a pre-configured secret containing a service account. The resulting
     ## secret will be mounted at /var/run/secrets/google
