feat: enhance worker deployments with additional packages and CA certificates #1944
+116
−12
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tyr1k
reviewed
Nov 19, 2025
charts/sentry/templates/sentry/worker/deployment-sentry-worker.yaml
Outdated
Show resolved
Hide resolved
tyr1k
reviewed
Nov 19, 2025
charts/sentry/templates/sentry/worker/deployment-sentry-worker.yaml
Outdated
Show resolved
Hide resolved
tyr1k
approved these changes
Nov 19, 2025
Contributor
Author
|
check pod with default values: |
Contributor
Author
|
@honghainguyen777 @jiriks74 @Poil @bhataprameya @Jorgagu @harmjanblok @PaulFarver @niknozhenko |
Contributor
|
Hi, Since you're messing around with worker arguments in this PR, would it be possible to add
for Sentry consumers alongside Tweaking these helps to reduce lag quite a lot. |
Contributor
Author
|
I'm thinking of adding |
Comment on lines
+85
to
+96
| - | | ||
| {{- if .Values.sentry.web.installAdditionalPackages }} | ||
| pip install {{ range .Values.sentry.web.installAdditionalPackages }}{{ . }} {{ end }} | ||
| {{- end }} | ||
| {{- if .Values.sentry.web.caCertificatesSecret }} | ||
| mkdir -p /usr/local/share/ca-certificates/ | ||
| for c in $(ls -1 /usr/local/share/ca-certificates/); do | ||
| cat /usr/local/share/ca-certificates/$c >> $(python3 -m certifi) && echo >> $(python3 -m certifi) | ||
| done | ||
| update-ca-certificates | ||
| {{- end }} | ||
| sentry run web |
There was a problem hiding this comment.
If I understand correctly about /bin/bash -c, it accepts exactly one argument. All the arguments after the first one will be ignored (well not really ignored but these args will be assigned to $0, $1, ...).
# Example
command: ["/bin/bash", "-c"]
args:
- |
sentry run web
- "--workers"
- "4"
$0 = --workers and $1 = 4, but sentry run web (or the whole first string) doesn’t use $0 or $1, so those args don’t get passed to it.
To make it work, you have to have:
command: ["/bin/bash", "-c"]
args:
- |
{{- if .Values.sentry.web.installAdditionalPackages }}
pip install {{ range .Values.sentry.web.installAdditionalPackages }}{{ . }} {{ end }}
{{- end }}
{{- if .Values.sentry.web.caCertificatesSecret }}
mkdir -p /usr/local/share/ca-certificates/
for c in $(ls -1 /usr/local/share/ca-certificates/); do
cat /usr/local/share/ca-certificates/$c >> $(python3 -m certifi) && echo >> $(python3 -m certifi)
done
update-ca-certificates
{{- end }}
sentry run web {{- if .Values.sentry.web.workers }} --workers {{ .Values.sentry.web.workers }}{{- end }}{{- if .Values.sentry.web.logLevel }} --loglevel {{ .Values.sentry.web.logLevel }}{{- end }}{{- if .Values.sentry.web.logFormat }} --logformat {{ .Values.sentry.web.logFormat }}{{- end }}
You may want to add set -euo pipefail so the container fails fast on errors.
Comment on lines
+83
to
+94
| - | | ||
| {{- if .Values.sentry.workerEvents.installAdditionalPackages }} | ||
| pip install {{ range .Values.sentry.workerEvents.installAdditionalPackages }}{{ . }} {{ end }} | ||
| {{- end }} | ||
| {{- if .Values.sentry.workerEvents.caCertificatesSecret }} | ||
| mkdir -p /usr/local/share/ca-certificates/ | ||
| for c in $(ls -1 /usr/local/share/ca-certificates/); do | ||
| cat /usr/local/share/ca-certificates/$c >> $(python3 -m certifi) && echo >> $(python3 -m certifi) | ||
| done | ||
| update-ca-certificates | ||
| {{- end }} | ||
| sentry run worker |
Comment on lines
+83
to
+94
| - | | ||
| {{- if .Values.sentry.workerTransactions.installAdditionalPackages }} | ||
| pip install {{ range .Values.sentry.workerTransactions.installAdditionalPackages }}{{ . }} {{ end }} | ||
| {{- end }} | ||
| {{- if .Values.sentry.workerTransactions.caCertificatesSecret }} | ||
| mkdir -p /usr/local/share/ca-certificates/ | ||
| for c in $(ls -1 /usr/local/share/ca-certificates/); do | ||
| cat /usr/local/share/ca-certificates/$c >> $(python3 -m certifi) && echo >> $(python3 -m certifi) | ||
| done | ||
| update-ca-certificates | ||
| {{- end }} | ||
| sentry run worker |
Comment on lines
+83
to
+94
| - | | ||
| {{- if .Values.sentry.worker.installAdditionalPackages }} | ||
| pip install {{ range .Values.sentry.worker.installAdditionalPackages }}{{ . }} {{ end }} | ||
| {{- end }} | ||
| {{- if .Values.sentry.worker.caCertificatesSecret }} | ||
| mkdir -p /usr/local/share/ca-certificates/ | ||
| for c in $(ls -1 /usr/local/share/ca-certificates/); do | ||
| cat /usr/local/share/ca-certificates/$c >> $(python3 -m certifi) && echo >> $(python3 -m certifi) | ||
| done | ||
| update-ca-certificates | ||
| {{- end }} | ||
| sentry run worker |
|
For the custom CA certificates, can we save the certs in K8S Secret resources and mount them to the containers using |
Contributor
|
I'm thinking whether it wouldn't be better to have the CA under And I find it better to ass the CA everywhere as Eg. Snuba can connect to Redis using SSL and both Snuba and Sentry can connect to Kafka using SSL. I don't think that having the option for Sentry and having to rebuild the Snuba image would be better than having it everywhere and potentially not using it in some deployments. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces several enhancements to the Sentry worker deployments:
Additional Package Installation:
installAdditionalPackagesflag in thevalues.yamlfile.django-multidb-routersentry-nodestore-elasticsentry-s3-nodestore(from a specific release)CA Certificates Management:
/usr/local/share/ca-certificates/.update-ca-certificates.caCertificatesSecretfield in thevalues.yamlfile.Changes
commandandargssections in the worker deployment templates to include a bash script that handles the installation of additional packages and CA certificates.Check pip packages
Check certificates
check certificate by openssl
output: