From 2568372d4aefdc02a55190517fd14a7d85f8d2e0 Mon Sep 17 00:00:00 2001
From: Marc <7050295+marcleblanc2@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:29:33 -0600
Subject: [PATCH] Fix grafana StatefulSet rendering with extraContainers and a
 service account (#924)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The grafana StatefulSet template renders `serviceAccountName` between
the `containers` list and `grafana.extraContainers`, so setting both a
service account and `extraContainers` produces invalid YAML:

```
Error: YAML parse error on sourcegraph/templates/grafana/grafana.StatefulSet.yaml: error converting YAML to JSON: yaml: line 94: did not find expected key
```

This moves the `extraContainers` block before
`renderServiceAccountName`, matching the ordering every other template
uses (e.g. `gitserver.StatefulSet.yaml`). Grafana is the only template
with this misordering.

This fix is required for customers using the Airgapped Analytics
dashboard, with AWS IAM (IRSA) authentication to their Postgres database
in RDS.

- [x] Follow the [manual testing
process](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/TEST.md)
- [x] Update
[changelog](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/CHANGELOG.md)
- [ ] Update [Kubernetes update
doc](https://docs.sourcegraph.com/admin/updates/kubernetes) — not
needed, no user-facing upgrade steps

With test values setting both keys:

```yaml
grafana:
  serviceAccount:
    create: false
    name: grafana-test-sa
  extraContainers:
    - name: test-sidecar
      image: busybox
```

- Before: `helm template sourcegraph charts/sourcegraph -f
test-values.yaml` fails with the YAML parse error above
- After: renders cleanly; parsed the StatefulSet with PyYAML and
verified `spec.template.spec.serviceAccountName: grafana-test-sa` and
`containers: [grafana, test-sidecar]`
- Verified no other template renders `extraContainers` after
`renderServiceAccountName`

Co-authored-by: Amp <amp@ampcode.com>
(cherry picked from commit e8fed45af40538315e049ecf9080ea8d8e5b2494)
---
 charts/sourcegraph/CHANGELOG.md                               | 1 +
 charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 7a804a8f..8c44867e 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -8,6 +8,7 @@ Use `**BREAKING**:` to denote a breaking change
 
 ## Unreleased
 
+- Fixed the grafana StatefulSet rendering invalid YAML when `grafana.extraContainers` and a service account are both set, by emitting `extraContainers` inside the `containers` list before `serviceAccountName`, matching the other templates
 - Added support for ordering trace processors via `openTelemetry.gateway.config.traces.tracePipelineProcessors`, falling back to processors ordered by name when unset
 - Removed the unused executor controller `/data` PersistentVolumeClaim from the Kubernetes-native executor chart (`sourcegraph-executor/k8s`), along with the now-orphaned `storageClass` and `executor.storageSize` values and the vestigial `EXECUTOR_KUBERNETES_PERSISTENCE_VOLUME_NAME` env var. Since single-job-pod became the only k8s execution mode, job pods use their own ephemeral `emptyDir` volume and the controller writes nothing to `/data`.
 - Removed the non-functional `executor.replicas` value from the Kubernetes-native executor chart; the controller is a singleton (it pins Job pods to its own node), so `replicas > 1` never worked.
diff --git a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
index b97c7db7..2d6812fa 100644
--- a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
@@ -83,10 +83,10 @@ spec:
         {{- end }}
         securityContext:
           {{- toYaml .Values.grafana.containerSecurityContext | nindent 10 }}
-      {{- include "sourcegraph.renderServiceAccountName" (list . "grafana") | trim | nindent 6 }}
       {{- if .Values.grafana.extraContainers }}
         {{- toYaml .Values.grafana.extraContainers | nindent 6 }}
       {{- end }}
+      {{- include "sourcegraph.renderServiceAccountName" (list . "grafana") | trim | nindent 6 }}
       securityContext:
         {{- toYaml .Values.grafana.podSecurityContext | nindent 8 }}
       {{- include "sourcegraph.nodeSelector" (list . "grafana" ) | trim | nindent 6 }}