How to make updates to sourcegraph.com config
Why can’t I edit the page through the site-admin page anymore
Site configuration for sourcegraph.com is split into two files. One contains non-sensitive configurations and the other production secrets such as GitHub OAuth credentials.
Making changes to the website configuration
Non-sensitive configurations
Non-sensitive configurations and env vars are stored in an overlay. Other config files can be found in the overlay folder
To update the non-sensitive configuration, follow these steps:
-
After your PR is approved, merge it with the “release” branch.
-
Wait until the Buildkite build is green, so your changes are successfully deployed.
-
Your changes will be result in the frontend being redeployed with a unique hash for the configuration change. See ConfigMapGeneration
-
Go to https://sourcegraph.com/site-admin/configuration to confirm that the non-sensitive configuration changes are live.
Sensitive configurations
Our site configuration contains many secrets like OAuth credentials. It is stored in GSM in the sourcegraph-dev
project. To update secrets in site config for our Cloud deployment, follow these steps:
- In GSM, copy the contents of the latest version of the secret and make the necessary changes.
- Create a new secret version with the updated site configuration. Disable all previous versions.
- Run
terraform plan
insourcegraph/infrastructure/cloud
. You should see only thefrontend-secrets
resource being changed. - Run
terraform apply
to apply the changes in our Cloud cluster - Run
kubectl rollout restart -n prod deployments/sourcegraph-frontend
andkubectl rollout restart -n prod deployments/sourcegraph-frontend-internal
. Make sure you are connected to the Cloud cluster withkubectl config current-context
.
External services connections
External service connections are handled through the sourcegraph.com UI. The only credentials managed through GSM are for the Cloud default GitHub and GitLab connections. To rotate those tokens follow these steps:
- Generate a new API token from the code host. Make sure it’s properly documented in 1password.
- On the external service configuration, replace
REDACTED
by the new token and save changes. - Ensure that the new token works.
- Revoke the old token from the code host.
Note:
Changes to the notices section can be merged by the author without explicit approval from the DevOps team.