release/appliance: resource def grafana (#63535)

appliance reconciler resource definition for grafana

## Test plan

Golden Tests

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->

---------

Co-authored-by: Anish Lakhwara <anish+git@lakhwara.com>
Co-authored-by: Anish Lakhwara <anish+github@lakhwara.com>

internal/appliance/config/BUILD.bazel

@@ -16,6 +16,7 @@ go_library(
         "postgres/pgsql.conf",
         "prometheus/default.yml.gotmpl",
         "postgres/codeinsights.conf",
+        "grafana/default.yml.gotmpl",
     ],
     importpath = "github.com/sourcegraph/sourcegraph/internal/appliance/config",
     tags = [TAG_INFRA_RELEASE],

internal/appliance/config/defaults.go

@@ -169,11 +169,15 @@ func NewDefaultConfig() Sourcegraph {
 				Replicas: 1,
 			},
 
-			// Grafana and Jaeger are opt-in
+			// Grafana and Jaeger are opt-in, on by default
 			Grafana: GrafanaSpec{
 				StandardConfig: StandardConfig{
-					Disabled: true,
+					Disabled: false,
+					PersistentVolumeConfig: PersistentVolumeConfig{
+						StorageSize: "2Gi",
+					},
 				},
+				Replicas: 1,
 			},
 			Jaeger: JaegerSpec{
 				StandardConfig: StandardConfig{

internal/appliance/config/dev_mode.go

@@ -16,6 +16,7 @@ func (sg *Sourcegraph) SetLocalDevMode() {
 	sg.Spec.Frontend.ContainerConfig = setBestEffortQOSOnContainer(sg.Spec.Frontend.ContainerConfig, "migrator")
 
 	sg.Spec.GitServer.ContainerConfig = setBestEffortQOSOnContainer(sg.Spec.GitServer.ContainerConfig, "gitserver")
+	sg.Spec.Grafana.ContainerConfig = setBestEffortQOSOnContainer(sg.Spec.Grafana.ContainerConfig, "grafana")
 
 	sg.Spec.IndexedSearch.ContainerConfig = setBestEffortQOSOnContainer(sg.Spec.IndexedSearch.ContainerConfig, "zoekt-webserver")
 	sg.Spec.IndexedSearch.ContainerConfig = setBestEffortQOSOnContainer(sg.Spec.IndexedSearch.ContainerConfig, "zoekt-indexserver")

internal/appliance/config/embed.go

@@ -7,17 +7,28 @@ import (
 var (
 	//go:embed postgres/*
 	//go:embed prometheus/default.yml.gotmpl
+	//go:embed grafana/default.yml.gotmpl
 	fs embed.FS
 
 	PgsqlConfig                     []byte
 	PrometheusDefaultConfigTemplate []byte
+	GrafanaDefaultConfigTemplate    []byte
 	CodeIntelConfig                 []byte
 	CodeInsightsConfig              []byte
 )
 
 func init() {
-	CodeIntelConfig, _ = fs.ReadFile("postgres/codeintel.conf")
-	CodeInsightsConfig, _ = fs.ReadFile("postgres/codeinsights.conf")
-	PgsqlConfig, _ = fs.ReadFile("postgres/pgsql.conf")
-	PrometheusDefaultConfigTemplate, _ = fs.ReadFile("prometheus/default.yml.gotmpl")
+	CodeIntelConfig = mustReadFile("postgres/codeintel.conf")
+	CodeInsightsConfig = mustReadFile("postgres/codeinsights.conf")
+	PgsqlConfig = mustReadFile("postgres/pgsql.conf")
+	PrometheusDefaultConfigTemplate = mustReadFile("prometheus/default.yml.gotmpl")
+	GrafanaDefaultConfigTemplate = mustReadFile("grafana/default.yml.gotmpl")
+}
+
+func mustReadFile(name string) []byte {
+	b, err := fs.ReadFile(name)
+	if err != nil {
+		panic(err)
+	}
+	return b
 }

internal/appliance/config/grafana/default.yml.gotmpl

@@ -0,0 +1,13 @@
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    access: proxy
+    url: http://prometheus:30090
+    isDefault: true
+    editable: false
+  - name: Jaeger
+    type: Jaeger
+    access: proxy
+    url: http://jaeger-query:16686/-/debug/jaeger

internal/appliance/config/spec.go

@@ -74,6 +74,12 @@ type GitServerSpec struct {
 
 type GrafanaSpec struct {
 	StandardConfig
+
+	// Replicas defines the number of Grafana pod replicas.
+	// Default: 1
+	Replicas int32 `json:"replicas,omitempty"`
+
+	ExistingConfigMap string `json:"existingConfigMap,omitempty"`
 }
 
 type IndexedSearchSpec struct {

internal/appliance/reconciler/BUILD.bazel

@@ -10,6 +10,7 @@ go_library(
         "codeintel.go",
         "frontend.go",
         "gitserver.go",
+        "grafana.go",
         "indexed_search.go",
         "jaeger.go",
         "kubernetes.go",
@@ -78,6 +79,7 @@ go_test(
         "frontend_test.go",
         "gitserver_test.go",
         "golden_test.go",
+        "grafana_test.go",
         "helpers_test.go",
         "indexed_search_test.go",
         "jaeger_test.go",

internal/appliance/reconciler/grafana.go

@@ -0,0 +1,152 @@
+package reconciler
+
+import (
+	"bytes"
+	"context"
+	"text/template"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/sourcegraph/sourcegraph/internal/appliance/config"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/configmap"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/container"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/pod"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/pvc"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/service"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/serviceaccount"
+	"github.com/sourcegraph/sourcegraph/internal/k8s/resource/statefulset"
+	"github.com/sourcegraph/sourcegraph/lib/errors"
+	"github.com/sourcegraph/sourcegraph/lib/pointers"
+)
+
+func (r *Reconciler) reconcileGrafana(ctx context.Context, sg *config.Sourcegraph, owner client.Object) error {
+	if err := r.reconcileGrafanaStatefulSet(ctx, sg, owner); err != nil {
+		return errors.Wrap(err, "reconciling StatefulSet")
+	}
+	if err := r.reconcileGrafanaService(ctx, sg, owner); err != nil {
+		return errors.Wrap(err, "reconciling Service")
+	}
+	if err := r.reconcileGrafanaServiceAccount(ctx, sg, owner); err != nil {
+		return errors.Wrap(err, "reconciling ServiceAccount")
+	}
+	if err := r.reconcileGrafanaConfigMap(ctx, sg, owner); err != nil {
+		return errors.Wrap(err, "reconciling ConfigMap")
+	}
+	return nil
+}
+
+func (r *Reconciler) reconcileGrafanaStatefulSet(ctx context.Context, sg *config.Sourcegraph, owner client.Object) error {
+	name := "grafana"
+	cfg := sg.Spec.Grafana
+
+	defaultImage := config.GetDefaultImage(sg, name)
+	ctr := container.NewContainer(name, cfg, config.ContainerConfig{
+		Image: defaultImage,
+		Resources: &corev1.ResourceRequirements{
+			Requests: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("100m"),
+				corev1.ResourceMemory: resource.MustParse("512Mi"),
+			},
+			Limits: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("1"),
+				corev1.ResourceMemory: resource.MustParse("512Mi"),
+			},
+		},
+	})
+	ctr.TerminationMessagePolicy = corev1.TerminationMessageFallbackToLogsOnError
+
+	ctr.Ports = []corev1.ContainerPort{
+		{Name: "http", ContainerPort: 3370},
+	}
+
+	ctr.VolumeMounts = []corev1.VolumeMount{
+		{Name: "grafana-data", MountPath: "/var/lib/grafana"},
+		{Name: "config", MountPath: "/sg_config_grafana/provisioning/datasources"},
+	}
+
+	ctr.SecurityContext = &corev1.SecurityContext{
+		AllowPrivilegeEscalation: pointers.Ptr(false),
+		RunAsUser:                pointers.Ptr(int64(472)),
+		RunAsGroup:               pointers.Ptr(int64(472)),
+		ReadOnlyRootFilesystem:   pointers.Ptr(true),
+	}
+
+	podTemplate := pod.NewPodTemplate(name, cfg)
+	podTemplate.Template.Spec.Containers = []corev1.Container{ctr}
+	podTemplate.Template.Spec.ServiceAccountName = name
+	podTemplate.Template.Spec.SecurityContext = &corev1.PodSecurityContext{
+		RunAsUser:           pointers.Ptr(int64(472)),
+		RunAsGroup:          pointers.Ptr(int64(472)),
+		FSGroup:             pointers.Ptr(int64(472)),
+		FSGroupChangePolicy: pointers.Ptr(corev1.FSGroupChangeOnRootMismatch),
+	}
+
+	cfgMapName := name
+	if cfg.ExistingConfigMap != "" {
+		cfgMapName = cfg.ExistingConfigMap
+	}
+	podTemplate.Template.Spec.Volumes = []corev1.Volume{
+		pod.NewVolumeFromConfigMap("config", cfgMapName),
+	}
+
+	pvc, err := pvc.NewPersistentVolumeClaim("grafana-data", sg.Namespace, sg.Spec.Grafana)
+	if err != nil {
+		return err
+	}
+
+	sset := statefulset.NewStatefulSet(name, sg.Namespace, sg.Spec.RequestedVersion)
+	sset.Spec.Template = podTemplate.Template
+	sset.Spec.Replicas = &cfg.Replicas
+	sset.Spec.VolumeClaimTemplates = []corev1.PersistentVolumeClaim{pvc}
+
+	return reconcileObject(ctx, r, cfg, &sset, &appsv1.StatefulSet{}, sg, owner)
+}
+
+func (r *Reconciler) reconcileGrafanaService(ctx context.Context, sg *config.Sourcegraph, owner client.Object) error {
+	name := "grafana"
+	cfg := sg.Spec.Grafana
+	svc := service.NewService(name, sg.Namespace, cfg)
+	svc.Spec.Ports = []corev1.ServicePort{
+		{Name: "http", TargetPort: intstr.FromString("http"), Port: 3181},
+		{Name: "debug", TargetPort: intstr.FromString("debug"), Port: 6060},
+	}
+	svc.Spec.Selector = map[string]string{
+		"app": name,
+	}
+	return reconcileObject(ctx, r, cfg, &svc, &corev1.Service{}, sg, owner)
+}
+
+func (r *Reconciler) reconcileGrafanaServiceAccount(ctx context.Context, sg *config.Sourcegraph, owner client.Object) error {
+	cfg := sg.Spec.Grafana
+	sa := serviceaccount.NewServiceAccount("grafana", sg.Namespace, cfg)
+	return reconcileObject(ctx, r, cfg, &sa, &corev1.ServiceAccount{}, sg, owner)
+}
+
+func (r *Reconciler) reconcileGrafanaConfigMap(ctx context.Context, sg *config.Sourcegraph, owner client.Object) error {
+	cfg := sg.Spec.Grafana
+	if cfg.ExistingConfigMap != "" {
+		return nil
+	}
+
+	tmpl, err := template.New("grafana-config").Parse(string(config.GrafanaDefaultConfigTemplate))
+	if err != nil {
+		return errors.Wrap(err, "parsing default grafana config template")
+	}
+	var defaultConfig bytes.Buffer
+	if err := tmpl.Execute(&defaultConfig, sg); err != nil {
+		return errors.Wrap(err, "rendering default grafana config template")
+	}
+
+	name := "grafana"
+	cm := configmap.NewConfigMap(name, sg.Namespace)
+	cm.Data = map[string]string{
+		"datasources.yml": defaultConfig.String(),
+		"extra_rules.yml": "",
+	}
+
+	return reconcileObject(ctx, r, cfg, &cm, &corev1.ConfigMap{}, sg, owner)
+}

internal/appliance/reconciler/grafana_test.go

@@ -0,0 +1,16 @@
+package reconciler
+
+func (suite *ApplianceTestSuite) TestDeployGrafana() {
+	for _, tc := range []struct {
+		name string
+	}{
+		{name: "grafana/default"},
+		{name: "grafana/with-replicas"},
+		{name: "grafana/with-existing-configmap"},
+	} {
+		suite.Run(tc.name, func() {
+			namespace := suite.createConfigMapAndAwaitReconciliation(tc.name)
+			suite.makeGoldenAssertions(namespace, tc.name)
+		})
+	}
+}

internal/appliance/reconciler/reconcile.go

@@ -2,17 +2,17 @@ package reconciler
 
 import (
 	"context"
-
 	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/yaml"
 
@@ -120,6 +120,9 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	if err := r.reconcileIndexedSearcher(ctx, &sourcegraph, &applianceSpec); err != nil {
 		return ctrl.Result{}, errors.Newf("failed to reconcile indexed-searcher: %w", err)
 	}
+	if err := r.reconcileGrafana(ctx, &sourcegraph, &applianceSpec); err != nil {
+		return ctrl.Result{}, errors.Newf("failed to reconcile grafana: %w", err)
+	}
 	if err := r.reconcileJaeger(ctx, &sourcegraph, &applianceSpec); err != nil {
 		return ctrl.Result{}, errors.Newf("failed to reconcile jaeger: %w", err)
 	}

internal/appliance/reconciler/testdata/golden-fixtures/blobstore/default.yaml

@@ -88,6 +88,153 @@ resources:
               persistentVolumeClaim:
                 claimName: blobstore
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -186,6 +333,25 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: Service
     metadata:
@@ -226,3 +392,47 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/cadvisor/default.yaml

@@ -124,6 +124,153 @@ resources:
       desiredNumberScheduled: 0
       numberMisscheduled: 0
       numberReady: 0
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -215,3 +362,66 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/codeinsights/default.yaml

@@ -198,6 +198,117 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: v1
     data:
       postgresql.conf: |
@@ -277,6 +388,42 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -426,6 +573,25 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: Service
     metadata:
@@ -468,3 +634,47 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/codeintel/default.yaml

@@ -219,6 +219,117 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: v1
     data:
       postgresql.conf: |
@@ -297,6 +408,42 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -446,6 +593,25 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: Service
     metadata:
@@ -488,3 +654,47 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/frontend/default.yaml

@@ -51,6 +51,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -201,6 +203,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -307,6 +311,153 @@ resources:
             - emptyDir: {}
               name: home-dir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -439,6 +590,25 @@ resources:
       - kind: ServiceAccount
         name: sourcegraph-frontend
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -458,6 +628,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/frontend/with-blobstore.yaml

@@ -140,6 +140,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -290,6 +292,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -396,6 +400,153 @@ resources:
             - emptyDir: {}
               name: home-dir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -557,6 +708,25 @@ resources:
       - kind: ServiceAccount
         name: sourcegraph-frontend
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -616,6 +786,50 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/frontend/with-ingress-optional-fields.yaml

@@ -51,6 +51,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -201,6 +203,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -307,6 +311,153 @@ resources:
             - emptyDir: {}
               name: home-dir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -445,6 +596,25 @@ resources:
       - kind: ServiceAccount
         name: sourcegraph-frontend
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -464,6 +634,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/frontend/with-ingress.yaml

@@ -51,6 +51,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -201,6 +203,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -307,6 +311,153 @@ resources:
             - emptyDir: {}
               name: home-dir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -440,6 +591,25 @@ resources:
       - kind: ServiceAccount
         name: sourcegraph-frontend
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -459,6 +629,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/frontend/with-overrides.yaml

@@ -51,6 +51,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -209,6 +211,153 @@ resources:
             - emptyDir: {}
               name: home-dir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -343,6 +492,25 @@ resources:
       - kind: ServiceAccount
         name: sourcegraph-frontend
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -362,6 +530,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/gitserver/default.yaml

@@ -137,6 +137,153 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -224,6 +371,25 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: Service
     metadata:
@@ -267,3 +433,47 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/grafana/default.yaml

@@ -0,0 +1,283 @@
+resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    data:
+      spec: |
+        spec:
+          requestedVersion: "5.3.9104"
+
+          blobstore:
+            disabled: true
+
+          codeInsights:
+            disabled: true
+
+          codeIntel:
+            disabled: true
+
+          frontend:
+            disabled: true
+
+          gitServer:
+            disabled: true
+
+          indexedSearch:
+            disabled: true
+
+          openTelemetry:
+            disabled: true
+
+          pgsql:
+            disabled: true
+
+          postgresExporter:
+            disabled: true
+
+          preciseCodeIntel:
+            disabled: true
+
+          redisCache:
+            disabled: true
+
+          redisStore:
+            disabled: true
+
+          repoUpdater:
+            disabled: true
+
+          searcher:
+            disabled: true
+
+          symbols:
+            disabled: true
+
+          syntectServer:
+            disabled: true
+
+          worker:
+            disabled: true
+
+          prometheus:
+            disabled: true
+
+          grafana:
+            disabled: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/currentVersion: 5.3.9104
+        appliance.sourcegraph.com/managed: "true"
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      name: sg
+      namespace: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/grafana/with-existing-configmap.yaml

@@ -0,0 +1,248 @@
+resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: 9b479a7d48de2e94c06ceb44a8f87c7a553ddc458a31323b8bce0d4daad0374c
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: some-out-of-band-config
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      spec: |
+        spec:
+          requestedVersion: "5.3.9104"
+
+          blobstore:
+            disabled: true
+
+          codeInsights:
+            disabled: true
+
+          codeIntel:
+            disabled: true
+
+          frontend:
+            disabled: true
+
+          gitServer:
+            disabled: true
+
+          indexedSearch:
+            disabled: true
+
+          openTelemetry:
+            disabled: true
+
+          pgsql:
+            disabled: true
+
+          postgresExporter:
+            disabled: true
+
+          preciseCodeIntel:
+            disabled: true
+
+          redisCache:
+            disabled: true
+
+          redisStore:
+            disabled: true
+
+          repoUpdater:
+            disabled: true
+
+          searcher:
+            disabled: true
+
+          symbols:
+            disabled: true
+
+          syntectServer:
+            disabled: true
+
+          worker:
+            disabled: true
+
+          prometheus:
+            disabled: true
+
+          grafana:
+            disabled: false
+            existingConfigMap: some-out-of-band-config
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/currentVersion: 5.3.9104
+        appliance.sourcegraph.com/managed: "true"
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      name: sg
+      namespace: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: 9b479a7d48de2e94c06ceb44a8f87c7a553ddc458a31323b8bce0d4daad0374c
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: 9b479a7d48de2e94c06ceb44a8f87c7a553ddc458a31323b8bce0d4daad0374c
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/grafana/with-replicas.yaml

@@ -0,0 +1,284 @@
+resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: a43b90b224c56e45e727c98034a0354d461393e2ff9fa50de02120e56b666e8d
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 5
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: a43b90b224c56e45e727c98034a0354d461393e2ff9fa50de02120e56b666e8d
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    data:
+      spec: |
+        spec:
+          requestedVersion: "5.3.9104"
+
+          blobstore:
+            disabled: true
+
+          codeInsights:
+            disabled: true
+
+          codeIntel:
+            disabled: true
+
+          frontend:
+            disabled: true
+
+          gitServer:
+            disabled: true
+
+          indexedSearch:
+            disabled: true
+
+          openTelemetry:
+            disabled: true
+
+          pgsql:
+            disabled: true
+
+          postgresExporter:
+            disabled: true
+
+          preciseCodeIntel:
+            disabled: true
+
+          redisCache:
+            disabled: true
+
+          redisStore:
+            disabled: true
+
+          repoUpdater:
+            disabled: true
+
+          searcher:
+            disabled: true
+
+          symbols:
+            disabled: true
+
+          syntectServer:
+            disabled: true
+
+          worker:
+            disabled: true
+
+          prometheus:
+            disabled: true
+
+          grafana:
+            disabled: false
+            replicas: 5
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/currentVersion: 5.3.9104
+        appliance.sourcegraph.com/managed: "true"
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      name: sg
+      namespace: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: a43b90b224c56e45e727c98034a0354d461393e2ff9fa50de02120e56b666e8d
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: a43b90b224c56e45e727c98034a0354d461393e2ff9fa50de02120e56b666e8d
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/indexed-search/default.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -160,6 +271,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -231,6 +378,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -250,6 +416,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/indexed-search/with-replicas.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -160,6 +271,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -232,6 +379,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -251,6 +417,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/jaeger/default.yaml

@@ -98,6 +98,153 @@ resources:
           serviceAccountName: jaeger
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -170,6 +317,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -189,6 +355,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/jaeger/with-replicas.yaml

@@ -98,6 +98,153 @@ resources:
           serviceAccountName: jaeger
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -171,6 +318,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -190,6 +356,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/pgsql/default.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -225,6 +336,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       postgresql.conf: |
@@ -433,6 +580,25 @@ resources:
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
     type: Opaque
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -452,6 +618,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/precise-code-intel/default.yaml

@@ -120,6 +120,153 @@ resources:
             - emptyDir: {}
               name: tmpdir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -188,6 +335,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -207,6 +373,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/precise-code-intel/with-blobstore.yaml

@@ -213,6 +213,153 @@ resources:
             - emptyDir: {}
               name: tmpdir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -310,6 +457,25 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -369,6 +535,50 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/precise-code-intel/with-num-workers.yaml

@@ -120,6 +120,153 @@ resources:
             - emptyDir: {}
               name: tmpdir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -189,6 +336,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -208,6 +374,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/precise-code-intel/with-replicas.yaml

@@ -120,6 +120,153 @@ resources:
             - emptyDir: {}
               name: tmpdir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -189,6 +336,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -208,6 +374,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/prometheus/default.yaml

@@ -98,6 +98,153 @@ resources:
                 name: prometheus
               name: config
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       extra_rules.yml: ""
@@ -503,6 +650,25 @@ resources:
       - kind: ServiceAccount
         name: prometheus
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -522,6 +688,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/prometheus/privileged.yaml

@@ -98,6 +98,117 @@ resources:
                 name: prometheus
               name: config
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
@@ -157,6 +268,42 @@ resources:
       - kind: ServiceAccount
         name: prometheus
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       extra_rules.yml: ""
@@ -569,6 +716,25 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -588,6 +754,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/prometheus/subsequent-disable.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
@@ -58,6 +169,42 @@ resources:
       - kind: ServiceAccount
         name: prometheus
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -159,3 +306,66 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/prometheus/with-existing-configmap.yaml

@@ -98,6 +98,153 @@ resources:
                 name: some-out-of-band-config
               name: config
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -260,6 +407,25 @@ resources:
       - kind: ServiceAccount
         name: prometheus
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -279,6 +445,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/redis/default.yaml

@@ -265,6 +265,153 @@ resources:
               persistentVolumeClaim:
                 claimName: redis-store
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -442,6 +589,69 @@ resources:
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
     type: Opaque
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/repo-updater/default.yaml

@@ -118,6 +118,153 @@ resources:
           serviceAccountName: repo-updater
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -186,6 +333,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -205,6 +371,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/searcher/default.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -149,6 +260,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -217,6 +364,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -236,6 +402,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/searcher/with-replicas.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -149,6 +260,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -218,6 +365,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -237,6 +403,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/searcher/with-storage.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -149,6 +260,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -219,6 +366,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -238,6 +404,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/blobstore-subsequent-disable.yaml

@@ -1,4 +1,151 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -100,3 +247,66 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/standard/blobstore-with-named-storage-class.yaml

@@ -88,6 +88,153 @@ resources:
               persistentVolumeClaim:
                 claimName: blobstore
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -189,6 +336,25 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: Service
     metadata:
@@ -229,3 +395,47 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}

internal/appliance/reconciler/testdata/golden-fixtures/standard/frontend-with-no-cpu-memory-resources.yaml

@@ -51,6 +51,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -197,6 +199,8 @@ resources:
               env:
                 - name: DEPLOY_TYPE
                   value: appliance
+                - name: GRAFANA_SERVER_URL
+                  value: http://grafana:30070
                 - name: PGDATABASE
                   valueFrom:
                     secretKeyRef:
@@ -297,6 +301,153 @@ resources:
             - emptyDir: {}
               name: home-dir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -434,6 +585,25 @@ resources:
       - kind: ServiceAccount
         name: sourcegraph-frontend
         namespace: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -453,6 +623,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/precise-code-intel-with-env-vars.yaml

@@ -124,6 +124,153 @@ resources:
             - emptyDir: {}
               name: tmpdir
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -197,6 +344,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -216,6 +382,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/redis-with-multiple-custom-images.yaml

@@ -132,6 +132,153 @@ resources:
               persistentVolumeClaim:
                 claimName: redis-cache
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -260,6 +407,69 @@ resources:
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
     type: Opaque
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/redis-with-storage.yaml

@@ -265,6 +265,153 @@ resources:
               persistentVolumeClaim:
                 claimName: redis-store
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -446,6 +593,69 @@ resources:
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
     type: Opaque
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/repo-updater-with-no-resources.yaml

@@ -112,6 +112,153 @@ resources:
           serviceAccountName: repo-updater
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -183,6 +330,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -202,6 +368,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/repo-updater-with-pod-template-config.yaml

@@ -136,6 +136,153 @@ resources:
               operator: Equal
               value: value1
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -223,6 +370,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -242,6 +408,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/repo-updater-with-resources.yaml

@@ -118,6 +118,153 @@ resources:
           serviceAccountName: repo-updater
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -195,6 +342,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -214,6 +380,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/repo-updater-with-sa-annotations.yaml

@@ -118,6 +118,153 @@ resources:
           serviceAccountName: repo-updater
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -188,6 +335,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -208,6 +374,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/standard/symbols-with-custom-image.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: my-custom-image-repository.info/sourcegraph-images/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -162,6 +273,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -234,6 +381,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -253,6 +419,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/symbols/default.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -162,6 +273,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -230,6 +377,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -249,6 +415,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/symbols/with-storage.yaml

@@ -1,4 +1,115 @@
 resources:
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
   - apiVersion: apps/v1
     kind: StatefulSet
     metadata:
@@ -162,6 +273,42 @@ resources:
     status:
       availableReplicas: 0
       replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -232,6 +379,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -251,6 +417,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/syntect/default.yaml

@@ -96,6 +96,153 @@ resources:
           serviceAccountName: syntect-server
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -164,6 +311,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -183,6 +349,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/syntect/with-replicas.yaml

@@ -96,6 +96,153 @@ resources:
           serviceAccountName: syntect-server
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -165,6 +312,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -184,6 +350,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/worker/default.yaml

@@ -125,6 +125,153 @@ resources:
             runAsUser: 100
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -193,6 +340,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -212,6 +378,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/worker/with-blobstore.yaml

@@ -218,6 +218,153 @@ resources:
             runAsUser: 100
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -315,6 +462,25 @@ resources:
       volumeMode: Filesystem
     status:
       phase: Pending
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -374,6 +540,50 @@ resources:
       type: ClusterIP
     status:
       loadBalancer: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/golden-fixtures/worker/with-replicas.yaml

@@ -125,6 +125,153 @@ resources:
             runAsUser: 100
           terminationGracePeriodSeconds: 30
     status: {}
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      generation: 1
+      labels:
+        app.kubernetes.io/component: grafana
+        app.kubernetes.io/name: sourcegraph
+        app.kubernetes.io/version: 5.3.9104
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      minReadySeconds: 10
+      persistentVolumeClaimRetentionPolicy:
+        whenDeleted: Retain
+        whenScaled: Retain
+      podManagementPolicy: OrderedReady
+      replicas: 1
+      revisionHistoryLimit: 10
+      selector:
+        matchLabels:
+          app: grafana
+      serviceName: grafana
+      template:
+        metadata:
+          annotations:
+            kubectl.kubernetes.io/default-container: grafana
+          creationTimestamp: null
+          labels:
+            app: grafana
+            deploy: sourcegraph
+          name: grafana
+        spec:
+          containers:
+            - image: index.docker.io/sourcegraph/grafana:5.3.9104
+              imagePullPolicy: IfNotPresent
+              name: grafana
+              ports:
+                - containerPort: 3370
+                  name: http
+                  protocol: TCP
+              resources:
+                limits:
+                  cpu: "1"
+                  memory: 512Mi
+                requests:
+                  cpu: 100m
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsGroup: 472
+                runAsUser: 472
+              terminationMessagePath: /dev/termination-log
+              terminationMessagePolicy: FallbackToLogsOnError
+              volumeMounts:
+                - mountPath: /var/lib/grafana
+                  name: grafana-data
+                - mountPath: /sg_config_grafana/provisioning/datasources
+                  name: config
+          dnsPolicy: ClusterFirst
+          restartPolicy: Always
+          schedulerName: default-scheduler
+          securityContext:
+            fsGroup: 472
+            fsGroupChangePolicy: OnRootMismatch
+            runAsGroup: 472
+            runAsUser: 472
+          serviceAccount: grafana
+          serviceAccountName: grafana
+          terminationGracePeriodSeconds: 30
+          volumes:
+            - configMap:
+                defaultMode: 511
+                name: grafana
+              name: config
+      updateStrategy:
+        type: RollingUpdate
+      volumeClaimTemplates:
+        - apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            creationTimestamp: null
+            labels:
+              deploy: sourcegraph
+            name: grafana-data
+            namespace: NORMALIZED_FOR_TESTING
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 2Gi
+            volumeMode: Filesystem
+          status:
+            phase: Pending
+    status:
+      availableReplicas: 0
+      replicas: 0
+  - apiVersion: v1
+    data:
+      datasources.yml: |
+        apiVersion: 1
+
+        datasources:
+          - name: Prometheus
+            type: prometheus
+            access: proxy
+            url: http://prometheus:30090
+            isDefault: true
+            editable: false
+          - name: Jaeger
+            type: Jaeger
+            access: proxy
+            url: http://jaeger-query:16686/-/debug/jaeger
+      extra_rules.yml: ""
+    immutable: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     data:
       spec: |
@@ -194,6 +341,25 @@ resources:
       namespace: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
   - apiVersion: v1
     kind: ServiceAccount
     metadata:
@@ -213,6 +379,50 @@ resources:
           uid: NORMALIZED_FOR_TESTING
       resourceVersion: NORMALIZED_FOR_TESTING
       uid: NORMALIZED_FOR_TESTING
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        appliance.sourcegraph.com/configHash: c7ada10d28d26c809f8b7e71aabb5a65420c3c2f306a364d3b9b966189d84a05
+      creationTimestamp: "2024-04-19T00:00:00Z"
+      labels:
+        app: grafana
+        app.kubernetes.io/component: grafana
+        deploy: sourcegraph
+      name: grafana
+      namespace: NORMALIZED_FOR_TESTING
+      ownerReferences:
+        - apiVersion: v1
+          blockOwnerDeletion: true
+          controller: true
+          kind: ConfigMap
+          name: sg
+          uid: NORMALIZED_FOR_TESTING
+      resourceVersion: NORMALIZED_FOR_TESTING
+      uid: NORMALIZED_FOR_TESTING
+    spec:
+      clusterIP: NORMALIZED_FOR_TESTING
+      clusterIPs:
+        - NORMALIZED_FOR_TESTING
+      internalTrafficPolicy: Cluster
+      ipFamilies:
+        - IPv4
+      ipFamilyPolicy: SingleStack
+      ports:
+        - name: http
+          port: 3181
+          protocol: TCP
+          targetPort: http
+        - name: debug
+          port: 6060
+          protocol: TCP
+          targetPort: debug
+      selector:
+        app: grafana
+      sessionAffinity: None
+      type: ClusterIP
+    status:
+      loadBalancer: {}
   - apiVersion: v1
     kind: Service
     metadata:

internal/appliance/reconciler/testdata/sg/grafana/default.yaml

@@ -0,0 +1,59 @@
+spec:
+  requestedVersion: "5.3.9104"
+
+  blobstore:
+    disabled: true
+
+  codeInsights:
+    disabled: true
+
+  codeIntel:
+    disabled: true
+
+  frontend:
+    disabled: true
+
+  gitServer:
+    disabled: true
+
+  indexedSearch:
+    disabled: true
+
+  openTelemetry:
+    disabled: true
+
+  pgsql:
+    disabled: true
+
+  postgresExporter:
+    disabled: true
+
+  preciseCodeIntel:
+    disabled: true
+
+  redisCache:
+    disabled: true
+
+  redisStore:
+    disabled: true
+
+  repoUpdater:
+    disabled: true
+
+  searcher:
+    disabled: true
+
+  symbols:
+    disabled: true
+
+  syntectServer:
+    disabled: true
+
+  worker:
+    disabled: true
+
+  prometheus:
+    disabled: true
+
+  grafana:
+    disabled: false

internal/appliance/reconciler/testdata/sg/grafana/with-existing-configmap.yaml

@@ -0,0 +1,60 @@
+spec:
+  requestedVersion: "5.3.9104"
+
+  blobstore:
+    disabled: true
+
+  codeInsights:
+    disabled: true
+
+  codeIntel:
+    disabled: true
+
+  frontend:
+    disabled: true
+
+  gitServer:
+    disabled: true
+
+  indexedSearch:
+    disabled: true
+
+  openTelemetry:
+    disabled: true
+
+  pgsql:
+    disabled: true
+
+  postgresExporter:
+    disabled: true
+
+  preciseCodeIntel:
+    disabled: true
+
+  redisCache:
+    disabled: true
+
+  redisStore:
+    disabled: true
+
+  repoUpdater:
+    disabled: true
+
+  searcher:
+    disabled: true
+
+  symbols:
+    disabled: true
+
+  syntectServer:
+    disabled: true
+
+  worker:
+    disabled: true
+
+  prometheus:
+    disabled: true
+
+  grafana:
+    disabled: false
+    existingConfigMap: some-out-of-band-config

internal/appliance/reconciler/testdata/sg/grafana/with-replicas.yaml

@@ -0,0 +1,60 @@
+spec:
+  requestedVersion: "5.3.9104"
+
+  blobstore:
+    disabled: true
+
+  codeInsights:
+    disabled: true
+
+  codeIntel:
+    disabled: true
+
+  frontend:
+    disabled: true
+
+  gitServer:
+    disabled: true
+
+  indexedSearch:
+    disabled: true
+
+  openTelemetry:
+    disabled: true
+
+  pgsql:
+    disabled: true
+
+  postgresExporter:
+    disabled: true
+
+  preciseCodeIntel:
+    disabled: true
+
+  redisCache:
+    disabled: true
+
+  redisStore:
+    disabled: true
+
+  repoUpdater:
+    disabled: true
+
+  searcher:
+    disabled: true
+
+  symbols:
+    disabled: true
+
+  syntectServer:
+    disabled: true
+
+  worker:
+    disabled: true
+
+  prometheus:
+    disabled: true
+
+  grafana:
+    disabled: false
+    replicas: 5