diff --git a/charts/dgraph/templates/_helpers.tpl b/charts/dgraph/templates/_helpers.tpl
index 66137b39e..af6fa3c41 100644
--- a/charts/dgraph/templates/_helpers.tpl
+++ b/charts/dgraph/templates/_helpers.tpl
@@ -147,25 +147,23 @@ Also, we can't use a single if because lazy evaluation is not an option
 
 {{/*
 Return the proper Docker Image Registry Secret Names
+Priority: imagePullSecrets (Kubernetes object list) > global.imagePullSecrets (string list) > image.pullSecrets (string list)
 */}}
 {{- define "dgraph.imagePullSecrets" -}}
-{{/*
-Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
-but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
-Also, we can't use a single if because lazy evaluation is not an option
-*/}}
-{{- if .Values.global }}
-{{- if .Values.global.imagePullSecrets }}
+{{- if .Values.imagePullSecrets }}
 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
+{{- range .Values.imagePullSecrets }}
+{{- if kindIs "map" . }}
+  - name: {{ .name }}
+{{- else }}
   - name: {{ . }}
 {{- end }}
-{{- else if .Values.image.pullSecrets }}
+{{- end }}
+{{- else if and .Values.global .Values.global.imagePullSecrets }}
 imagePullSecrets:
-{{- range .Values.image.pullSecrets }}
+{{- range .Values.global.imagePullSecrets }}
   - name: {{ . }}
 {{- end }}
-{{- end -}}
 {{- else if .Values.image.pullSecrets }}
 imagePullSecrets:
 {{- range .Values.image.pullSecrets }}
@@ -264,3 +262,69 @@ Allow overriding namespace
 {{- define "dgraph.namespace" -}}
 {{- default .Release.Namespace .Values.namespaceOverride -}}
 {{- end -}}
+
+{{/*
+Generate the ingress path. Emits "/*" for ingress classes that need a wildcard
+prefix (gce, alb, nsx) and "/" otherwise, checking global.ingress.ingressClassName
+first and falling back to the kubernetes.io/ingress.class annotation.
+*/}}
+{{- define "dgraph.ingressPath" -}}
+  {{- $path := "/" -}}
+  {{- if .Values.global.ingress.ingressClassName -}}
+    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
+      {{- $path = "/*" -}}
+    {{- else }}
+      {{- $path = "/" -}}
+    {{- end }}
+  {{- else if index $.Values.global.ingress "annotations" -}}
+    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
+      {{- $path = "/*" -}}
+    {{- else }}
+      {{- $path = "/" -}}
+    {{- end }}
+  {{- end -}}
+  {{- printf "%s" $path -}}
+{{- end -}}
+
+{{/*
+Cluster-domain suffix for in-cluster FQDNs: ".<global.domain>" with the leading
+dot, or empty when global.domain is unset. Trims stray leading/trailing dots so
+a host never renders "...svc." or "...svc..cluster.local".
+Use as: ...svc{{ include "dgraph.domainSuffix" . }}
+*/}}
+{{- define "dgraph.domainSuffix" -}}
+{{- with (.Values.global.domain | default "" | trimAll ".") }}.{{ . }}{{ end -}}
+{{- end -}}
+
+{{/*
+Map a named log level to its glog -v integer; pass any other value (e.g. a raw
+integer) through unchanged. Names are lowercase.
+*/}}
+{{- define "dgraph.verbosity" -}}
+  {{- $m := dict "normal" "0" "verbose" "1" "debug" "2" "trace" "3" -}}
+  {{- $k := toString . -}}
+  {{- index $m $k | default $k -}}
+{{- end -}}
+
+{{/*
+Render the glog flag fragment for a role. "." is a role value map (.Values.alpha
+or .Values.zero). Emits nothing when every value is a glog default (logLevel
+normal/0, empty vmodule, alsologtostderr false, empty logDir, logtostderr true),
+so the default command line is unchanged. When any value differs it emits, with a
+leading space, "-v=<n> --logtostderr=<bool>" plus --vmodule / --alsologtostderr /
+--log_dir when those are set.
+*/}}
+{{- define "dgraph.logFlags" -}}
+{{- $v := include "dgraph.verbosity" .logLevel -}}
+{{- /* logtostderr defaults to true (values.yaml), but Helm's `default` treats a
+       boolean false as empty, so an explicit `false` would be flipped back to the
+       default. Use a nil check so nil -> true while honoring an explicit false. */}}
+{{- $logtostderr := .logtostderr -}}
+{{- if kindIs "invalid" $logtostderr -}}{{- $logtostderr = true -}}{{- end -}}
+{{- if or (ne $v "0") .vmodule .alsologtostderr .logDir (not $logtostderr) -}}
+{{- printf " -v=%s --logtostderr=%v" $v $logtostderr -}}
+{{- if .vmodule }}{{ printf " --vmodule=%s" .vmodule }}{{ end -}}
+{{- if .alsologtostderr }} --alsologtostderr{{ end -}}
+{{- if .logDir }}{{ printf " --log_dir=%s" .logDir }}{{ end -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/dgraph/templates/alpha/ingress.yaml b/charts/dgraph/templates/alpha/ingress.yaml
index 3b89464e2..3a03ad2fb 100644
--- a/charts/dgraph/templates/alpha/ingress.yaml
+++ b/charts/dgraph/templates/alpha/ingress.yaml
@@ -1,21 +1,3 @@
-{{- /* Generate ingress path */}}
-{{- define "path" -}}
-  {{- $path := "/" -}}
-  {{- if .Values.global.ingress.ingressClassName -}}
-    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- else if index $.Values.global.ingress "annotations" -}}
-    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- end -}}
-  {{- printf "%s" $path -}}
-{{- end -}}
 {{- /* Alpha ingress resource */}}
 {{- if and (eq .Values.alpha.ingress.enabled true) (eq .Values.global.ingress.enabled false) -}}
 apiVersion: networking.k8s.io/v1
@@ -52,7 +34,7 @@ spec:
                 port:
                   number: 8080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.alpha.ingress.hostname }}
       host: {{ .Values.alpha.ingress.hostname }}
       {{- end }}
@@ -94,7 +76,7 @@ spec:
                 port:
                   number: 9080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.alpha.ingress_grpc.hostname }}
       host: {{ .Values.alpha.ingress_grpc.hostname }}
       {{- end }}
diff --git a/charts/dgraph/templates/alpha/statefulset.yaml b/charts/dgraph/templates/alpha/statefulset.yaml
index cd4301e50..f4fdfcea9 100644
--- a/charts/dgraph/templates/alpha/statefulset.yaml
+++ b/charts/dgraph/templates/alpha/statefulset.yaml
@@ -8,11 +8,8 @@
      {{- $max = 1 -}}
   {{- end -}}
 
-  {{- /* Append domain suffix if domain is used */}}
-  {{- $domainSuffix := "" -}}
-  {{- if .Values.global.domain -}}
-  {{- $domainSuffix = printf ".%s" .Values.global.domain -}}
-  {{- end -}}
+  {{- /* Append the cluster-domain suffix (trimmed, omitted when empty). */}}
+  {{- $domainSuffix := include "dgraph.domainSuffix" . -}}
 
   {{- /* Create comma-separated list of zeros */}}
   {{- range $idx := until $max }}
@@ -116,8 +113,7 @@ spec:
 {{- include "dgraph.imagePullSecrets" . | indent 6 }}
       {{- if .Values.alpha.securityContext.enabled }}
       securityContext:
-        fsGroup: {{ .Values.alpha.securityContext.fsGroup }}
-        runAsUser: {{ .Values.alpha.securityContext.runAsUser }}
+        {{- omit .Values.alpha.securityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       {{- if .Values.alpha.nodeSelector }}
       nodeSelector:
@@ -136,6 +132,10 @@ spec:
       - name: {{ template "dgraph.alpha.fullname" . }}-init
         image: {{ template "dgraph.initContainers.init.image" . }}
         imagePullPolicy: {{ .Values.alpha.initContainers.init.image.pullPolicy | quote }}
+        {{- if .Values.alpha.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.alpha.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         {{- with .Values.alpha.initContainers.init.env }}
         env:
           {{- tpl (toYaml .) $ | nindent 10 }}
@@ -162,6 +162,10 @@ spec:
       containers:
       - name: {{ template "dgraph.alpha.fullname" . }}
         image: {{ template "dgraph.image" . }}
+        {{- if .Values.alpha.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.alpha.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         ports:
         - containerPort: 7080
           name: grpc-alpha-int
@@ -219,7 +223,7 @@ spec:
           {{- /* TODO: Remove awk-gsub once dgraph-io/dgraph#6837 is merged and back-ported. */}}
           - |
             set -ex
-            exec dgraph alpha --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):7080 --zero {{ template "multi_zeros" . }} {{ .Values.alpha.extraFlags }}{{- if .Values.alpha.acl.enabled }} --acl "secret-file=/dgraph/acl/{{ .Values.alpha.acl.secretFile }};"{{- end }}{{- if .Values.alpha.encryption.enabled }} --encryption "key-file=/dgraph/enc/{{ .Values.alpha.encryption.keyFile }};"{{- end }}
+            exec dgraph alpha --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):7080 --zero {{ template "multi_zeros" . }}{{ template "dgraph.logFlags" .Values.alpha }} {{ .Values.alpha.extraFlags }}{{- if .Values.alpha.acl.enabled }} --acl "secret-file=/dgraph/acl/{{ .Values.alpha.acl.secretFile }};"{{- end }}{{- if .Values.alpha.encryption.enabled }} --encryption "key-file=/dgraph/enc/{{ .Values.alpha.encryption.keyFile }};"{{- end }}
         resources:
 {{ toYaml .Values.alpha.resources | indent 10 }}
         {{- if .Values.alpha.startupProbe.enabled }}
diff --git a/charts/dgraph/templates/global-ingress.yaml b/charts/dgraph/templates/global-ingress.yaml
index c7b35f0f0..8452b3a36 100644
--- a/charts/dgraph/templates/global-ingress.yaml
+++ b/charts/dgraph/templates/global-ingress.yaml
@@ -1,21 +1,3 @@
-{{- /* Generate ingress path */}}
-{{- define "path" -}}
-  {{- $path := "/" -}}
-  {{- if .Values.global.ingress.ingressClassName -}}
-    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- else if index $.Values.global.ingress "annotations" -}}
-    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- end -}}
-  {{- printf "%s" $path -}}
-{{- end -}}
 {{- /* Global ingress resource */}}
 {{- if (eq .Values.global.ingress.enabled true) -}}
 apiVersion: networking.k8s.io/v1
@@ -52,7 +34,7 @@ spec:
                 port:
                   number: 8080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.global.ingress.alpha_hostname }}
       host: {{ .Values.global.ingress.alpha_hostname }}
       {{- end }}
@@ -65,7 +47,7 @@ spec:
                 port:
                   number: 80
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.global.ingress.ratel_hostname }}
       host: {{ .Values.global.ingress.ratel_hostname }}
       {{- end }}
@@ -107,7 +89,7 @@ spec:
                 port:
                   number: 9080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.global.ingress_grpc.alpha_grpc_hostname }}
       host: {{ .Values.global.ingress_grpc.alpha_grpc_hostname }}
       {{- end }}
diff --git a/charts/dgraph/templates/pre-upgrade-statefulset-cleanup.yaml b/charts/dgraph/templates/pre-upgrade-statefulset-cleanup.yaml
index 30724f5df..0e1180cbc 100644
--- a/charts/dgraph/templates/pre-upgrade-statefulset-cleanup.yaml
+++ b/charts/dgraph/templates/pre-upgrade-statefulset-cleanup.yaml
@@ -3,7 +3,13 @@ Pre-upgrade hook: delete StatefulSets with --cascade=orphan so that Helm can
 recreate them with updated immutable fields (e.g. selector.matchLabels) while
 keeping existing pods running. The pods are adopted by the new StatefulSets
 once the upgrade completes.
+
+Gated by preUpgradeHook.enabled. This only matters for clusters migrating from
+the v24-era selector labels; once a cluster has upgraded past that point the
+hook is pure per-upgrade overhead (a Job plus transient SA/RBAC on every
+helm upgrade) and can be turned off.
 */}}
+{{- if .Values.preUpgradeHook.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -92,22 +98,36 @@ spec:
 
               # StatefulSets (Alpha and Zero)
               for STS in {{ template "dgraph.alpha.fullname" . }} {{ template "dgraph.zero.fullname" . }}; do
-                SELECTOR=$(kubectl get statefulset "$STS" -n "$NS" --ignore-not-found -o jsonpath='{.spec.selector.matchLabels.chart}')
+                # --ignore-not-found: NotFound exits 0 with empty output (handled
+                # below); any other kubectl error exits non-zero and fails the Job
+                # via sh -e, so RBAC or connection problems stay visible.
+                EXISTS=$(kubectl get statefulset "$STS" -n "$NS" --ignore-not-found -o name)
+                if [ -z "$EXISTS" ]; then
+                  echo "StatefulSet $STS does not exist in namespace $NS, skipping."
+                  continue
+                fi
+                SELECTOR=$(kubectl get statefulset "$STS" -n "$NS" -o jsonpath='{.spec.selector.matchLabels.chart}')
                 if [ -n "$SELECTOR" ]; then
                   echo "StatefulSet $STS has stale 'chart' selector label ($SELECTOR), deleting with --cascade=orphan..."
                   kubectl delete statefulset "$STS" --cascade=orphan -n "$NS"
                 else
-                  echo "StatefulSet $STS does not have 'chart' selector label (or does not exist), skipping."
+                  echo "StatefulSet $STS does not have 'chart' selector label, skipping."
                 fi
               done
 
               # Deployments (Ratel)
               for DEPLOY in {{ template "dgraph.ratel.fullname" . }}; do
-                SELECTOR=$(kubectl get deployment "$DEPLOY" -n "$NS" --ignore-not-found -o jsonpath='{.spec.selector.matchLabels.chart}')
+                EXISTS=$(kubectl get deployment "$DEPLOY" -n "$NS" --ignore-not-found -o name)
+                if [ -z "$EXISTS" ]; then
+                  echo "Deployment $DEPLOY does not exist in namespace $NS, skipping."
+                  continue
+                fi
+                SELECTOR=$(kubectl get deployment "$DEPLOY" -n "$NS" -o jsonpath='{.spec.selector.matchLabels.chart}')
                 if [ -n "$SELECTOR" ]; then
                   echo "Deployment $DEPLOY has stale 'chart' selector label ($SELECTOR), deleting with --cascade=orphan..."
                   kubectl delete deployment "$DEPLOY" --cascade=orphan -n "$NS"
                 else
-                  echo "Deployment $DEPLOY does not have 'chart' selector label (or does not exist), skipping."
+                  echo "Deployment $DEPLOY does not have 'chart' selector label, skipping."
                 fi
               done
+{{- end }}
diff --git a/charts/dgraph/templates/ratel/deployment.yaml b/charts/dgraph/templates/ratel/deployment.yaml
index 08edba72d..c2659543e 100644
--- a/charts/dgraph/templates/ratel/deployment.yaml
+++ b/charts/dgraph/templates/ratel/deployment.yaml
@@ -33,14 +33,17 @@ spec:
       {{- end }}
       {{- if .Values.ratel.securityContext.enabled }}
       securityContext:
-        fsGroup: {{ .Values.ratel.securityContext.fsGroup }}
-        runAsUser: {{ .Values.ratel.securityContext.runAsUser }}
+        {{- omit .Values.ratel.securityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
 {{- include "dgraph.imagePullSecrets" . | indent 6 }}
       containers:
       - name: "{{ template "dgraph.ratel.fullname" . }}"
         image: "{{ template "dgraph.ratel.image" . }}"
         imagePullPolicy: {{ .Values.ratel.image.pullPolicy | quote }}
+        {{- if .Values.ratel.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.ratel.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         {{- if .Values.ratel.extraEnvs }}
         env:
         {{- with .Values.ratel.extraEnvs }}
diff --git a/charts/dgraph/templates/ratel/ingress.yaml b/charts/dgraph/templates/ratel/ingress.yaml
index 109847e4f..46fb64090 100644
--- a/charts/dgraph/templates/ratel/ingress.yaml
+++ b/charts/dgraph/templates/ratel/ingress.yaml
@@ -1,21 +1,3 @@
-{{- /* Generate ingress path */}}
-{{- define "path" -}}
-  {{- $path := "/" -}}
-  {{- if .Values.global.ingress.ingressClassName -}}
-    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- else if index $.Values.global.ingress "annotations" -}}
-    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- end -}}
-  {{- printf "%s" $path -}}
-{{- end -}}
 {{- /* Ratel ingress resource */}}
 {{- if and (eq .Values.ratel.ingress.enabled true) (eq .Values.global.ingress.enabled false) (eq .Values.ratel.enabled true) -}}
 apiVersion: networking.k8s.io/v1
@@ -52,7 +34,7 @@ spec:
                 port:
                  number: 80
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.ratel.ingress.hostname }}
       host: {{ .Values.ratel.ingress.hostname }}
       {{- end }}
diff --git a/charts/dgraph/templates/zero/statefulset.yaml b/charts/dgraph/templates/zero/statefulset.yaml
index 11d9fbfdf..87458e020 100644
--- a/charts/dgraph/templates/zero/statefulset.yaml
+++ b/charts/dgraph/templates/zero/statefulset.yaml
@@ -2,11 +2,8 @@
 {{- define "peer_zero" -}}
   {{- $zeroFullName := include "dgraph.zero.fullname" . -}}
 
-  {{- /* Append domain suffix if domain is used */}}
-  {{- $domainSuffix := "" -}}
-  {{- if .Values.global.domain -}}
-  {{- $domainSuffix = printf ".%s" .Values.global.domain -}}
-  {{- end -}}
+  {{- /* Append the cluster-domain suffix (trimmed, omitted when empty). */}}
+  {{- $domainSuffix := include "dgraph.domainSuffix" . -}}
 
   {{- printf "%s-%d.%s-headless.${POD_NAMESPACE}.svc%s:5080" $zeroFullName 0 $zeroFullName $domainSuffix -}}
 {{- end -}}
@@ -100,8 +97,7 @@ spec:
 {{- include "dgraph.imagePullSecrets" . | indent 6 }}
       {{- if .Values.zero.securityContext.enabled }}
       securityContext:
-        fsGroup: {{ .Values.zero.securityContext.fsGroup }}
-        runAsUser: {{ .Values.zero.securityContext.runAsUser }}
+        {{- omit .Values.zero.securityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       {{- if .Values.zero.nodeSelector }}
       nodeSelector:
@@ -114,6 +110,10 @@ spec:
       containers:
       - name: {{ template "dgraph.zero.fullname" . }}
         image: {{ template "dgraph.image" . }}
+        {{- if .Values.zero.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.zero.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         ports:
         - containerPort: 5080
           name: grpc-zero
@@ -145,9 +145,9 @@ spec:
               ordinal=${BASH_REMATCH[1]}
               idx=$(($ordinal + 1))
               if [[ $ordinal -eq 0 ]]; then
-                exec dgraph zero --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):5080 {{ template "raft_index_flag" . }}$idx --replicas {{ .Values.zero.shardReplicaCount }} {{ .Values.zero.extraFlags }}
+                exec dgraph zero --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):5080 {{ template "raft_index_flag" . }}$idx --replicas {{ .Values.zero.shardReplicaCount }}{{ template "dgraph.logFlags" .Values.zero }} {{ .Values.zero.extraFlags }}
               else
-                exec dgraph zero --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):5080 --peer {{ template "peer_zero" . }} {{ template "raft_index_flag" . }}$idx --replicas {{ .Values.zero.shardReplicaCount }} {{ .Values.zero.extraFlags }}
+                exec dgraph zero --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):5080 --peer {{ template "peer_zero" . }} {{ template "raft_index_flag" . }}$idx --replicas {{ .Values.zero.shardReplicaCount }}{{ template "dgraph.logFlags" .Values.zero }} {{ .Values.zero.extraFlags }}
               fi
         resources:
 {{ toYaml .Values.zero.resources | indent 10 }}
diff --git a/charts/dgraph/values.yaml b/charts/dgraph/values.yaml
index c675381f5..a5fb62361 100644
--- a/charts/dgraph/values.yaml
+++ b/charts/dgraph/values.yaml
@@ -12,6 +12,12 @@
 ## and per-component podLabels will override commonLabels on key conflicts.
 commonLabels: {}
 
+## Optionally specify an array of imagePullSecrets applied to every Pod.
+## Entries may be plain secret-name strings or Kubernetes {name: secret-name}
+## objects. Takes precedence over global.imagePullSecrets and image.pullSecrets.
+## Secrets must be manually created in the namespace.
+imagePullSecrets: []
+
 image: &image
   registry: docker.io
   repository: dgraph/dgraph
@@ -37,6 +43,10 @@ image: &image
 ## Runs automatically on helm upgrade — detects and recreates StatefulSets
 ## with stale selector labels using --cascade=orphan to avoid downtime.
 preUpgradeHook:
+  ## Run the v24-to-v25 StatefulSet selector migration Job on helm upgrade.
+  ## Once every cluster has migrated past the v24-to-v25 selector change this
+  ## can be set to false (it then becomes pure per-upgrade overhead).
+  enabled: true
   image:
     registry: docker.io
     repository: bitnami/kubectl
@@ -126,6 +136,27 @@ zero:
   ## Extra flags for command line flags in command
   extraFlags: ""
 
+  ## Verbosity (glog -v). INFO/WARNING/ERROR are ALWAYS written to stderr; this
+  ## only adds finer V-logs on top. Named level OR a raw -v integer:
+  ##   normal->0 (prod default)   verbose->1   debug->2   trace->3
+  logLevel: normal
+
+  ## Per-module verbosity (glog --vmodule), e.g. "server=3,raft=2". Empty = none.
+  vmodule: ""
+
+  ## Log to the container's stderr (glog --logtostderr). Keep true in Kubernetes
+  ## so logs reach `kubectl logs` / the node collector. Setting false routes logs
+  ## to files under logDir instead — only safe with a writable, mounted logDir.
+  logtostderr: true
+
+  ## Also write logs to files under logDir IN ADDITION to stderr
+  ## (glog --alsologtostderr). Requires a writable logDir.
+  alsologtostderr: false
+
+  ## Directory for glog file output (glog --log_dir); used when logtostderr=false
+  ## or alsologtostderr=true. Must be a writable mount. Empty = glog default.
+  logDir: ""
+
   ## Configuration file for dgraph zero used as an alternative to command-line options
   ## Ref: https://docs.dgraph.io/cli/config
   configFile: {}
@@ -173,6 +204,19 @@ zero:
     fsGroup: 1001
     runAsUser: 1001
 
+  ## dgraph container Security Context.
+  ## Drops all Linux capabilities and forbids privilege escalation. Every key
+  ## except `enabled` is rendered verbatim into the container securityContext.
+  ## readOnlyRootFilesystem is left false because dgraph writes scratch data
+  ## outside its mounted data dir; flip it on only after verifying on a cluster.
+  containerSecurityContext:
+    enabled: false
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: false
+    capabilities:
+      drop:
+      - ALL
+
   ## TLS Configuration
   tls:
     enabled: false
@@ -314,6 +358,27 @@ alpha:
   ## Extra flags for command line flags in command
   extraFlags: ""
 
+  ## Verbosity (glog -v). INFO/WARNING/ERROR are ALWAYS written to stderr; this
+  ## only adds finer V-logs on top. Named level OR a raw -v integer:
+  ##   normal->0 (prod default)   verbose->1   debug->2   trace->3
+  logLevel: normal
+
+  ## Per-module verbosity (glog --vmodule), e.g. "server=3,raft=2". Empty = none.
+  vmodule: ""
+
+  ## Log to the container's stderr (glog --logtostderr). Keep true in Kubernetes
+  ## so logs reach `kubectl logs` / the node collector. Setting false routes logs
+  ## to files under logDir instead — only safe with a writable, mounted logDir.
+  logtostderr: true
+
+  ## Also write logs to files under logDir IN ADDITION to stderr
+  ## (glog --alsologtostderr). Requires a writable logDir.
+  alsologtostderr: false
+
+  ## Directory for glog file output (glog --log_dir); used when logtostderr=false
+  ## or alsologtostderr=true. Must be a writable mount. Empty = glog default.
+  logDir: ""
+
   ## Configuration file for dgraph alpha used as an alternative to command-line options
   ## Ref: https://docs.dgraph.io/cli/config
   configFile: {}
@@ -377,6 +442,19 @@ alpha:
     fsGroup: 1001
     runAsUser: 1001
 
+  ## dgraph container Security Context.
+  ## Drops all Linux capabilities and forbids privilege escalation. Every key
+  ## except `enabled` is rendered verbatim into the container securityContext.
+  ## readOnlyRootFilesystem is left false because dgraph writes scratch data
+  ## outside its mounted data dir; flip it on only after verifying on a cluster.
+  containerSecurityContext:
+    enabled: false
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: false
+    capabilities:
+      drop:
+      - ALL
+
   ## TLS Configuration
   ## Documentation on dgraph alpha TLS options,
   ##  see https://docs.dgraph.io/admin/security/tls-configuration#tls-options
@@ -606,6 +684,17 @@ ratel:
     fsGroup: 1001
     runAsUser: 1001
 
+  ## ratel container Security Context.
+  ## Drops all Linux capabilities and forbids privilege escalation. Every key
+  ## except `enabled` is rendered verbatim into the container securityContext.
+  containerSecurityContext:
+    enabled: false
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: false
+    capabilities:
+      drop:
+      - ALL
+
   ## Configure resource requests
   ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
   ##