dgraph-io · mlwelles · Jul 21, 2026
diff --git a/charts/dgraph/templates/_helpers.tpl b/charts/dgraph/templates/_helpers.tpl
@@ -147,25 +147,23 @@ Also, we can't use a single if because lazy evaluation is not an option
 
 {{/*
 Return the proper Docker Image Registry Secret Names
+Priority: imagePullSecrets (Kubernetes object list) > global.imagePullSecrets (string list) > image.pullSecrets (string list)
 */}}
 {{- define "dgraph.imagePullSecrets" -}}
-{{/*
-Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
-but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
-Also, we can't use a single if because lazy evaluation is not an option
-*/}}
-{{- if .Values.global }}
-{{- if .Values.global.imagePullSecrets }}
+{{- if .Values.imagePullSecrets }}
 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
+{{- range .Values.imagePullSecrets }}
+{{- if kindIs "map" . }}
+  - name: {{ .name }}
+{{- else }}
   - name: {{ . }}
 {{- end }}
-{{- else if .Values.image.pullSecrets }}
+{{- end }}
+{{- else if and .Values.global .Values.global.imagePullSecrets }}
 imagePullSecrets:
-{{- range .Values.image.pullSecrets }}
+{{- range .Values.global.imagePullSecrets }}
   - name: {{ . }}
 {{- end }}
-{{- end -}}
 {{- else if .Values.image.pullSecrets }}
 imagePullSecrets:
 {{- range .Values.image.pullSecrets }}
@@ -264,3 +262,69 @@ Allow overriding namespace
 {{- define "dgraph.namespace" -}}
 {{- default .Release.Namespace .Values.namespaceOverride -}}
 {{- end -}}
+
+{{/*
+Generate the ingress path. Emits "/*" for ingress classes that need a wildcard
+prefix (gce, alb, nsx) and "/" otherwise, checking global.ingress.ingressClassName
+first and falling back to the kubernetes.io/ingress.class annotation.
+*/}}
+{{- define "dgraph.ingressPath" -}}
+  {{- $path := "/" -}}
+  {{- if .Values.global.ingress.ingressClassName -}}
+    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
+      {{- $path = "/*" -}}
+    {{- else }}
+      {{- $path = "/" -}}
+    {{- end }}
+  {{- else if index $.Values.global.ingress "annotations" -}}
+    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
+      {{- $path = "/*" -}}
+    {{- else }}
+      {{- $path = "/" -}}
+    {{- end }}
+  {{- end -}}
+  {{- printf "%s" $path -}}
+{{- end -}}
+
+{{/*
+Cluster-domain suffix for in-cluster FQDNs: ".<global.domain>" with the leading
+dot, or empty when global.domain is unset. Trims stray leading/trailing dots so
+a host never renders "...svc." or "...svc..cluster.local".
+Use as: ...svc{{ include "dgraph.domainSuffix" . }}
+*/}}
+{{- define "dgraph.domainSuffix" -}}
+{{- with (.Values.global.domain | default "" | trimAll ".") }}.{{ . }}{{ end -}}
+{{- end -}}
+
+{{/*
+Map a named log level to its glog -v integer; pass any other value (e.g. a raw
+integer) through unchanged. Names are lowercase.
+*/}}
+{{- define "dgraph.verbosity" -}}
+  {{- $m := dict "normal" "0" "verbose" "1" "debug" "2" "trace" "3" -}}
+  {{- $k := toString . -}}
+  {{- index $m $k | default $k -}}
+{{- end -}}
+
+{{/*
+Render the glog flag fragment for a role. "." is a role value map (.Values.alpha
+or .Values.zero). Emits nothing when every value is a glog default (logLevel
+normal/0, empty vmodule, alsologtostderr false, empty logDir, logtostderr true),
+so the default command line is unchanged. When any value differs it emits, with a
+leading space, "-v=<n> --logtostderr=<bool>" plus --vmodule / --alsologtostderr /
+--log_dir when those are set.
+*/}}
+{{- define "dgraph.logFlags" -}}
+{{- $v := include "dgraph.verbosity" .logLevel -}}
+{{- /* logtostderr defaults to true (values.yaml), but Helm's `default` treats a
+       boolean false as empty, so an explicit `false` would be flipped back to the
+       default. Use a nil check so nil -> true while honoring an explicit false. */}}
+{{- $logtostderr := .logtostderr -}}
+{{- if kindIs "invalid" $logtostderr -}}{{- $logtostderr = true -}}{{- end -}}
+{{- if or (ne $v "0") .vmodule .alsologtostderr .logDir (not $logtostderr) -}}
+{{- printf " -v=%s --logtostderr=%v" $v $logtostderr -}}
+{{- if .vmodule }}{{ printf " --vmodule=%s" .vmodule }}{{ end -}}
+{{- if .alsologtostderr }} --alsologtostderr{{ end -}}
+{{- if .logDir }}{{ printf " --log_dir=%s" .logDir }}{{ end -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/dgraph/templates/alpha/ingress.yaml b/charts/dgraph/templates/alpha/ingress.yaml
@@ -1,21 +1,3 @@
-{{- /* Generate ingress path */}}
-{{- define "path" -}}
-  {{- $path := "/" -}}
-  {{- if .Values.global.ingress.ingressClassName -}}
-    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- else if index $.Values.global.ingress "annotations" -}}
-    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- end -}}
-  {{- printf "%s" $path -}}
-{{- end -}}
 {{- /* Alpha ingress resource */}}
 {{- if and (eq .Values.alpha.ingress.enabled true) (eq .Values.global.ingress.enabled false) -}}
 apiVersion: networking.k8s.io/v1
@@ -52,7 +34,7 @@ spec:
                 port:
                   number: 8080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.alpha.ingress.hostname }}
       host: {{ .Values.alpha.ingress.hostname }}
       {{- end }}
@@ -94,7 +76,7 @@ spec:
                 port:
                   number: 9080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.alpha.ingress_grpc.hostname }}
       host: {{ .Values.alpha.ingress_grpc.hostname }}
       {{- end }}

diff --git a/charts/dgraph/templates/alpha/statefulset.yaml b/charts/dgraph/templates/alpha/statefulset.yaml
@@ -8,11 +8,8 @@
      {{- $max = 1 -}}
   {{- end -}}
 
-  {{- /* Append domain suffix if domain is used */}}
-  {{- $domainSuffix := "" -}}
-  {{- if .Values.global.domain -}}
-  {{- $domainSuffix = printf ".%s" .Values.global.domain -}}
-  {{- end -}}
+  {{- /* Append the cluster-domain suffix (trimmed, omitted when empty). */}}
+  {{- $domainSuffix := include "dgraph.domainSuffix" . -}}
 
   {{- /* Create comma-separated list of zeros */}}
   {{- range $idx := until $max }}
@@ -116,8 +113,7 @@ spec:
 {{- include "dgraph.imagePullSecrets" . | indent 6 }}
       {{- if .Values.alpha.securityContext.enabled }}
       securityContext:
-        fsGroup: {{ .Values.alpha.securityContext.fsGroup }}
-        runAsUser: {{ .Values.alpha.securityContext.runAsUser }}
+        {{- omit .Values.alpha.securityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       {{- if .Values.alpha.nodeSelector }}
       nodeSelector:
@@ -136,6 +132,10 @@ spec:
       - name: {{ template "dgraph.alpha.fullname" . }}-init
         image: {{ template "dgraph.initContainers.init.image" . }}
         imagePullPolicy: {{ .Values.alpha.initContainers.init.image.pullPolicy | quote }}
+        {{- if .Values.alpha.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.alpha.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         {{- with .Values.alpha.initContainers.init.env }}
         env:
           {{- tpl (toYaml .) $ | nindent 10 }}
@@ -162,6 +162,10 @@ spec:
       containers:
       - name: {{ template "dgraph.alpha.fullname" . }}
         image: {{ template "dgraph.image" . }}
+        {{- if .Values.alpha.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.alpha.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         ports:
         - containerPort: 7080
           name: grpc-alpha-int
@@ -219,7 +223,7 @@ spec:
           {{- /* TODO: Remove awk-gsub once dgraph-io/dgraph#6837 is merged and back-ported. */}}
           - |
             set -ex
-            exec dgraph alpha --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):7080 --zero {{ template "multi_zeros" . }} {{ .Values.alpha.extraFlags }}{{- if .Values.alpha.acl.enabled }} --acl "secret-file=/dgraph/acl/{{ .Values.alpha.acl.secretFile }};"{{- end }}{{- if .Values.alpha.encryption.enabled }} --encryption "key-file=/dgraph/enc/{{ .Values.alpha.encryption.keyFile }};"{{- end }}
+            exec dgraph alpha --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):7080 --zero {{ template "multi_zeros" . }}{{ template "dgraph.logFlags" .Values.alpha }} {{ .Values.alpha.extraFlags }}{{- if .Values.alpha.acl.enabled }} --acl "secret-file=/dgraph/acl/{{ .Values.alpha.acl.secretFile }};"{{- end }}{{- if .Values.alpha.encryption.enabled }} --encryption "key-file=/dgraph/enc/{{ .Values.alpha.encryption.keyFile }};"{{- end }}
         resources:
 {{ toYaml .Values.alpha.resources | indent 10 }}
         {{- if .Values.alpha.startupProbe.enabled }}

diff --git a/charts/dgraph/templates/global-ingress.yaml b/charts/dgraph/templates/global-ingress.yaml
@@ -1,21 +1,3 @@
-{{- /* Generate ingress path */}}
-{{- define "path" -}}
-  {{- $path := "/" -}}
-  {{- if .Values.global.ingress.ingressClassName -}}
-    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- else if index $.Values.global.ingress "annotations" -}}
-    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- end -}}
-  {{- printf "%s" $path -}}
-{{- end -}}
 {{- /* Global ingress resource */}}
 {{- if (eq .Values.global.ingress.enabled true) -}}
 apiVersion: networking.k8s.io/v1
@@ -52,7 +34,7 @@ spec:
                 port:
                   number: 8080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.global.ingress.alpha_hostname }}
       host: {{ .Values.global.ingress.alpha_hostname }}
       {{- end }}
@@ -65,7 +47,7 @@ spec:
                 port:
                   number: 80
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.global.ingress.ratel_hostname }}
       host: {{ .Values.global.ingress.ratel_hostname }}
       {{- end }}
@@ -107,7 +89,7 @@ spec:
                 port:
                   number: 9080
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.global.ingress_grpc.alpha_grpc_hostname }}
       host: {{ .Values.global.ingress_grpc.alpha_grpc_hostname }}
       {{- end }}

diff --git a/charts/dgraph/templates/pre-upgrade-statefulset-cleanup.yaml b/charts/dgraph/templates/pre-upgrade-statefulset-cleanup.yaml
@@ -3,7 +3,13 @@ Pre-upgrade hook: delete StatefulSets with --cascade=orphan so that Helm can
 recreate them with updated immutable fields (e.g. selector.matchLabels) while
 keeping existing pods running. The pods are adopted by the new StatefulSets
 once the upgrade completes.
+
+Gated by preUpgradeHook.enabled. This only matters for clusters migrating from
+the v24-era selector labels; once a cluster has upgraded past that point the
+hook is pure per-upgrade overhead (a Job plus transient SA/RBAC on every
+helm upgrade) and can be turned off.
 */}}
+{{- if .Values.preUpgradeHook.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -92,22 +98,36 @@ spec:
 
               # StatefulSets (Alpha and Zero)
               for STS in {{ template "dgraph.alpha.fullname" . }} {{ template "dgraph.zero.fullname" . }}; do
-                SELECTOR=$(kubectl get statefulset "$STS" -n "$NS" --ignore-not-found -o jsonpath='{.spec.selector.matchLabels.chart}')
+                # --ignore-not-found: NotFound exits 0 with empty output (handled
+                # below); any other kubectl error exits non-zero and fails the Job
+                # via sh -e, so RBAC or connection problems stay visible.
+                EXISTS=$(kubectl get statefulset "$STS" -n "$NS" --ignore-not-found -o name)
+                if [ -z "$EXISTS" ]; then
+                  echo "StatefulSet $STS does not exist in namespace $NS, skipping."
+                  continue
+                fi
+                SELECTOR=$(kubectl get statefulset "$STS" -n "$NS" -o jsonpath='{.spec.selector.matchLabels.chart}')
                 if [ -n "$SELECTOR" ]; then
                   echo "StatefulSet $STS has stale 'chart' selector label ($SELECTOR), deleting with --cascade=orphan..."
                   kubectl delete statefulset "$STS" --cascade=orphan -n "$NS"
                 else
-                  echo "StatefulSet $STS does not have 'chart' selector label (or does not exist), skipping."
+                  echo "StatefulSet $STS does not have 'chart' selector label, skipping."
                 fi
               done
 
               # Deployments (Ratel)
               for DEPLOY in {{ template "dgraph.ratel.fullname" . }}; do
-                SELECTOR=$(kubectl get deployment "$DEPLOY" -n "$NS" --ignore-not-found -o jsonpath='{.spec.selector.matchLabels.chart}')
+                EXISTS=$(kubectl get deployment "$DEPLOY" -n "$NS" --ignore-not-found -o name)
+                if [ -z "$EXISTS" ]; then
+                  echo "Deployment $DEPLOY does not exist in namespace $NS, skipping."
+                  continue
+                fi
+                SELECTOR=$(kubectl get deployment "$DEPLOY" -n "$NS" -o jsonpath='{.spec.selector.matchLabels.chart}')
                 if [ -n "$SELECTOR" ]; then
                   echo "Deployment $DEPLOY has stale 'chart' selector label ($SELECTOR), deleting with --cascade=orphan..."
                   kubectl delete deployment "$DEPLOY" --cascade=orphan -n "$NS"
                 else
-                  echo "Deployment $DEPLOY does not have 'chart' selector label (or does not exist), skipping."
+                  echo "Deployment $DEPLOY does not have 'chart' selector label, skipping."
                 fi
               done
+{{- end }}
diff --git a/charts/dgraph/templates/ratel/deployment.yaml b/charts/dgraph/templates/ratel/deployment.yaml
@@ -33,14 +33,17 @@ spec:
       {{- end }}
       {{- if .Values.ratel.securityContext.enabled }}
       securityContext:
-        fsGroup: {{ .Values.ratel.securityContext.fsGroup }}
-        runAsUser: {{ .Values.ratel.securityContext.runAsUser }}
+        {{- omit .Values.ratel.securityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
 {{- include "dgraph.imagePullSecrets" . | indent 6 }}
       containers:
       - name: "{{ template "dgraph.ratel.fullname" . }}"
         image: "{{ template "dgraph.ratel.image" . }}"
         imagePullPolicy: {{ .Values.ratel.image.pullPolicy | quote }}
+        {{- if .Values.ratel.containerSecurityContext.enabled }}
+        securityContext:
+          {{- omit .Values.ratel.containerSecurityContext "enabled" | toYaml | nindent 10 }}
+        {{- end }}
         {{- if .Values.ratel.extraEnvs }}
         env:
         {{- with .Values.ratel.extraEnvs }}

diff --git a/charts/dgraph/templates/ratel/ingress.yaml b/charts/dgraph/templates/ratel/ingress.yaml
@@ -1,21 +1,3 @@
-{{- /* Generate ingress path */}}
-{{- define "path" -}}
-  {{- $path := "/" -}}
-  {{- if .Values.global.ingress.ingressClassName -}}
-    {{- if eq .Values.global.ingress.ingressClassName "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- else if index $.Values.global.ingress "annotations" -}}
-    {{- if eq (index $.Values.global.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "nsx" }}
-      {{- $path = "/*" -}}
-    {{- else }}
-      {{- $path = "/" -}}
-    {{- end }}
-  {{- end -}}
-  {{- printf "%s" $path -}}
-{{- end -}}
 {{- /* Ratel ingress resource */}}
 {{- if and (eq .Values.ratel.ingress.enabled true) (eq .Values.global.ingress.enabled false) (eq .Values.ratel.enabled true) -}}
 apiVersion: networking.k8s.io/v1
@@ -52,7 +34,7 @@ spec:
                 port:
                  number: 80
             pathType: ImplementationSpecific
-            path: {{ template "path" . }}
+            path: {{ template "dgraph.ingressPath" . }}
       {{- if .Values.ratel.ingress.hostname }}
       host: {{ .Values.ratel.ingress.hostname }}
       {{- end }}