From 371dd17a7e5b2a35f760e43cdb12c089175482c6 Mon Sep 17 00:00:00 2001 From: Michael Welles Date: Tue, 21 Jul 2026 00:40:49 -0400 Subject: [PATCH] chore(dgraph): release v25.3.8 and document the breaking changes --- charts/dgraph/Chart.yaml | 4 +-- charts/dgraph/README.md | 69 ++++++++++++++++++++++++++++++++++++++- charts/dgraph/values.yaml | 2 +- 3 files changed, 71 insertions(+), 4 deletions(-) diff --git a/charts/dgraph/Chart.yaml b/charts/dgraph/Chart.yaml index edc4489aa..8bf2b8517 100644 --- a/charts/dgraph/Chart.yaml +++ b/charts/dgraph/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v2 name: dgraph type: application -version: 25.3.1-preview2 -appVersion: v25.3.1 +version: 25.3.8 +appVersion: v25.3.8 description: Dgraph is a horizontally scalable and distributed graph database, providing ACID transactions, consistent replication and linearizable reads. keywords: - dgraph diff --git a/charts/dgraph/README.md b/charts/dgraph/README.md index f8f75270a..68c5dcc03 100644 --- a/charts/dgraph/README.md +++ b/charts/dgraph/README.md @@ -88,13 +88,15 @@ The following table lists the configurable parameters of the `dgraph` chart and | Parameter | Description | Default | | ---------------------------------------- | --------------------------------------------------------------------- | --------------------------------------------------- | | `commonLabels` | Labels to add to all resources and pod templates | `{}` | +| `imagePullSecrets` | Array of imagePullSecrets applied to every Pod (plain strings or `{name: ...}` objects); takes precedence over `global.imagePullSecrets` and `image.pullSecrets` | `[]` | | `image.registry` | Container registry name | `docker.io` | | `image.repository` | Container image name | `dgraph/dgraph` | -| `image.tag` | Container image tag | `v25.3.1` | +| `image.tag` | Container image tag | `v25.3.8` | | `image.pullPolicy` | Container pull policy | `IfNotPresent` | | `nameOverride` | Deployment name override (will append the release name) | `nil` | | `namespaceOverride` | Deployment namespace override if specified. | `nil` | | `fullnameOverride` | Deployment full name override (the release name is ignored) | `nil` | +| `preUpgradeHook.enabled` | Run the v24-to-v25 StatefulSet selector migration Job on `helm upgrade` | `true` | | `preUpgradeHook.image.registry` | Pre-upgrade hook image registry | `docker.io` | | `preUpgradeHook.image.repository` | Pre-upgrade hook image repository | `bitnami/kubectl` | | `preUpgradeHook.image.tag` | Pre-upgrade hook image tag | `1.31` | @@ -111,6 +113,9 @@ The following table lists the configurable parameters of the `dgraph` chart and | `zero.updateStrategy` | Strategy for upgrading zero nodes | `RollingUpdate` | | `zero.schedulerName` | Configure an explicit scheduler | `nil` | | `zero.monitorLabel` | "monitor" label on the zero Service (for Prometheus service discovery) | `zero-dgraph-io` | +| `zero.pdb.enabled` | Enable a PodDisruptionBudget for the zero StatefulSet | `false` | +| `zero.pdb.minAvailable` | Minimum available zero pods during voluntary disruptions | `2` | +| `zero.pdb.maxUnavailable` | Maximum unavailable zero pods (alternative to `minAvailable`) | `nil` | | `zero.rollingUpdatePartition` | Partition update strategy | `nil` | | `zero.podManagementPolicy` | Pod management policy for zero nodes | `OrderedReady` | | `zero.replicaCount` | Number of zero nodes | `3` | @@ -122,6 +127,11 @@ The following table lists the configurable parameters of the `dgraph` chart and | `zero.envFrom` | Extra environment variables loaded from configmap(s) and/or secret(s) | `[]` | | `zero.extraEnvs` | extra env vars | `[]` | | `zero.extraFlags` | Zero extra flags for command line | `""` | +| `zero.logLevel` | Verbosity (glog `-v`): `normal`/`verbose`/`debug`/`trace`, or a raw integer | `normal` | +| `zero.vmodule` | Per-module glog verbosity (`--vmodule`), e.g. `server=3,raft=2` | `""` | +| `zero.logtostderr` | Log to the container's stderr (glog `--logtostderr`) | `true` | +| `zero.alsologtostderr` | Also write logs under `logDir` in addition to stderr | `false` | +| `zero.logDir` | Directory for glog file output (`--log_dir`); used when `logtostderr=false` or `alsologtostderr=true` | `""` | | `zero.configFile` | Zero config file | `{}` | | `zero.automountServiceAccountToken` | automatically mount a ServiceAccount API credentials | `true` | | `zero.service.type` | Zero service type | `ClusterIP` | @@ -135,6 +145,10 @@ The following table lists the configurable parameters of the `dgraph` chart and | `zero.securityContext.enabled` | Security context for zero nodes enabled | `false` | | `zero.securityContext.fsGroup` | Group id of the zero container | `1001` | | `zero.securityContext.runAsUser` | User ID for the zero container | `1001` | +| `zero.containerSecurityContext.enabled` | Enable the zero container securityContext (drop ALL capabilities, forbid privilege escalation) | `false` | +| `zero.containerSecurityContext.allowPrivilegeEscalation` | Allow privilege escalation for the zero container | `false` | +| `zero.containerSecurityContext.readOnlyRootFilesystem` | Mount the zero container's root filesystem read-only | `false` | +| `zero.containerSecurityContext.capabilities.drop` | Linux capabilities dropped from the zero container | `['ALL']` | | `zero.persistence.enabled` | Enable persistence for zero using PVC | `true` | | `zero.persistence.storageClass` | PVC Storage Class for zero volume | `nil` | | `zero.persistence.accessModes` | PVC Access Mode for zero volume | `['ReadWriteOnce']` | @@ -156,6 +170,9 @@ The following table lists the configurable parameters of the `dgraph` chart and | `alpha.extraAnnotations` | Specify annotations for template metadata | `{}` | | `alpha.podLabels` | Specify additional labels for template metadata | `{}` | | `alpha.monitorLabel` | "monitor" label on the alpha Service (for Prometheus service discovery) | `alpha-dgraph-io` | +| `alpha.pdb.enabled` | Enable a PodDisruptionBudget for the alpha StatefulSet | `false` | +| `alpha.pdb.minAvailable` | Minimum available alpha pods during voluntary disruptions | `2` | +| `alpha.pdb.maxUnavailable` | Maximum unavailable alpha pods (alternative to `minAvailable`) | `nil` | | `alpha.updateStrategy` | Strategy for upgrading alpha nodes | `RollingUpdate` | | `alpha.schedulerName` | Configure an explicit scheduler | `nil` | | `alpha.rollingUpdatePartition` | Partition update strategy | `nil` | @@ -168,6 +185,11 @@ The following table lists the configurable parameters of the `dgraph` chart and | `alpha.envFrom` | Extra environment variables loaded from configmap(s) and/or secret(s) | `[]` | | `alpha.extraEnvs` | extra env vars | `[]` | | `alpha.extraFlags` | Alpha extra flags for command | `""` | +| `alpha.logLevel` | Verbosity (glog `-v`): `normal`/`verbose`/`debug`/`trace`, or a raw integer | `normal` | +| `alpha.vmodule` | Per-module glog verbosity (`--vmodule`), e.g. `server=3,raft=2` | `""` | +| `alpha.logtostderr` | Log to the container's stderr (glog `--logtostderr`) | `true` | +| `alpha.alsologtostderr` | Also write logs under `logDir` in addition to stderr | `false` | +| `alpha.logDir` | Directory for glog file output (`--log_dir`); used when `logtostderr=false` or `alsologtostderr=true` | `""` | | `alpha.configFile` | Alpha config file | `{}` | | `alpha.automountServiceAccountToken` | automatically mount a ServiceAccount API credentials | `true` | | `alpha.service.type` | Alpha node service type | `ClusterIP` | @@ -190,6 +212,10 @@ The following table lists the configurable parameters of the `dgraph` chart and | `alpha.securityContext.enabled` | Security context for Alpha nodes enabled | `false` | | `alpha.securityContext.fsGroup` | Group id of the Alpha container | `1001` | | `alpha.securityContext.runAsUser` | User ID for the Alpha container | `1001` | +| `alpha.containerSecurityContext.enabled` | Enable the alpha container securityContext (drop ALL capabilities, forbid privilege escalation) | `false` | +| `alpha.containerSecurityContext.allowPrivilegeEscalation` | Allow privilege escalation for the alpha container | `false` | +| `alpha.containerSecurityContext.readOnlyRootFilesystem` | Mount the alpha container's root filesystem read-only | `false` | +| `alpha.containerSecurityContext.capabilities.drop` | Linux capabilities dropped from the alpha container | `['ALL']` | | `alpha.tls.enabled` | Alpha service TLS enabled | `false` | | `alpha.tls.files` | Alpha service TLS key and certificate files stored as secrets | `false` | | `alpha.tls.internalPort` | Enable TLS on Alpha's internal gRPC port (synthesized into `--tls`) | `true` | @@ -203,6 +229,13 @@ The following table lists the configurable parameters of the `dgraph` chart and | `alpha.acl.secretFile` | Filename/key of the HMAC secret within the mounted Secret | `hmac_secret_file` | | `alpha.acl.existingSecret` | Name of a pre-created Secret holding the HMAC key (suppresses the chart's own) | `""` | | `alpha.acl.file` | Alpha ACL secret file | `nil` | +| `alpha.acl.bootstrap.enabled` | Enable the post-install/post-upgrade ACL bootstrap reconciler Job | `false` | +| `alpha.acl.bootstrap.existingSecret` | Secret holding the credentials the bootstrap Job reads (defaults to `acl.existingSecret`, else the chart-managed ACL Secret) | `""` | +| `alpha.acl.bootstrap.grootPasswordSecretKey` | Key in the credentials Secret holding groot's rotated password | `groot_password` | +| `alpha.acl.bootstrap.rotation` | Opaque token rendered as a Job pod annotation; change it to force a re-run without touching Alpha | `""` | +| `alpha.acl.bootstrap.image` | Image override for the bootstrap Job (empty reuses the deployed dgraph image) | `{}` | +| `alpha.acl.bootstrap.groups` | Declarative ACL groups (`name`, `rules: [{predicate, permission}]`) the reconciler converges | `[]` | +| `alpha.acl.bootstrap.users` | Declarative ACL users (`name`, `passwordSecretKey`, `groups`) the reconciler converges | `[]` | | `alpha.persistence.enabled` | Enable persistence for alpha using PVC | `true` | | `alpha.persistence.storageClass` | PVC Storage Class for alpha volume | `nil` | | `alpha.persistence.accessModes` | PVC Access Mode for alpha volume | `['ReadWriteOnce']` | @@ -254,6 +287,10 @@ The following table lists the configurable parameters of the `dgraph` chart and | `ratel.securityContext.enabled` | Security context for ratel nodes enabled | `false` | | `ratel.securityContext.fsGroup` | Group id of the ratel container | `1001` | | `ratel.securityContext.runAsUser` | User ID for the ratel container | `1001` | +| `ratel.containerSecurityContext.enabled` | Enable the ratel container securityContext (drop ALL capabilities, forbid privilege escalation) | `false` | +| `ratel.containerSecurityContext.allowPrivilegeEscalation` | Allow privilege escalation for the ratel container | `false` | +| `ratel.containerSecurityContext.readOnlyRootFilesystem` | Mount the ratel container's root filesystem read-only | `false` | +| `ratel.containerSecurityContext.capabilities.drop` | Linux capabilities dropped from the ratel container | `['ALL']` | | `ratel.resources.requests` | Ratel pod resources requests | `nil` | | `ratel.livenessProbe` | Ratel liveness probes | See `values.yaml` for defaults | | `ratel.readinessProbe` | Ratel readiness probes | See `values.yaml` for defaults | @@ -265,6 +302,8 @@ The following table lists the configurable parameters of the `dgraph` chart and | `backups.schedulerName` | Configure an explicit scheduler for Backups Kubernetes CronJobs | `nil` | | `backups.admin.user` | Login user for backups (required if ACL enabled) | `groot` | | `backups.admin.password` | Login user password for backups (required if ACL enabled) | `nil` | +| `backups.admin.existingSecret` | Pre-created Secret holding the backup admin password (chart mints none of its own when set); ignored unless `alpha.acl.enabled` | `""` | +| `backups.admin.passwordSecretKey` | Key within `existingSecret` (or the chart's own backups Secret) holding the backup admin password | `backup_admin_password` | | `backups.admin.tls_client` | TLS Client Name (requried if `REQUIREANY` or `REQUIREANDVERIFY` set) | `nil` | | `backups.admin.auth_token` | Auth Token | `nil` | | `backups.image.registry` | Container registry name | `docker.io` | @@ -294,6 +333,34 @@ The following table lists the configurable parameters of the `dgraph` chart and | `backups.keys.minio.secret` | Alpha env variable `MINIO_SECRET_KEY` fetched from secrets | "" | | `backups.keys.s3.access` | Alpha env variable `AWS_ACCESS_KEY_ID` fetched from secrets | "" | | `backups.keys.s3.secret` | Alpha env variable `AWS_SECRET_ACCESS_KEY` fetched from secrets | "" | +| `serviceMonitor.enabled` | Create a Prometheus Operator ServiceMonitor for the alpha and zero metrics endpoints (requires the Prometheus Operator CRDs) | `false` | +| `serviceMonitor.namespace` | Namespace for the ServiceMonitor (defaults to the release namespace) | `nil` | +| `serviceMonitor.labels` | Extra labels for the ServiceMonitor (for Prometheus Operator `serviceMonitorSelector`) | `{}` | +| `serviceMonitor.interval` | Scrape interval | `30s` | +| `serviceMonitor.scrapeTimeout` | Scrape timeout | `10s` | +| `serviceMonitor.path` | Metrics endpoint path | `/debug/prometheus_metrics` | +| `prometheusRule.enabled` | Create a Prometheus Operator PrometheusRule with default alerts (requires the Prometheus Operator CRDs) | `false` | +| `prometheusRule.labels` | Extra labels for the PrometheusRule (for Prometheus Operator `ruleSelector`) | `{}` | +| `prometheusRule.defaultRules` | Include the chart's conservative default alerting rules | `true` | +| `prometheusRule.extraRules` | Additional Prometheus alerting rules appended to the PrometheusRule | `[]` | +| `networkPolicy.enabled` | Create a NetworkPolicy restricting ingress to the dgraph pods | `false` | +| `networkPolicy.clientPodLabels` | Pod selector labels allowed as NetworkPolicy ingress clients | `{}` | +| `networkPolicy.extraIngress` | Additional NetworkPolicy ingress rules | `[]` | +| `validation.enabled` | Master switch for the post-install validation subsystem (ConfigMap, test Pod, Job, CronJob, RBAC) | `false` | +| `validation.image` | Validator image override (empty reuses the deployed dgraph image) | `{}` | +| `validation.adminUser` | Account the validator logs in as for auth-dependent checks | `groot` | +| `validation.adminPasswordSecretKey` | Secret key holding `adminUser`'s password (empty derives it) | `""` | +| `validation.job.enabled` | Run validation as a post-install/upgrade hook Job that gates the release | `false` | +| `validation.job.backoffLimit` | Job `backoffLimit` (also used by the manual CronJob's jobTemplate) | `1` | +| `validation.cronjob.enabled` | Create a suspended, manually-triggered CronJob for on-demand validation | `false` | +| `validation.rbac.enabled` | Create the validator ServiceAccount/Role/RoleBinding (required by `checkBackups`) | `false` | +| `validation.checkBackups` | Also assert the backup CronJobs exist with their expected schedules (requires `rbac.enabled`) | `false` | +| `validation.backupRoundtrip` | Trigger a live backup round-trip to S3 (side-effecting, slow; reserved for future use) | `false` | +| `validation.retries` | Per-check retry attempts before failing | `10` | +| `validation.retrySleep` | Seconds between retries | `12` | +| `validation.podAnnotations` | Extra annotations for validator pods | `{}` | +| `validation.nodeSelector` | nodeSelector for validator pods (empty falls back to `alpha.nodeSelector`) | `{}` | +| `validation.tolerations` | tolerations for validator pods (empty falls back to `alpha.tolerations`) | `[]` | | `global.ingress.enabled` | Enable global ingress resource (overrides Alpha/Ratel ingress) | `false` | | `global.ingress.annotations` | global ingress annotations | `{}` | | `global.ingress.tls` | global ingress tls settings | `{}` | diff --git a/charts/dgraph/values.yaml b/charts/dgraph/values.yaml index 1d05abcd5..e2688385d 100644 --- a/charts/dgraph/values.yaml +++ b/charts/dgraph/values.yaml @@ -21,7 +21,7 @@ imagePullSecrets: [] image: &image registry: docker.io repository: dgraph/dgraph - tag: v25.3.1 + tag: v25.3.8 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images