OPS-2703: Leverage upstream chart for persistency by enys · Pull Request #50 · Linkurious/docker-memgraph

enys · 2026-04-08T15:27:07Z

Start using memgraph official chart
values

enys · 2026-04-17T13:02:34Z

Currently blocked by memgraph/helm-charts#226

argocd-linkurious · 2026-04-27T12:23:07Z

Application memgraph-pr-50 is now running new version of deployments manifests.
See more here: https://argo-cd.k8s.dev.linkurious.net/applications/memgraph-pr-50?operation=true
Url:https://memgraph-pr-50.preview.k8s.preprod.linkurious.net

Copilot

Pull request overview

This PR converts the local Memgraph Helm chart into an umbrella chart that delegates the core workloads to the official upstream memgraph and memgraph-lab sub-charts, while keeping local templates for ingress/network-policy glue.

Changes:

Switched charts/memgraph to an umbrella chart with upstream memgraph + memgraph-lab dependencies and updated values accordingly.
Removed in-repo templates for StatefulSet/Service/ServiceAccount/HPA/tests/exporter in favor of upstream chart resources.
Updated umbrella templates (IngressRoute, NetworkPolicies, NOTES, helpers) and adjusted Tilt config for a preprod context.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
charts/memgraph/values.yaml	Restructured values to pass through to upstream sub-charts and added umbrella-only settings.
charts/memgraph/templates/tests/test-connection.yaml	Removed Helm test pod template.
charts/memgraph/templates/statefulset.yaml	Removed local StatefulSet template (now provided by upstream sub-chart).
charts/memgraph/templates/serviceaccount.yaml	Removed local ServiceAccount template (now provided by upstream sub-chart).
charts/memgraph/templates/service.yaml	Removed local Service template (now provided by upstream sub-chart).
charts/memgraph/templates/namespace-netpol.yaml	Reworked NetworkPolicies to target DB/Lab/exporter resources in the new umbrella setup.
charts/memgraph/templates/mg-exporter.yaml	Removed local exporter resources (now expected from upstream configuration).
charts/memgraph/templates/init-file-configmap.yaml	Moved init-file configmap to umbrella-level values.
charts/memgraph/templates/ingressroute.yaml	Updated IngressRoute to target Memgraph Lab service.
charts/memgraph/templates/hpa.yaml	Removed HPA template.
charts/memgraph/templates/_helpers.tpl	Updated helpers to support DB/Lab service naming and selectors under umbrella chart.
charts/memgraph/templates/NOTES.txt	Updated post-install notes for umbrella chart endpoints and access instructions.
charts/memgraph/Chart.yaml	Updated chart metadata/version and added upstream dependencies.
Tiltfile	Adjusted Tilt context gating and Helm release naming for preprod.
.version	Bumped chart version.
.bumpversion.cfg	Updated bumpversion current_version.

Comments suppressed due to low confidence (1)

Tiltfile:14

Tilt is now gated on a k8s-preprod context, but it still hard-fails unless the namespace ends with dev. This combination will likely prevent Tilt from running in the intended preprod namespaces; align the namespace guard (or the context guard) with the environments you actually want Tilt to support.

if ctx.endswith('k8s-preprod'):
  allow_k8s_contexts(ctx)

if not k8s_namespace().endswith("dev"):
  fail("You are not targeting a dev namespace")

Copilot · 2026-04-27T12:29:16Z

    - from:
      - podSelector:
          matchLabels:
-            {{- include "memgraphExporter.selectorLabels" . | nindent 12 }}
+            app: mg-exporter
+      {{- $promNs := (index .Values "memgraph" "prometheus" "namespace") }}
+      {{- if and $promNs (ne ($promNs | toString) (.Release.Namespace | toString)) }}
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ $promNs }}
+      {{- end }}


In the DB NetworkPolicy, the from peers for the Prometheus exporter are split into separate list items (podSelector and namespaceSelector). In NetworkPolicy semantics these peers are OR'ed, so when prometheus.namespace is set this will allow all pods from that namespace, not just the exporter pods. Combine namespaceSelector and podSelector in the same peer entry to restrict access to only the exporter pods in that namespace.

Copilot · 2026-04-27T12:29:17Z

    - to:
      - podSelector:
          matchLabels:
-            {{- include "memgraph.selectorLabels" . | nindent 12 }}
-      {{- if ne (.Values.prometheus.namespace | default .Release.Namespace) .Release.Namespace }}
+            {{- include "memgraph.dbSelectorLabels" . | nindent 12 }}
+      {{- $promNs := (index .Values "memgraph" "prometheus" "namespace") }}
+      {{- if and $promNs (ne ($promNs | toString) (.Release.Namespace | toString)) }}
      - namespaceSelector:
          matchLabels:
-            name: {{ .Release.Namespace }}
+            kubernetes.io/metadata.name: {{ .Release.Namespace }}
      {{- end }}


In the exporter egress NetworkPolicy, to peers are also split into separate list items (podSelector and namespaceSelector). If the exporter runs in a different namespace than Memgraph, this ends up allowing egress to any pod in the Memgraph namespace on the monitoring port. Combine namespaceSelector + podSelector in a single to peer so egress is limited to the Memgraph pods only.

@copilot apply changes based on this feedback

Fixed in d900039. Both the DB NetworkPolicy from peers and the exporter egress to peers now combine podSelector and namespaceSelector in a single list entry (AND semantics) when the exporter runs in a different namespace, preventing over-broad access.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…er entries Agent-Logs-Url: https://github.com/Linkurious/docker-memgraph/sessions/d5dc5b78-68cd-4423-a226-3b14669023fd Co-authored-by: enys <36994826+enys@users.noreply.github.com>

Copilot · 2026-04-28T08:57:28Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

memgraph.github.io
- Triggering command: /usr/local/bin/helm helm template test charts/memgraph --set networkPolicies.create=true --set memgraph.prometheus.enabled=true --set memgraph.prometheus.namespace=monitoring --dependency-update (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

enys · 2026-04-28T10:01:02Z

The only thing remaining to do is to add the container init for the dataset.

enys added 2 commits April 3, 2026 22:34

Start using memgraph official chart

23711b6

values

1fa412c

enys self-assigned this Apr 8, 2026

enys added 2 commits April 9, 2026 09:59

Fix data-folder

2de00ac

Fix sso

685e955

enys changed the title ~~feature/upstream chart~~ OPS-2703: Leverage upstream chart for persistency Apr 10, 2026

enys added 8 commits April 10, 2026 18:15

update rights

d2add17

storage off by defoult and ressources

9ff31ba

comments

eb16b17

use upstream chart

c9ae9ce

version and spacing

447d4aa

trailing spaces

3c85185

Revert version

d6f16d6

Bump minor

23ea582

enys added cd:preview deploy preview environment and removed cd:preview deploy preview environment labels Apr 17, 2026

Bump upstream chart

1c62ce1

enys added the cd:preview deploy preview environment label Apr 27, 2026

no claim

80d920f

argocd-linkurious Bot deployed to preview April 27, 2026 12:23 View deployment

enys requested review from LiseMachetel and Copilot April 27, 2026 12:24

Copilot started reviewing on behalf of enys April 27, 2026 12:24 View session

Copilot AI reviewed Apr 27, 2026

View reviewed changes

Update charts/memgraph/values.yaml

4d90f30

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of enys April 28, 2026 08:53 View session

fix: combine podSelector+namespaceSelector in single NetworkPolicy pe…

d900039

…er entries Agent-Logs-Url: https://github.com/Linkurious/docker-memgraph/sessions/d5dc5b78-68cd-4423-a226-3b14669023fd Co-authored-by: enys <36994826+enys@users.noreply.github.com>

Copilot finished work on behalf of enys April 28, 2026 08:57

LiseMachetel approved these changes Apr 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OPS-2703: Leverage upstream chart for persistency#50

OPS-2703: Leverage upstream chart for persistency#50
enys wants to merge 16 commits intodevelopfrom
feature/upstream-chart

enys commented Apr 8, 2026

Uh oh!

enys commented Apr 17, 2026

Uh oh!

argocd-linkurious Bot commented Apr 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

enys Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Uh oh!

Copilot AI commented Apr 28, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

enys commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

enys commented Apr 8, 2026

Uh oh!

enys commented Apr 17, 2026

Uh oh!

argocd-linkurious Bot commented Apr 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

enys Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented Apr 28, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

enys commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants