[BOYSCOUT]: Grant dma/dfshell RBAC to scale the memgraph StatefulSet

[anatoly-scherbakov]

Why

Per-org managed Memgraph graphs are provisioned at runtime by MemgraphsByOrg.create (datafold/knowledge_graph/registry.py): it patches the datafold-memgraph StatefulSet's replica count (_scale_statefulset) and polls the new pod for readiness (_wait_for_pod_healthy). That code runs inside the dma and dfshell pods, whose service accounts lack permission to read/scale StatefulSets — so knowledge-graph create-graph fails with:

statefulsets.apps "datafold-memgraph" is forbidden: User "system:serviceaccount:<ns>:dma"
cannot patch resource "statefulsets/scale" in API group "apps"

This was hit provisioning a new graph on saas (a fresh datafold-memgraph-8); the fix was applied live by hand and this PR codifies it.

What

New Role + RoleBinding datafold-memgraph-scale in the memgraph subchart, granting exactly what the registry code calls:

Resource	API group	Verbs	Used by
statefulsets/scale	apps	get, patch, update	_scale_statefulset
statefulsets	apps	get	_scale_statefulset (reads current replicas)
pods	""	get	_wait_for_pod_healthy

Subjects come from a new scaleAccessServiceAccounts value (default [dma, dfshell]; empty list disables the RBAC).

Placed in the memgraph subchart so it renders only where memgraph is installed — auto-covering saas, ecolab, and any future memgraph deployment with no per-cluster copies.

Validation

• helm lint charts/datafold passes.
• helm template with memgraph enabled renders the Role + RoleBinding binding dma/dfshell in the release namespace.
• Gated off correctly when memgraph.install=false (subchart not rendered) and when scaleAccessServiceAccounts is empty.
• The equivalent RBAC is already live on saas (applied by hand), where it fixed create-graph.

Rollout / cleanup

• Takes effect when the operator picks up chart 0.10.120. The hand-applied live RBAC keeps create-graph working until then.
• Once this is live, delete the hand-created leftovers on saas (different names): role/dma-memgraph-scale, rolebinding/dma-memgraph-scale, rolebinding/dfshell-memgraph-scale.

🤖 Generated with Claude Code

[github-actions]

🔍 Kubeconform Validation Results

✅ All cloud provider configurations passed Kubernetes API schema validation!

Cloud Provider	Status
AWS	✅ Passed
GCP	✅ Passed
Azure	✅ Passed

The rendered Kubernetes manifests conform to the Kubernetes API specification across all cloud providers.

[github-actions]

🔍 Kubeconform Validation Results

✅ All cloud provider configurations passed Kubernetes API schema validation!

Cloud Provider	Status
AWS	✅ Passed
GCP	✅ Passed
Azure	✅ Passed

The rendered Kubernetes manifests conform to the Kubernetes API specification across all cloud providers.

[github-actions]

🔍 Kubeconform Validation Results

✅ All cloud provider configurations passed Kubernetes API schema validation!

Cloud Provider	Status
AWS	✅ Passed
GCP	✅ Passed
Azure	✅ Passed

The rendered Kubernetes manifests conform to the Kubernetes API specification across all cloud providers.