[ENG-4100]: Grant worker-temporal RBAC to pull Memgraph snapshots - #375
Merged
Merged
Conversation
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 22, 2026 12:32 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 22, 2026 12:32 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 22, 2026 12:32 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 22, 2026 12:32 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
🔍 Kubeconform Validation Results✅ All cloud provider configurations passed Kubernetes API schema validation!
The rendered Kubernetes manifests conform to the Kubernetes API specification across all cloud providers. |
gtoonstra
approved these changes
Jul 22, 2026
Memgraph DR backups (datafold docs/decisions/choose-memgraph-dr-architecture.md) stream snapshot files out of Memgraph pods via the k8s exec API from a Temporal activity in the worker-temporal pod. Render an opt-in Role (pods/exec create + pods get) and RoleBinding for the service accounts listed in memgraph.backupAccessServiceAccounts (default empty = nothing rendered). Pattern mirrors the ClickHouse backup exec grant held by the operator.
anatoly-scherbakov
force-pushed
the
anatoly-eng-4100-memgraph-backup-rbac
branch
from
July 23, 2026 08:19
a974824 to
c1c42d9
Compare
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 23, 2026 08:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 23, 2026 08:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 23, 2026 08:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
anatoly-scherbakov
temporarily deployed
to
Helm Charts
July 23, 2026 08:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
🔍 Kubeconform Validation Results✅ All cloud provider configurations passed Kubernetes API schema validation!
The rendered Kubernetes manifests conform to the Kubernetes API specification across all cloud providers. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Memgraph DR backups (datafold repo:
docs/decisions/choose-memgraph-dr-architecture.md, datafold/datafold#13758) stream each graph's newest snapshot file out of the Memgraph pod via the k8s exec API, from a Temporal activity running in the worker-io pod.This renders an opt-in Role (
pods/exec create+pods get) and RoleBinding for the service accounts listed inmemgraph.backupAccessServiceAccounts(default[]= nothing rendered). Pattern mirrorsscale-rbac.yamlfrom #374 and the ClickHouse-backup exec grant held by the operator. RBAC cannot scope exec by label/command, so the grant is namespace-wide — same blast radius the operator already carries; recorded in the ADR's security considerations.Per-customer enablement goes through the operator CR (
memgraph.rawValues.backupAccessServiceAccounts: [worker]) — wired in the companion cloud-infra PR. SaaS (hand-applied StatefulSets) gets the equivalent hand-applied Role/RoleBinding, seed kept in cloud-infra.Validation
helm template charts/datafold --set memgraph.install=true --set global.cloudProvider=aws --set memgraph.backupAccessServiceAccounts='{worker-temporal}' --show-only charts/memgraph/templates/backup-rbac.yamlrenders the Role + RoleBinding; without the value, nothing is rendered. Chart version bumped for ct lint.🤖 Generated with Claude Code