fix(helm): preserve STS serviceName + networkPolicy.egress back-compat

[waleedlatif1]

Summary

• Revert postgres StatefulSet spec.serviceName to <name>-postgresql — the field is immutable, so the rename to -headless would break helm upgrade on every existing install. Headless Service is still rendered alongside.
• Restore networkPolicy.egress as a list of custom egress rules (back-compat). Cloud-metadata blocking moves to a sibling field networkPolicy.egressExceptCidrs. This prevents the silent-drop of user-supplied egress rules when upgrading.
• Add upgrade notes to NOTES.txt covering the above plus the ESO apiVersion default flip (v1 → v1beta1) from the previous PR.

Type of Change

• Bug fix (upgrade-path regressions surfaced post-merge of improvement(helm): helm chart updates with security, ESO, and docs overhaul #4565)

Testing

helm lint . --strict clean; helm unittest . 51/51 pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 12, 2026 9:18pm

[cursor]

PR Summary

Medium Risk
Touches Helm-rendered StatefulSet and NetworkPolicy templates/values; mistakes could break upgrades or unexpectedly restrict/permit egress, though the intent is explicitly back-compat and is covered by updated unit tests.

Overview
Prevents upgrade failures by restoring PostgreSQL (and copilot Postgres) StatefulSet.spec.serviceName to the previously shipped non-headless Service name and documenting the immutability constraint.

Restores backward compatibility for network policy customization by keeping networkPolicy.egress as a list of user-supplied egress rules and moving cloud-metadata blocking to networkPolicy.egressExceptCidrs; updates the template accordingly and adds a dedicated telemetry collector NetworkPolicy when telemetry.enabled=true.

Adds startupProbe support for both Postgres StatefulSets and updates chart docs/NOTES.txt and Helm unit tests to reflect the new/renamed values and upgrade notes.

^{Reviewed by Cursor Bugbot for commit 32f8ca4. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes two upgrade-path regressions introduced by #4565: it reverts spec.serviceName on both PostgreSQL StatefulSets to their original (immutable) values to prevent helm upgrade failures on existing installs, and restores networkPolicy.egress as a flat list of custom rules while moving CIDR-exclusion config to the new sibling field networkPolicy.egressExceptCidrs.

• StatefulSet serviceName revert — spec.serviceName is immutable in Kubernetes; both statefulset-postgresql.yaml and statefulset-copilot-postgres.yaml are restored to <name>-postgresql / <name>-copilot-postgresql with an explanatory comment.
• NetworkPolicy egress back-compat — networkPolicy.egress is a flat list again (matching pre-improvement(helm): helm chart updates with security, ESO, and docs overhaul #4565 shape), preventing silent drops of user-supplied egress rules; cloud-metadata CIDR blocking moves to networkPolicy.egressExceptCidrs.
• OTel Collector NetworkPolicy + startupProbe defaults — a new NetworkPolicy for the telemetry collector is added alongside startupProbe defaults for both Postgres instances to handle slow first-boot scenarios.

Confidence Score: 5/5

Safe to merge — all changes are targeted rollbacks of immutable-field renames and value-schema restructuring that would have broken existing installs.

The StatefulSet spec.serviceName revert is a straightforward correctness fix for an immutable Kubernetes field; no data or state is affected. The networkPolicy.egress shape change restores backward compatibility and is covered by the updated unit tests (51/51 pass). The only open item is a documentation gap in NOTES.txt for users who briefly ran the intermediate #4565 chart with customized egress.exceptCidrs — a narrow window with minimal real-world exposure given that #4565 targeted staging.

helm/sim/templates/NOTES.txt — the upgrade note could more explicitly guide users who customised networkPolicy.egress.exceptCidrs or networkPolicy.egress.extraRules on the short-lived intermediate chart.

Important Files Changed

Filename	Overview
helm/sim/templates/networkpolicy.yaml	Fixes egress field paths (extraRules→egress, exceptCidrs→egressExceptCidrs) and adds an OTel Collector NetworkPolicy; logic is correct and matches updated values schema.
helm/sim/templates/statefulset-postgresql.yaml	Reverts spec.serviceName to the original immutable value and adds conditional startupProbe support; fix is correct.
helm/sim/templates/statefulset-copilot-postgres.yaml	Same serviceName immutability fix as the main postgresql StatefulSet, plus startupProbe support.
helm/sim/values.yaml	Restructures networkPolicy egress to a flat list with sibling egressExceptCidrs; adds startupProbe defaults for both postgresql instances.
helm/sim/tests/networkpolicy_test.yaml	Replaces the combined extraRules test with split app/realtime assertions and adds the new telemetry collector render test; coverage is now adequate.
helm/sim/templates/NOTES.txt	Adds upgrade notes for ESO apiVersion flip and egress restructure, but misses explicit migration guidance for the egress.exceptCidrs/extraRules rename from the intermediate #4565 chart.
helm/sim/README.md	Updates production checklist to reference egressExceptCidrs and clarify that egress is now a list.
helm/sim/.claude/skills/sim-helm/references/values-model.md	Minor documentation consolidation; no functional impact.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    UP[helm upgrade] --> STS_CHECK{spec.serviceName\nimmutable check}
    STS_CHECK -- "was -headless\n(broke upgrade)" --> FAIL[❌ Forbidden error]
    STS_CHECK -- "reverted to -postgresql\n(this PR)" --> OK[✅ Upgrade succeeds]

    subgraph networkPolicy.egress shape
        OLD_MAP["#4565: egress:\n  exceptCidrs: [...]\n  extraRules: [...]"] -- "silent drop\nof user rules" --> BROKEN[❌ user egress lost]
        NEW_FLAT["This PR: egress: []\negressExceptCidrs: [...]"] --> COMPAT[✅ back-compat\nwith pre-1.0 shape]
    end

Loading

_{Reviews (2): Last reviewed commit: "docs(helm-skill): trim narrative bloat i..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 32f8ca4. Configure here.}