bitflicker64 commented on code in PR #3149: URL: https://github.com/apache/hugegraph/pull/3149#discussion_r3767870065
########## docker/hugegraph-hubble-3x3.properties: ########## @@ -0,0 +1,33 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +server.host=0.0.0.0 +server.port=8088 + +cluster=hg +idc=docker + +pd.enabled=true +# Bootstrap target; the live topology comes from PD discovery. If this +# replica is down when Hubble starts, point it at another server. +server.direct_url=http://server0:8080 Review Comment: Correction: addressed in 1b4f00890. The server.direct_url comment now says it is unused when pd.enabled=true and applies only to standalone pd.enabled=false mode. ########## .github/workflows/server-ci.yml: ########## @@ -138,6 +138,107 @@ jobs: check_compose docker/docker-compose.yml always always check_compose docker/docker-compose.dev.yml build missing + check_cluster_compose() { + local cluster="docker/docker-compose-3pd-3store-3server.yml" + local addon="docker/docker-compose-hubble.yml" + local rendered + rendered="$(mktemp)" + + # Both cluster credentials are required and may not be empty. + if HUGEGRAPH_AUTH_TOKEN_SECRET=ci-test-secret \ + env -u HUGEGRAPH_ADMIN_PASSWORD \ + docker compose -f "$cluster" config -q >/dev/null 2>&1; then + echo "$cluster accepted an unset admin password" >&2 + return 1 + fi + if HUGEGRAPH_ADMIN_PASSWORD= \ + HUGEGRAPH_AUTH_TOKEN_SECRET=ci-test-secret \ + docker compose -f "$cluster" config -q >/dev/null 2>&1; then + echo "$cluster accepted an empty admin password" >&2 + return 1 + fi + if HUGEGRAPH_ADMIN_PASSWORD=ci-test-password \ + env -u HUGEGRAPH_AUTH_TOKEN_SECRET \ + docker compose -f "$cluster" config -q >/dev/null 2>&1; then + echo "$cluster accepted an unset token secret" >&2 + return 1 + fi + if HUGEGRAPH_ADMIN_PASSWORD=ci-test-password \ + HUGEGRAPH_AUTH_TOKEN_SECRET= \ + docker compose -f "$cluster" config -q >/dev/null 2>&1; then + echo "$cluster accepted an empty token secret" >&2 + return 1 + fi + + # The add-on alone must define Hubble and nothing else, join the + # shared external network with its default name, and need no + # credentials or overrides. + env -u HUGEGRAPH_ADMIN_PASSWORD -u HUGEGRAPH_AUTH_TOKEN_SECRET \ + -u HUGEGRAPH_NETWORK -u HUGEGRAPH_VERSION \ + docker compose -f "$addon" config --format json > "$rendered" + jq -e ' + (.services | keys) == ["hubble"] and + .networks."hg-net".external == true and + .networks."hg-net".name == "hugegraph-net" and + (.services.hubble | has("depends_on") | not) and + any(.services.hubble.volumes[]; + .target == "/hubble/conf/hugegraph-hubble.properties" and + (.source | endswith("hugegraph-hubble-3x3.properties"))) + ' "$rendered" >/dev/null + + # The combined render carries the PD-registration and auth + # settings on every server replica and keeps Hubble on loopback. + # Rendered with non-default HUGEGRAPH_NETWORK/HUGEGRAPH_VERSION so + # CI fails if any file stops honoring the overrides (the add-on + # render above covers the defaults). + HUGEGRAPH_ADMIN_PASSWORD=ci-test-password \ + HUGEGRAPH_AUTH_TOKEN_SECRET=ci-test-secret \ Review Comment: Correction: addressed in commit 1b4f00890. The CI fixture is ci-test-token-secret-32-bytes-long (>=32 bytes), and the cluster render uses it for every Server replica. Guard tests run with --env-file /dev/null; the repository entrypoint test complements Compose validation. ########## docker/docker-compose-hubble.yml: ########## @@ -0,0 +1,47 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Hubble add-on for the distributed cluster defined in +# docker-compose-3pd-3store-3server.yml. Requires the pre-created cluster +# network (docker network create hugegraph-net). See "Hubble for the +# 3-Node Cluster" in docker/README.md for the attach and combined flows. + +networks: + hg-net: + external: true + name: ${HUGEGRAPH_NETWORK:-hugegraph-net} + +services: + hubble: + # Pin a release via HUGEGRAPH_VERSION in docker/.env; unset, the image + # tag defaults to latest. + image: ${HUBBLE_IMAGE:-hugegraph/hubble:${HUGEGRAPH_VERSION:-latest}} + pull_policy: ${HUBBLE_PULL_POLICY:-missing} + container_name: hg-hubble + hostname: hubble + restart: unless-stopped + networks: [hg-net] + ports: + - "${HUBBLE_PUBLISH_HOST:-127.0.0.1}:8088:8088" + volumes: + - ./hugegraph-hubble-3x3.properties:/hubble/conf/hugegraph-hubble.properties:ro Review Comment: Correction: addressed in 1b4f00890. The add-on mounts named volumes hg-hubble-db at /hubble/db and hg-hubble-upload-files at /hubble/upload-files; CI asserts both mounts and the README documents persistence across Hubble recreation. ########## docker/hugegraph-hubble-3x3.properties: ########## @@ -0,0 +1,33 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +server.host=0.0.0.0 +server.port=8088 + +cluster=hg +idc=docker + +pd.enabled=true +# Bootstrap target; the live topology comes from PD discovery. If this +# replica is down when Hubble starts, point it at another server. +server.direct_url=http://server0:8080 +pd.peers=pd0:8686,pd1:8686,pd2:8686 +# PD REST endpoint for the operations view (single address). +pd.server=pd0:8620 Review Comment: Correction: addressed as an explicit limitation in 1b4f00890. Hubble LiveOperationsCollector accepts one pd.server target for operations HTTP calls; pd.peers is discovery only, not HTTP failover. The docs now state that pd0 loss blinds operations and that operators must repoint pd.server. Automatic failover requires a separate Hubble code change. ########## docker/README.md: ########## @@ -168,14 +173,87 @@ To validate local images without Compose replacing them with remote `latest`: ## 3-Node Cluster Quickstart +The cluster and the Hubble add-on share one named Docker network so Hubble +can attach to a running cluster without touching it. Treat that network as a +trust boundary: PD and Store expose unauthenticated control APIs on it (only +the Server layer authenticates), and any container on the host can join it +by declaring the well-known name. One-time setup: write the required +credentials to a mode-600 `docker/.env` and create the network. +The cluster file requires both credentials — the admin password enables +authentication, and every Server replica must share one token secret so a +token issued by any server validates on all of them. The `:?` guards fire +on every Compose subcommand, including `down`. + +```bash +( + set -eu + cd docker + command -v openssl >/dev/null 2>&1 || { echo "openssl not found" >&2; exit 1; } + [ -e .env ] || install -m 600 /dev/null .env + chmod 600 .env + # Keep appends on their own lines even if the file was hand-edited. + [ ! -s .env ] || [ -z "$(tail -c1 .env)" ] || printf '\n' >> .env + pat='^[[:space:]]*(export[[:space:]]+)?' + if ! grep -Eq "${pat}HUGEGRAPH_ADMIN_PASSWORD=" .env; then Review Comment: Correction: addressed in 1b4f00890. The validator isolates unset and empty admin/token cases, checks that the error names the intended variable, and the setup block rejects existing empty or short credentials with a repair message. ########## docker/README.md: ########## @@ -205,6 +283,110 @@ curl http://localhost:8620/v1/partitions --- +## Hubble for the 3-Node Cluster + +`docker-compose-hubble.yml` defines only the Hubble service. It joins the +cluster's external network (`hugegraph-net` by default, override with +`HUGEGRAPH_NETWORK`) and has no `depends_on` on cluster services, so +starting, stopping, or upgrading Hubble never recreates or restarts PD, +Store, or Server containers. Hubble reads the cluster topology from +`hugegraph-hubble-3x3.properties`; adjust that file when attaching to a +cluster with different hostnames. + +Sign in at `http://localhost:8088` as `admin` with the +`HUGEGRAPH_ADMIN_PASSWORD` from `docker/.env`. Hubble binds to host +loopback by default (`HUBBLE_PUBLISH_HOST`, same caveats as the +single-node setup). + +The two flows below create Hubble in different Compose projects, so manage +Hubble with the same flags you started it with: the attach flow always uses +`-p hugegraph-hubble -f docker-compose-hubble.yml`, the combined flow always +uses both `-f` flags. The explicit `-p` keeps the attach project independent +of the directory name and of other Compose projects. + +Run one Hubble per host: the single-node stack and both add-on flows all +publish `127.0.0.1:8088` and name their container `hg-hubble`. The two +add-on flows are therefore mutually exclusive — starting one while the +other's Hubble exists fails with a container-name conflict, so `down` the +flow you are leaving before switching. + +### Attach to a running cluster + +With the 3-node cluster already up: + +```bash +cd docker +docker compose -p hugegraph-hubble -f docker-compose-hubble.yml up -d Review Comment: Correction: addressed in 1b4f00890. The README distinguishes attach from combined mode, explains that attach requires an existing cluster with the new PD-registration and auth settings, and documents the upgrade-first path for older clusters. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
