bitflicker64 commented on PR #3149: URL: https://github.com/apache/hugegraph/pull/3149#issuecomment-5431096561
Pushed `d2a12bc1`. Commit-by-commit, since this branch has grown a lot since the last review. **`0d1e67ba`: back to authenticated by default.** The two commits before it had made the 3-node cluster anonymous. Reverted on top rather than rewritten, so every thread here keeps its anchor. Anonymous is still supported, as an explicit opt-in rather than the default. **`c3115579`: the four blocking findings.** Images pull by default and readiness proves the running image enforces auth, so a cached older image cannot look healthy while serving the graph APIs open. PD, Store and Server ports bind to loopback, widened only through `HUGEGRAPH_CONTROL_PLANE_HOST` / `HUGEGRAPH_SERVER_PUBLISH_HOST`. And a live smoke job replaces the render-only checks. **`10c6c6b5`: corrections the smoke job found in itself.** Running it against a real cluster showed two of its own assertions were wrong: `/v1/cluster` returns PD peers, not graph servers, so the registration check could never pass; and the persistence check passed even when the two flows used different volumes. Now it asserts three PD peers and three Stores `Up`, and proves shared state by writing a marker through one flow and reading it back through the other. **`7ea0efe2`: the port reference contradicted the code.** It still said cluster ports bind every interface after they had moved to loopback. Also, the documented no-auth placeholder token was long enough to pass validation, so copying those two lines into `docker/.env` would produce a cluster that looked authenticated while signing tokens with a key printed in this repo. The placeholder is now deliberately too short for the Server to accept. **`6b6c3a3c`: the no-auth override only disabled auth on one Server.** The three services shared a YAML anchor, and `!reset` does not survive an alias on every Compose version: on 5.1.2 only `server0` lost its credentials, so the cluster came up half authenticated, while 5.1.4 reset all three. The healthcheck override propagated either way, which is what hid it. Spelled out per service. **`96160375`: the seams around the contract.** Chiefly: `HG_SERVER_REST_URL` becomes `restserver.url`, which is the *bind* address, so the advertised-address option crash-looped a replica on `java.net.BindException`; those variables are gone and the limitation is documented. Readiness no longer pins to the seeded admin password, which would have bricked every replica after a password rotation. Hubble's volumes became `external`, because Compose deletes a fixed-name volume on `down -v` from any project declaring the name, so leaving one flow destroyed the other's database. Plus the offline pull escape hatch, the no-auth flow's missing network and teardown, a dotenv reader that returned an empty password for malformed values, and a verification block whose `exit 1` closed the operator's shell. **`05715714`: a claim that covered files it did not.** The version-pinning paragraph promised an image ignoring `PASSWORD` never reports healthy across three Compose files. Only the cluster has that check; the single-node files probe `/versions`, which stays open either way. **`d2a12bc1`: your latest finding.** Making the volumes external fixed data loss but broke the flow that needs them most: `external volume "hugegraph-hubble-upload-files" not found`. The attach section now creates both first, honouring `HUBBLE_DB_VOLUME` and `HUBBLE_UPLOAD_VOLUME`, inspect-then-create so it is safe to repeat. Reproduced the failure and confirmed the fix against a running cluster. Everything above was verified by running it, not by reading. On the current head: ten containers healthy, 401 unauthenticated and 200 authenticated on all three replicas, wrong password 401, three PD peers and three Stores `Up`, the H2 database inside its mount, Hubble attaching without recreating a cluster container, and shared state surviving the teardown that used to destroy it. One note on CI: `docker-build (Dockerfile-hstore)` is red, and it is a Maven build inside that Dockerfile. This branch changes no Java, no pom and no Dockerfile, and the same job passes on current master, so I believe it is unrelated to this diff. This push re-runs it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
