bitflicker64 commented on code in PR #3119:
URL: https://github.com/apache/hugegraph/pull/3119#discussion_r3653419683
##########
hugegraph-server/hugegraph-dist/src/main/java/org/apache/hugegraph/cmd/InitStore.java:
##########
@@ -74,6 +74,20 @@ public static void main(String[] args) throws Exception {
RegisterUtil.registerServer();
HugeConfig restServerConfig = new HugeConfig(restConf);
+
+ // Skip local init only when the flag is *explicitly* false (Helm /
+ // HStore). Unset keeps master behavior: full standalone init-store.
+ // ServerOptions default is false for GraphManager; we do not treat
+ // "missing key" as skip so existing tarball users are not broken.
+ if (shouldSkipLocalInit(restServerConfig)) {
+ LOG.warn("Skipping init-store: '{}' is false in {}. "
+ + "Unset the property (or set true) to run local "
+ + "backend/admin init; distributed/Helm sets false.",
+ ServerOptions.GRAPH_LOAD_FROM_LOCAL_CONFIG.name(),
+ restConf);
+ return;
Review Comment:
Fixed in 69ac25e1.
I took the "map the configuration combination" option rather than preserving
the bootstrap, because `initAdminUserIfNeeded()` calls `setup()`, which scans
the graphs directory and opens the auth graph store locally — that is the work
the skip exists to avoid.
So in skip mode the entrypoint writes `PASSWORD` to `auth.admin_pa` instead
of piping it into `init-store.sh`, and the server creates the admin from that
on startup. It also no longer writes `docker/init_complete`, since nothing was
initialized and a later run with init-store enabled must still be able to
perform the real initialization.
`PASSWORD` together with skip is covered in
`hugegraph-server/hugegraph-dist/docker/test/test-docker-entrypoint.sh`, which
asserts the password reaches `auth.admin_pa` and never reaches `init-store.sh`
stdin.
Two caveats I documented rather than fixed, both pre-existing properties of
`auth.admin_pa`:
- it only applies when the admin account is first created, so changing
`PASSWORD` on a later restart silently keeps the old one, without an error;
- it leaves the password at rest in `rest-server.properties`, whereas the
enabled path only passes it over stdin.
Both are noted at the line that causes them and in `docker/README.md`. Happy
to take them on here if you would rather they were fixed than documented.
To be explicit about the limit of the testing: the smoke tests prove the
entrypoint wiring, not that the server then creates a working admin from
`auth.admin_pa` under PD. I have not run the 3pd-3store cluster to confirm that
end to end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
