bitflicker64 commented on PR #3189: URL: https://github.com/apache/hugegraph/pull/3189#issuecomment-5550447338
Tested end to end on Kubernetes through the Helm chart on 2026-09-05. **Build under test.** Tag [`helm-dev-20260905`](https://github.com/hugegraph/hugegraph/releases/tag/helm-dev-20260905), commit `6ec19838`: apache master `36811483` plus this PR at `e964b680`, #3185 and #3187. PD, Store and Server images built from that tree with `docker buildx bake -f docker/bake.hcl pd store server-hstore` (linux/amd64), `org.opencontainers.image.revision=6ec1983889f58a52995b27a4e1ea89bd00932396` read back from every pod. kind, Kubernetes 1.37.0, 3 PD + 3 Store + 3 Server + Hubble, auth on. The chart side is apache/hugegraph#3132 at `0a50f6fe`: a kept release Secret holding `auth.secret-key`, handed to PD as `HG_PD_AUTH_SECRET_KEY`, to the Server storage wait as `PD_AUTH_PASSWORD`, and written into Hubble's properties as `operations.pd.password`. - Rollout: a running cluster on images from the same tree minus this PR was upgraded to these images in 175 s. All three PDs started with the secret; every Server's `wait-storage.sh` logged `Store registration check PASSED` and `Storage backend is VIABLE` with no 401; 0 `Blocked connection` and 0 `Could not resolve allowlist entry` lines; data written before the roll readable after it; `helm test` passed. - Credential matrix, 57 requests against `/v1/members`, `/v1/stores` and `/v1/allInfo` through the PD client Service: no header, empty password, wrong password, and `admin` or `nobody` with any password all answered `401 {"status":-1,"error":"Unauthorized"}` with `WWW-Authenticate: Basic realm="hugegraph-pd"`; `hg`, `store`, `hubble` and `vermeer` with the release secret answered 200 with the real payload. `/v1/health`, `/v1/ready`, `/actuator/health` and `/actuator/prometheus` stayed open without a credential. - Control: the same 57 requests against the pre-#3189 images reproduced the old behaviour, 200 for every outcome and any password accepted for the four names. - Hubble, not restarted across the roll, listed 3 PD, 3 STORE and 3 SERVER, all UP, with the `operations.pd.password` it had from install, so its PD calls carry the credential on this image. Merge notes for whoever lands the second of #3185 and this PR: `AuthenticationConfigurer` needs both changes in one exclusion list, `"/actuator/**", "/v1/health", "/v1/ready", "/v1/prom/targets/*"`; and `docker/test-compose.sh` keeps #3187's timeout asserts followed by `hubble_password_helper_check`, with `HG_PD_AUTH_SECRET_KEY="${PD_SECRET}"` added to `render_with_timeout`. That is how the tag resolves them. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
