bitflicker64 opened a new pull request, #3260: URL: https://github.com/apache/hugegraph/pull/3260
## Purpose of the PR - Companion to #3218 (the Helm chart). No issue of its own. The chart carries guards, probe derivations and runbook steps that compensate for server-side behavior rather than Kubernetes concerns. Each of those workarounds should disappear when the server behavior is fixed, and the only way a later change at the server site learns that is a comment at that site. This PR leaves one TODO per site, stating what is wrong or missing, what the proper fix does, and which chart guard is removed afterwards, linking the tracking issue where one exists. ## Main Changes Comments only, 13 sites, no behavior change: | Site | Server behavior | Chart workaround that goes once fixed | Issue | |---|---|---|---| | `AuthenticationFilter.java` (Basic decode) | credential decoded as ASCII and split on every colon: a non-ASCII password answers 401, a password with `:` answers 400, both accepted at account creation | schema pattern and Server wrapper refuse such admin passwords | none yet; measured on `:latest` 2026-10-03 | | `AuthenticationFilter.java` (`FIXED_WHITE_API_SET`) | no unauthenticated `/readiness` until #3221 lands | `server.readinessPath` defaults to `/versions`, `/readiness` is opt-in | #3212 | | `GraphManager.loadGraph` | a loaded graph is never offered to Gremlin Server after one failed static instantiation | per-Pod Gremlin query in `helm test`, documented Pod deletion | #3228 | | `StoreAPI.checkHealthy` | `/v1/health` stays 200 in `STATE_ERROR` and with an unopened KV store | single-PD startup and liveness derived to `/v1/ready` | #3222, #3226 | | `RaftStateMachine.onLeaderStop` | overwrites `STATE_ERROR` with `STATE_FOLLOWER` | same | #3222 | | `StoreNodeService` (registration) | a re-registering Store is marked `Up` before its partition engines are restored | Store rollouts on `OnDelete` with a manual `/v1/shardGroups` barrier | #3229 | | `HgStoreEngine.restoreLocalPartitionEngine` | restore outcome only logged | same | #3229 | | `HgKVStoreImpl.init` | a held RocksDB `LOCK` leaves PD running uninitialized; nothing restarts it | README limitation | #3226 | | `TaskAPI.balanceLeaders` | a follower answers an empty success; a run and a no-op look the same | README task sequence and spacing | #3231 part 2 | | `StandardAuthManager.invalidatePasswordCache` | password and token caches invalidated on one replica only | README limitation on admin password rotation | none | | `ServerOptions.ADMIN_PA` | the initial admin password passes through a properties file (trimmed, backslash-unescaped, ISO-8859-1) | schema and wrapper refuse padded, backslash and non-ASCII values | none | | `docker-entrypoint.sh` (env mapping) | `server.urls_to_pd`, `server.deploy_in_k8s`, `auth.admin_pa` have no environment mapping | the chart rewrites `rest-server.properties` in a wrapper and refuses `readOnlyRootFilesystem` for Server | none | | `application-pd.yml` (`rocksdb.total_memory_size`) | 32 GB pinned, not overridable | cluster preset sized around it, README note | none | Two Hubble-side workarounds (the Hubble properties parser and the missing environment mapping for `operations.pd.password`) belong to hugegraph-toolchain and are not in this PR. ## Verifying these changes - [x] Trivial rework / code cleanup without any test coverage. (No Need) Comments only. Lines stay within 100 characters. ## Does this PR potentially affect the following parts? - [ ] Dependencies - [ ] Modify configurations - [ ] The public API - [ ] Other affects - [x] Nope ## Documentation Status - [ ] `Doc - TODO` - [ ] `Doc - Done` - [x] `Doc - No Need` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
