bitflicker64 commented on code in PR #528: URL: https://github.com/apache/hugegraph-doc/pull/528#discussion_r4293564033
########## content/en/docs/clients/restful-api/other.md: ########## @@ -273,29 +273,75 @@ PUT http://localhost:8080/whiteiplist?status=true #### 11.1.6 Start the Arthas agent -Attaches the [Arthas](https://arthas.aliyun.com/en/) agent to the running server process for diagnosis. The ports, the bind IP and the disabled commands are taken from the `arthas.telnetPort`, `arthas.httpPort`, `arthas.ip` and `arthas.disabledCommands` options, see [Config Options](/docs/config/config-option/). +Starting with HugeGraph 1.8.0, Server and Store bundle Arthas 4.1.5 (PD does not embed an Arthas agent). +You can attach it to a running JVM for live troubleshooting via the local script or the administrator HTTP endpoint. + +> [!IMPORTANT] +> **Security Requirements for Diagnostics** +> - **Loopback Only**: Arthas defaults to `127.0.0.1` and accepts only loopback addresses. Non-loopback addresses (such as `0.0.0.0`) are rejected. Review Comment: Important: This callout covers how Arthas gets started (loopback bind, admin authentication, the service OS user for the attach), but not that the running agent has no authentication of its own. While it listens, its telnet port (and the HTTP port after `PUT /arthas`) runs commands for any process in the same network namespace, under any OS user, with no login. In Kubernetes that includes every container in the pod and anyone allowed to `kubectl port-forward` to it. It keeps listening after `quit` until someone runs `stop`, and Arthas executes code inside the JVM. Evidence: neither `ArthasAPI.startArthas()` nor `ArthasAttach.java` in #2945 sets `arthas.username` or `arthas.password`, and Arthas 4.1.5 requires login only when one of them is set. A plain `nc` session to the helper's port ran `version` with no prompt. Please add this to the EN and CN callouts: limit host and pod access to trusted operators and run `stop` when diagnosis ends. #2945 `docs/server-runtime.md` already carries this warning. ########## content/en/docs/config/config-option.md: ########## @@ -327,14 +327,23 @@ Basic Config Options and Backend Config Options correspond to configuration file > | k8s.internal_algorithm_image_url | Empty | Image URL for built-in > Kubernetes algorithms. | > [!DETAILS]- **Arthas Diagnostic Config Options (Optional)** -> Corresponding configuration file `rest-server.properties` +> Corresponding configuration file: `rest-server.properties`. +> Starting with HugeGraph 1.8.0. +> +> | Config option | Default value | Description | +> |---------------|---------------|-------------| +> | arthas.telnet_port | 8562 | Arthas telnet port for administrator activation through `PUT /arthas`. | +> | arthas.http_port | 8561 | Arthas HTTP port for administrator activation. | +> | arthas.ip | 127.0.0.1 | Loopback bind address; activation rejects non-loopback addresses. | +> | arthas.disabled_commands | jad | Disabled Arthas commands, separated by commas. | Review Comment: Minor: `arthas.disabled_commands` only applies to an agent started through `PUT /arthas`. `bin/arthas.sh`, which these pages recommend, writes its own properties file with `arthas.config.overrideAll=true` and no `disabledCommands`, so an agent the helper starts has every command enabled, `jad` included. The paragraph below says the helper works "without changing these settings", which reads as if the settings still apply to it. Evidence: with the #2945 helper at e090d9ed against a stub Server JVM, `bin/arthas.sh --command 'jad --source-only java.lang.Runnable'` printed the decompiled source. Please scope this row to `PUT /arthas` like the two port rows above it, for example "Disabled commands for administrator activation; the local helper does not apply them", here and in `content/cn/docs/config/config-option.md` line 336. ########## content/cn/docs/quickstart/hugegraph/hugegraph-hstore.md: ########## @@ -265,12 +265,20 @@ Store 使用无界队列处理 gRPC 回调，避免队列满时丢弃取消或 **诊断** -| 配置项 | 代码默认值 | 说明 | -|--------|------------|------| -| `arthas.telnetPort` | `8566` | 调用 `/v1/arthasstart` 后 Arthas 的 telnet 端口。 | -| `arthas.httpPort` | `8565` | Arthas HTTP 端口。 | -| `arthas.ip` | `0.0.0.0` | Arthas 监听地址。 | -| `arthas.disabledCommands` | `jad` | 需要禁用的 Arthas 命令。 | +自 HugeGraph 1.8.0 起，Server 和 Store 统一使用 Arthas 4.1.5，PD 未内置 Arthas 代理。Store 的 HTTP 激活接口 `GET /v1/arthasstart` 返回 `403`（包括 loopback 或代理请求）。 +推荐以服务进程所属的 OS 用户运行发行包内的脚本，即可直接诊断运行中的 JVM： + +```bash +bin/arthas.sh +``` + +脚本读取 `bin/pid`，需要 JDK 17，离线使用包内代理，无需重启服务或修改配置。 +新激活代理时，Telnet 固定监听 `127.0.0.1:3658`，HTTP 和 MCP 均禁用。同机多进程时可指定 `--pid <PID> --telnet-port 3659`。 Review Comment: Minor: `固定监听` says the port is fixed, but the next sentence passes `--telnet-port 3659` and the helper accepts any port; only the address is fixed. The CN `other.md` says `telnet 默认监听 127.0.0.1:3658`. Suggest `Telnet 默认监听 127.0.0.1:3658` here as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
