imbajin commented on code in PR #528: URL: https://github.com/apache/hugegraph-doc/pull/528#discussion_r4303625987
########## content/en/docs/clients/restful-api/other.md: ########## @@ -273,29 +273,126 @@ PUT http://localhost:8080/whiteiplist?status=true #### 11.1.6 Start the Arthas agent -Attaches the [Arthas](https://arthas.aliyun.com/en/) agent to the running server process for diagnosis. The ports, the bind IP and the disabled commands are taken from the `arthas.telnetPort`, `arthas.httpPort`, `arthas.ip` and `arthas.disabledCommands` options, see [Config Options](/docs/config/config-option/). +Starting with HugeGraph 1.8.0, Server and Store bundle Arthas 4.1.5 (PD does not embed an Arthas agent). +You can attach it to a running JVM for live troubleshooting via the local script or the administrator HTTP endpoint. + +> [!IMPORTANT] +> **Diagnostic Access** +> - **Local by Default**: Arthas defaults to `127.0.0.1`. Administrators may explicitly bind another valid address, including `0.0.0.0`. +> - **Native Authentication Recommended**: Enable Arthas native authentication, especially before exposing diagnostic ports beyond loopback. +> HugeGraph administrator authentication protects activation only. Without Arthas authentication, any network-reachable client can execute commands, +> including other OS users or containers in the same pod. Administrators control firewall rules, port mappings, and forwarding access. Review Comment: Updated in 8eb0af1 and 0c0e410: Clarified across all four pages that native credentials do not stop clients from `127.0.0.1` unless `-Darthas.localConnectionNonAuth=false` is set on the service JVM (restart required), and restored the recommendation to limit host, Pod and port-forward access to trusted operators. ########## content/en/docs/config/config-option.md: ########## @@ -327,14 +327,23 @@ Basic Config Options and Backend Config Options correspond to configuration file > | k8s.internal_algorithm_image_url | Empty | Image URL for built-in > Kubernetes algorithms. | > [!DETAILS]- **Arthas Diagnostic Config Options (Optional)** -> Corresponding configuration file `rest-server.properties` +> Corresponding configuration file: `rest-server.properties`. +> Starting with HugeGraph 1.8.0. +> +> | Config option | Default value | Description | +> |---------------|---------------|-------------| +> | arthas.telnet_port | 8562 | Arthas telnet port for administrator activation through `PUT /arthas`. | +> | arthas.http_port | 8561 | Arthas HTTP port for administrator activation. | +> | arthas.ip | 127.0.0.1 | Bind address; administrators may explicitly select another valid address, including `0.0.0.0`. | Review Comment: Updated in 8eb0af1 and 0c0e410: Documented in `config-option.md`, `config-guide.md`, and `other.md` that API activation has no REST credential setting; native credentials on that path require setting `-Darthas.username=...` and `-Darthas.password=...` on the Server JVM with a restart. A specific non-loopback bind without native credentials has no login, wildcard binds generate a password, and the local helper `bin/arthas.sh` remains the recommended route for authenticated access beyond loopback without JVM restarts. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
