byteayan commented on code in PR #544: URL: https://github.com/apache/hugegraph-doc/pull/544#discussion_r4345666386
########## content/en/docs/quickstart/hugegraph/hugegraph-helm.md: ########## @@ -230,6 +230,22 @@ helm test hugegraph -n hugegraph --logs --timeout 5m Existing explicit helper images also remain under `--reuse-values`; add `--set-string store.waitImage= --set-string server.waitImage=` to reuse component images. Adopt new defaults deliberately with `--reset-values` and a reviewed file retaining your image, credential, storage and topology settings. + +PD, Store and Server images built from current master run as UID/GID `10001`, and the chart defaults `pd.podSecurityContext` and +`store.podSecurityContext` to `fsGroup: 10001` so they can write PVCs created by older images, which ran as root. `--reuse-values` keeps an existing +release's empty value, and the default `latest` tag with `pullPolicy: Always` can pull the new image on any Pod restart, so set it explicitly first: + +```bash +helm upgrade hugegraph "$CHART" --devel -n hugegraph --reuse-values \ + --set pd.podSecurityContext.fsGroup=10001 \ + --set pd.podSecurityContext.fsGroupChangePolicy=OnRootMismatch \ + --set store.podSecurityContext.fsGroup=10001 \ + --set store.podSecurityContext.fsGroupChangePolicy=OnRootMismatch \ + --wait --timeout 15m +``` + +If a Pod still reports `Permission denied`, set `fsGroupChangePolicy: Always` for one rollout or change the owner once with `chown -R 10001:10001`; +volumes whose CSI driver ignores `fsGroup` (for example many NFS drivers) and `hostPath` volumes need that `chown` too. Review Comment: Moved the non-root block below the lifecycle sentence in both EN and CN, so the `--reuse-values` paragraph is intact again (92e6d20). ########## content/en/docs/guides/hugegraph-docker-cluster.md: ########## @@ -317,6 +317,19 @@ Standalone publishes only `8080` and `8088`; minimal HStore publishes `8620` (PD 5. **Unexpected retained data**: `docker compose down` keeps named volumes. To delete topology data too, use `docker compose down -v`. +6. **`Permission denied` after upgrading to master-built images**: PD, Store and Server images built from current master run as the non-root user + `hugegraph`, UID/GID `10001`. Volumes written by older images, which ran as root, stay owned by root. Stop with `docker compose down` (not `down -v`), + change the owner of each data volume once, then start again: + + ```bash + docker run --rm -u 0 --entrypoint chown -v <volume>:/data <new-image> -R 10001:10001 /data + ``` + + Do not upgrade running containers with a plain `up -d`: Compose reattaches the anonymous volume holding the previous image's root-owned application + directory. Run `down` first, or use `up -d --renew-anon-volumes`. A host directory used as a bind mount must be writable by UID `10001`. On Kubernetes, Review Comment: Added `sudo chown -R 10001:10001 <dir>` for a host directory an older image wrote to, in both EN and CN (92e6d20). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
