bitflicker64 commented on PR #3449: URL: https://github.com/apache/hugegraph/pull/3449#issuecomment-6611306324
## Review summary: R1 (FULL), head `6524cc14` **Verdict: the direction is right, but two items need follow-up before merge.** Keeping the master key next to H2 on `/hubble-data` does let a newly saved Text2GQL API key survive restarts and Pod replacement when persistence is enabled. Two cases still lose access to the key: - **[Important]** Non-root deployments that set `fsGroup`, as `values.yaml` recommends: kubelet adds group bits to the key file, and Hubble then rejects it. [Inline thread](https://github.com/apache/hugegraph/pull/3449#discussion_r4458407777) - **[Important]** Existing releases: after the upgrade the API key must be re-entered once, and the PR doesn't document this. [Inline thread](https://github.com/apache/hugegraph/pull/3449#discussion_r4458407791) - **[Minor]** The PR description says each Pod replacement generates a new master key. In fact Hubble creates a key lazily, on the next save. A replaced Pod has no key at all, so decrypting fails until the API key is saved again. Without persistence (`emptyDir`), the H2 data and the key are both lost on Pod replacement, as expected. **Score: 5.8 / 10** (provisional, 2 of 4 reviews in). | Reviewer | Raw | Corrections | Adjusted | |---|---|---|---| | Reviewer A (gpt-6.1-terra) | 6.0 | none | 6.0 | | Reviewer B (model not reported) | 5.5 | none | 5.5 | **Checks:** both reviewers checked the property name, default, path resolution, key creation and the 0600 permission rule against the Hubble source. The `fsGroup` result is based on reading the source. It was not tested on a real cluster. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
