bitflicker64 commented on code in PR #3449:
URL: https://github.com/apache/hugegraph/pull/3449#discussion_r4459423918
##########
helm/hugegraph/templates/hubble-deployment.yaml:
##########
@@ -286,6 +296,8 @@ spec:
value: {{ if $vermeerEnabled }}{{ printf "http://%s:%v"; (include
"hugegraph.vermeer.masterName" .) .Values.vermeer.master.httpPort | quote }}{{
else }}""{{ end }}
- name: HG_HUBBLE_VERMEER_TOKEN_FILE
value: {{ if $vermeerEnabled
}}"/var/run/hugegraph/vermeer/token"{{ else }}""{{ end }}
+ - name: HG_HUBBLE_TEXT2GQL_MASTER_KEY_FILE
+ value: "/hubble-data/text2gql-master.key"
Review Comment:
Addressed in `857dd12c`. When the Hubble user owns the key file, the startup
wrapper now restores it to `0600` before Hubble starts. It skips symlinks and
an environment-supplied key, and the new wrapper tests cover repeated
permission widening. Verified by reading the code and the tests. It was not
exercised on a live cluster or CSI driver. A related follow-up, for the case
where the file is owned by a different UID, is in a new R2 thread. This thread
can be resolved.
##########
helm/hugegraph/templates/hubble-deployment.yaml:
##########
@@ -267,6 +272,11 @@ spec:
if [[ "${FOUND_SERVER_HOST}" == false ]]; then
printf 'server.host=0.0.0.0\n' >>"${TMP}"
fi
+ # The image default (data/text2gql-master.key, relative to
/hubble)
+ # is outside the data volume; keep the key next to the H2
database.
Review Comment:
Addressed in `857dd12c`. The new section
`docs/operations.md#hubble-text2gql-credentials`, linked from the README and
`values.yaml`, documents the one-time re-entry, why H2 still shows a saved key,
lazy key creation, backup alongside H2, the `emptyDir` limit and the
`HUBBLE_TEXT2GQL_MASTER_KEY` alternative. This thread can be resolved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
