Repository navigation
Integration test does not boot HA with a user-supplied root password Secret on the file branches (explicit cluster token, image >= 26.11.1) #56
Description
Context
Follow-up from #54. The chart picks one of several routes for handing the root password and the HA cluster token to the server (arcadedb.credentials.rootPasswordFromFile and arcadedb.credentials.mountClusterToken in charts/arcadedb/templates/_helpers.tpl). After #54 the kind integration suite boots a 3-pod HA cluster on two of them:
| Branch | Booted in CI |
|---|---|
HA, generated arcadedb-credentials-secret → rootPasswordPath + clusterTokenPath |
yes (integration, integration-native, latest guard) |
HA, user root password Secret, no token, image < 26.11.1 → env var arcadedb.server.rootPassword |
yes (integration-root-password-env, #54) |
HA, user root password Secret and arcadedb.credentials.clusterToken.secret.name → rootPasswordPath + clusterTokenPath from two Secrets |
no |
HA, user root password Secret, no token, image >= 26.11.1 → rootPasswordPath only, token derived from the file |
no (no 26.11.1 image released yet) |
single node (replicaCount=1) → rootPasswordPath only |
no (the suite is HA-only) |
Gap
The three uncovered branches are checked only by helm-unittest (rendering). A server or chart change that broke one of them would not fail CI.
Possible fix
.github/workflows/integration-reusable.yml now takes rootPasswordSecret / rootPasswordFrom inputs and ci/integration-test.sh takes ROOT_PASSWORD_SECRET / ROOT_PASSWORD_KEY / ROOT_PASSWORD_FROM. Extending that with a clusterTokenSecret input covers the explicit-token row. The >= 26.11.1 row can reuse the #54 job with a released 26.11.1+ tag and rootPasswordFrom: file once that image exists (phase 9's file branch currently reads the token from arcadedb-credentials-secret and would need to skip the token check when none is mounted).
Why it was left out of #54
#54 asks for the pre-26.11.1 env-var fallback specifically; each further branch is another kind job, and one of them needs an image that is not published yet.
Activity
robfrank commentedon Oct 22, 2026
PR #65 boots the explicit-token and single-node routes on PR CI, and the >= 26.11.1 file route weekly in the latest-image guard against
26.11.1-SNAPSHOT. Moving that one to PR CI with a pinned 26.11.1 is tracked in #64.feat(#56): boot the explicit-token, single-node and >= 26.11.1 root-p…
robfrank commentedon Oct 23, 2026
Fixed in #65. CI now starts the credential setups that were only unit-tested. On every PR it runs HA with a user Secret plus an explicit cluster token, and a single node. Every week it runs HA with a user Secret on
26.11.1-SNAPSHOT(password file only). Each run checks which way the password and token reached the server, and single-node runs skip the Raft checks.Still open: the 26.11.1-or-later setup runs weekly against a moving snapshot, not on PRs. Once 26.11.1 is released it should be pinned to it and run on PRs. Tracked in #64.
❤️ Thanks for helping make ArcadeDB better! ArcadeDB is free and open source, sustained by its community. If it's useful to you or your company, please consider becoming a sponsor to keep development going.