[robfrank]

Closes #49

On image.flavor=native the config-seed init container was skipped, because the native image has no shell. The config volume then hid the image's /home/arcadedb/config, and the server started with its built-in groups, which have no readonly group. This PR takes the third option from the issue: on the native flavor, config-seed runs the JVM image of the same version, using the server tag without its -native suffix (26.10.2-native becomes 26.10.2, latest-native becomes latest). Both images take config/ from package/src/main/config with the same include set, and both run as 1000:1000 (see native/src/main/docker/Dockerfile.native.* and package/src/main/docker/Dockerfile in the core repo). The cost is one more image pull per node. The new initContainers.configSeed.image.{registry,repository,tag} values (empty = derived) override the seed image on either flavor. If image.tag does not end in -native and no tag override is set, the render fails with an actionable message instead of skipping the seed without a word.

Changes

• _helpers.tpl: new arcadedb.configSeed.image helper. arcadedb.configSeed.container is no longer gated on not native.
• values.yaml / README.md: document initContainers.configSeed.image.* and the native behaviour.
• tests/config_seed_test.yaml: 10 new native/override cases.
• ci/integration-test.sh phase 11, native branch: checks that config-seed is present and does not run a -native image, and that its log reports server-groups.json as seeded or kept. It also checks that GET /api/v1/server/groups returns a readonly group, so the server really loaded the seeded file (kubectl exec is not possible on native).

Existing test changed: config_seed_test.yaml "is skipped on the native image, which has no shell" asserted the behaviour this issue reports as the bug. It is replaced by "seeds the config volume on the native image from the JVM image of the same version". No other existing test was touched.

Test plan

• helm unittest charts/arcadedb: 349 passed (was 340; −1 replaced, +10 new). The new cases failed (9 of 10) before the template change.
• helm lint charts/arcadedb --set image.flavor=native
• Local kind run, native flavor, 3 replicas (IMAGE_FLAVOR=native bash ci/integration-test.sh): all 11 phases pass, exit 0. The config-seed log shows seeded server-groups.json, and phase 11 confirms the readonly group through the API.
• Red check: a fresh native install of the origin/main chart on the same cluster returns groups ["*","admin"] (no readonly) from /api/v1/server/groups.
• CI CI - Lint, Unit Tests, Integration Tests on 96e86cb: all 5 checks pass, integration-native among them
• integration-latest-native (weekly guard; latest-native → seed image latest) has not run on this branch

Completeness

Invariant: whenever initContainers.configSeed.enabled is on and a volumeMounts entry holds arcadedb.configDirectory, the pod runs a config-seed container whose image has a shell, on either flavor.

grep -rn 'include "arcadedb.native"' charts/ after the change:

templates/NOTES.txt:44            (extraEnvironment warning, unrelated)
templates/_helpers.tpl:84         (server image tag)
templates/_helpers.tpl:141        (plugin validation)
templates/_helpers.tpl:732        (new: seed image derivation)
templates/statefulset.yaml:3      (server command/env)

No native gate on the seed container is left. grep -rn "configSeed\|config-seed" charts/arcadedb/templates shows that the only image reference for config-seed is the new helper.

Entry point	Status
native, default tag (<appVersion>-native)	fixed here, unit + kind test
native, explicit *-native tag (e.g. latest-native)	fixed here, unit test
native, custom registry/repository/pullPolicy	fixed here, unit test
native, tag without -native	render fails with guidance; configSeed.image.tag override, unit tests
native, configSeed.enabled=false	skipped, unit test
native, --reuse-values without configSeed key	seeds, unit test
native, relocated configDirectory under a parent mount	fixed here, unit test
jvm flavor	unchanged output (existing tests pass), plus override test
integration phase 11 (native)	fixed here, verified on kind

Known gaps

None filed. Residual risk, argued: an existing native release whose config PVC already holds a server-groups.json (the server writes its built-in default to disk at first start) keeps that file, because config-seed never overwrites. The README's "Existing installs" paragraph under Default config files already covers this case (edit the file or delete it and restart), and it applies to both flavors.

Adversarial pass

The Phase 1.5 independent-reviewer subagent could not be spawned: no subagent tool was available in this run. In its place the author did a self-check against the issue's acceptance criteria. That check found one real defect, fixed here before the PR opened: the first version of the native phase 11 reset PF_PID="", so the EXIT trap's [[ -n ... ]] returned 1 and the script exited 1 after "All checks passed". The phase now uses the same pf_start/pf_stop pattern as the other phases, and the rerun exits 0.

Review cycles

• cycle 1: 96e86cb. No claude review arrived within 15 minutes, on any surface (reviews, inline comments, issue comments). This repo has no Claude Code Review workflow (gh workflow list shows only Integration, Latest Image Guard, CI, Release, Dependabot and pages), so a bot review will not come on its own.

Deferred items

None.

Final state

timeout: no automated reviewer is configured on this repo. CI is green. A human review is needed; merging is up to the maintainer.

🤖 Generated with Claude Code