[robfrank]

Closes #56

The kind integration suite now boots every route the chart can take to hand the root password and the HA cluster token to the server. integration-reusable.yml gains a clusterTokenSecret input (it creates the Secret and sets arcadedb.credentials.clusterToken.secret.*) and a replicaCount input. ci/integration-test.sh takes CLUSTER_TOKEN_SECRET / CLUSTER_TOKEN_KEY / REPLICAS. It works out which token Secret the chart should mount (mirroring arcadedb.credentials.mountClusterToken), and phase 9's file branch checks for exactly that: when a token is expected, clusterTokenPath is present and the projected clusterToken file comes from the expected Secret/key. When none is expected, clusterTokenPath is absent. The env-var route must be unused in both cases. With REPLICAS=1 the Raft phases (3, 6, 7, 12) are skipped and pod-0 takes the writes.

New jobs:

• lint.yml / integration-cluster-token: HA, user root password Secret + user cluster token Secret, appVersion image.
• lint.yml / integration-single-node: replicaCount: 1.
• latest-image.yml / integration-root-password-file-snapshot: HA, user root password Secret, no token, 26.11.1-SNAPSHOT. The chart reads that tag as >= 26.11.1, so it mounts the password file only and the server derives the token from it (fix(#10462): HA derives its cluster token from rootPasswordPath, and the StatefulSet mounts its own token arcadedb#10479, merged 2026-10-21). Phase 12, a write through a follower, checks that the nodes derived matching tokens.

Finding ledger

#	Uncovered branch (from the issue)	Status
1	HA, user root password Secret + clusterToken.secret.name → two Secrets, both files	fixed here: integration-cluster-token (PR CI)
2	HA, user root password Secret, no token, image >= 26.11.1 → rootPasswordPath only	fixed here in the weekly guard (26.11.1-SNAPSHOT); running it on PRs against a pinned 26.11.1 is #64
3	single node → rootPasswordPath only	fixed here: integration-single-node (PR CI)

Test plan

• actionlint .github/workflows/*.yml clean; shellcheck -S warning ci/integration-test.sh clean (the two remaining SC2016 infos were already there)
• Rendered each route with helm template and ran phase 9's jq projected-volume lookup on it: generated → arcadedb-credentials-secret/clusterToken; explicit token → ct/clusterToken; single node and 26.11.1-SNAPSHOT + user Secret → no token file, no env var
• Ran the four scenarios locally on kind (pods at -Xmx768M). All 12 phases passed (or were skipped as intended) for each: single-node, cluster-token, snapshot-file (26.11.1-SNAPSHOT), default HA (regression)
• PR CI: integration, integration-native, integration-root-password-env, integration-cluster-token, integration-single-node green
• Latest-image guard dispatched on this branch (run 39819021544) green, including integration-root-password-file-snapshot

Coverage

Invariant: every route arcadedb.credentials.rootPasswordFromFile / mountClusterToken can choose is booted by at least one kind job.

Route (_helpers.tpl)	Job
HA, generated Secret → password + token files	integration, integration-native, latest guard (existing)
HA, user Secret, no token, < 26.11.1 → env var	integration-root-password-env (existing, #54)
HA, user Secret + user token → two files from two Secrets	integration-cluster-token (new)
HA, user Secret, no token, >= 26.11.1 → password file only	integration-root-password-file-snapshot (new, weekly guard)
single node → password file only	integration-single-node (new)
HA via autoscaling.enabled with replicaCount: 1	not booted: arcadedb.ha.enabled treats it the same as replicaCount > 1, so the route is identical to the rows above; helm-unittest covers the switch
HA, generated root password + user token Secret	not booted: the same mountClusterToken route as the explicit-token row, with a different Secret name for the password; helm-unittest covers the rendering

Known gaps

• The >= 26.11.1 route runs weekly against a rolling snapshot, not on PRs. Tracked in Pin the HA root-password-file integration job (user Secret, no token) to 26.11.1 and run it on PRs once released #64 (pin to 26.11.1 in lint.yml once it is released; README release-bump checklist step 4 says the same).

Adversarial pass

Not run as a separate subagent: this session had no subagent-spawning tool. I did a self-review instead:

• The snapshot job is not exercised by this PR's CI → real. I dispatched the guard workflow on this branch (run 39819021544), and the PR-CI gap is filed as Pin the HA root-password-file integration job (user Secret, no token) to 26.11.1 and run it on PRs once released #64.
• REPLICAS=1 with ROOT_PASSWORD_FROM=env or with a token Secret would assert a route the chart never takes → real, so the script refuses those combinations up front.
• Phase 9 could pass on the file route while the chart also exported the env var → real, so phase 9 now fails if arcadedb.server.rootPassword is in the pod env on the file route.

Review cycles

• cycle 1: f5c0c93, the initial change. No claude review arrived within 15 minutes. This repository has no Claude Code Review workflow (.github/workflows holds only integration-reusable, latest-image, lint and release), and earlier PRs such as feat(#52): allow a Gremlin port other than 8182 when gremlin-server.yaml sets it #60 got no bot review either, so no review will come.

Deferred items

None (no review feedback was received).

Final state

timeout: the automated reviewer never responded. All 8 PR checks are green, and the dispatched latest-image guard run is green too. The PR is ready for human review. Merging is the developer's call.

🤖 Generated with Claude Code