[robfrank]

Closes #62

Adds a real-pod check for arcadedb.plugins.gremlin.writePortToConfig (#58). ci/integration-test-gremlin.sh (make test-integration-gremlin) runs in a new integration-gremlin-port PR job, and against latest in the latest-image guard as integration-latest-gremlin-port. Both jobs go through integration-reusable.yml with a new gremlinPort input (0 = off). The job installs a single node with Gremlin on 8183 through writePortToConfig and runs the main suite. The Gremlin suite then checks four things on that port: config-seed ran with readOnlyRootFilesystem: true and logged config-seed: set port: 8183 in gremlin-server.yaml; gremlin-server.yaml on the config volume has the single line port: 8183; the plugin started and listens on 8183; another pod connects to test-arcadedb:8183 through the Service. After that, helm upgrade --reuse-values --set arcadedb.plugins.gremlin.port=8184 replaces the pod (its UID is checked) and the same checks run on 8184, plus a check that 8183 is no longer listening. The Gremlin plugin stays out of the HA runs, as the issue asked.

One difference from the suggested check: the server log does not name the Gremlin port. TinkerPop logs through SLF4J, which has no binding in the image (SLF4J: Defaulting to no-operation (NOP) logger), so "Channel started at port" is never printed. The suite checks the log for GremlinServerPlugin plugin started and reads the port from the pod's listening sockets (netstat -ltn) instead.

Test plan

• Local kind (macOS, arm64), installed with the job's values plus the memory workaround (ARCADEDB_OPTS_MEMORY=-Xms384M -Xmx768M): REPLICAS=1 make test-integration passes all 12 phases with Gremlin on, and GREMLIN_PORT=8183 make test-integration-gremlin passes all 4 phases (8183, then 8184 after the upgrade)
• Negative control: GREMLIN_PORT=8185 against a release on 8184 fails at [2/4a] with config-seed did not log 'config-seed: set port: 8185 in gremlin-server.yaml'
• Back-to-back runs: a probe pod still terminating from the last run is waited out (port 8184 then 8183, passes)
• Input guards: GREMLIN_PORT=70000 and GREMLIN_UPGRADE_PORT == GREMLIN_PORT are refused
• shellcheck ci/integration-test-gremlin.sh, actionlint .github/workflows/*.yml, make lint
• CI: integration-gremlin-port green (run 39942395696)

Coverage

Invariant: a Gremlin port the chart writes through writePortToConfig is the port the running plugin binds and that the Service reaches, on install and after an upgrade that changes it.

Entry point	Status
Fresh install: config-seed seeds the file, then writes port: under readOnlyRootFilesystem	fixed here, [2/4a] to [2/4d]
helm upgrade that changes the port: config-seed keeps the file on the PVC and rewrites port:, the pod rolls	fixed here, [3/4], [4/4a] to [4/4d]
Old port released after the move	fixed here, [4/4c]
Upcoming server release (the plugin reading its port only from gremlin-server.yaml)	fixed here, integration-latest-gremlin-port in latest-image.yml
NetworkPolicy opening the Gremlin port	not covered: argued. kind's default CNI (kindnet) does not enforce NetworkPolicy, so a kind run cannot tell an open policy from a closed one. The rendered policy is covered by helm-unittest (tests/gremlin_port_write_test.yaml)
Native flavor	not applicable: the render refuses Gremlin on image.flavor=native
portManagedExternally: true (#52), the other route to a non-default port	filed as #66

Known gaps: portManagedExternally on a real pod, tracked in #66. NetworkPolicy enforcement is argued above.

Adversarial pass

The separate reviewer subagent did not run: this session had no subagent tool. I reviewed the patch myself instead. That covers less, because I wrote the code. What I found:

• The issue expects the server log to show the port, but the log never prints it. This is now a deviation, stated above, and the suite checks listening sockets instead.
• kubectl logs ... | grep -q under pipefail failed on the first local run, because grep closed the pipe early and kubectl got SIGPIPE. Fixed in this branch: logs are read into a variable before grep.
• A probe pod still terminating from an earlier run made kubectl run fail with AlreadyExists. Fixed in this branch (fix(#62): wait out a probe pod ...).
• The other route to a non-default port, portManagedExternally, has no real-pod check. Filed as Integration test: boot Gremlin on a port set by the user's own gremlin-server.yaml (portManagedExternally, follow-up to #62) #66.

Review cycles

• cycle 1: 4951d1e - no review arrived within 15 minutes. This repo has no Claude Code Review workflow (gh run list --workflow "Claude Code Review" finds none), and no bot has commented on recent PRs (feat(#56): boot the explicit-token, single-node and >= 26.11.1 root-password-file routes in CI #65) either. Every CI check passed, including the new integration-gremlin-port (1m28s).

Deferred items

None. No review feedback came in.

Final state

timeout: no reviewer bot is configured on this repository. Merging is up to the developer.

🤖 Generated with Claude Code