[robfrank]

Closes #58

Summary

The Gremlin plugin reads its port only from gremlin-server.yaml, and core still has no setting the chart can pass instead (checked on ArcadeData/arcadedb main at 4ffa8ca240: GlobalConfiguration has arcadedb.gremlin.client.port for the remote client, nothing for the server). This takes option 2 of the issue: the new opt-in arcadedb.plugins.gremlin.writePortToConfig: true makes the config-seed init container set the top-level port: key of gremlin-server.yaml on the config volume to arcadedb.plugins.gremlin.port on every pod start (env GREMLIN_PORT). Every other line of the file is kept; the key is added when the file has none; a duplicate or quoted port key collapses into one line. The server, the Services and the NetworkPolicy then follow one value, and a helm upgrade that changes it rolls the pods because the init container's env changes. portManagedExternally (#52) stays for operators who own the file themselves; the two cannot be combined.

The config-seed shell script moves from an inline block in _helpers.tpl to charts/arcadedb/files/config-seed.sh (rendered with .Files.Get, same text plus the new block), so ci/test-config-seed.sh can run the real script against sample files. It runs as make test-config-seed and in the lint workflow.

Test plan

• make lint
• make test-unit: 389 tests, new suite tests/gremlin_port_write_test.yaml (16 tests), refusal message of arcadedb.plugins.gremlin.port renders -Darcadedb.gremlin.port, which the server never reads #47 updated in gremlin_port_test.yaml / gremlin_port_external_test.yaml to point at the new setting
• make test-config-seed: the script under sh and dash: default seeding unchanged byte for byte, port appended on a fresh volume, nested port: left alone, idempotent re-run, port replaced on change, operator file edited in place, untouched without GREMLIN_PORT, quoted/spaced/duplicate keys, missing trailing newline, file absent everywhere, portable:/ports: not mistaken for port:, no temp file left. Mutation check: breaking the replace logic fails 8 checks.
• helm package includes files/config-seed.sh
• Real pod on kind with Gremlin on 8183: not run here, tracked in Integration test: boot Gremlin on a non-default port via writePortToConfig (follow-up to #58) #62

Coverage

Invariant: with writePortToConfig: true, the port the server's Gremlin plugin binds equals arcadedb.plugins.gremlin.port, which is also what every Service and the NetworkPolicy expose; and when the chart cannot guarantee that, the render fails.

$ grep -rn '_arcadedb.plugin.ports\|arcadedb.gremlin.configPort\|arcadedb.configSeed.container' charts/arcadedb/templates
_helpers.tpl:140  define "_arcadedb.plugin.ports"            (validation; Services + NetworkPolicy read it)
_helpers.tpl:186  include "arcadedb.gremlin.configPort" $    (refusals fire on every render)
_helpers.tpl:230  arcadedb.plugin.parameters  <- plugin.ports (StatefulSet command; no gremlin -D, #47)
_helpers.tpl:278  arcadedb.plugin.service     <- plugin.ports (service.yaml:55 headless, :86 external)
_helpers.tpl:293  arcadedb.plugin.networkPolicy <- plugin.ports (networkpolicy.yaml:22)
_helpers.tpl:555  include "arcadedb.configSeed.container"   (StatefulSet initContainers)
_helpers.tpl:831  configSeed.container -> env GREMLIN_PORT from arcadedb.gremlin.configPort
$ grep -rn 'containerPort' charts/arcadedb/templates/*.yaml   -> http / https / rpc only; no plugin containerPort to keep in step

Entry point	Covered by fix?	Covered by a test?
Server bind: config-seed writes port: (fresh volume, existing file, re-run, port change)	yes	ci/test-config-seed.sh
StatefulSet: init container gets GREMLIN_PORT (set / unset / string / default 8182 / relocated config dir / --reuse-values without configSeed key)	yes	gremlin_port_write_test.yaml
Headless Service, external Service, NetworkPolicy expose the written port	yes	gremlin_port_write_test.yaml
Default and portManagedExternally paths pass no GREMLIN_PORT (operator file untouched)	yes	gremlin_port_write_test.yaml + script case 5
config-seed disabled	refused at render	yes
No volume holds configDirectory (with readOnlyRootFilesystem: false; with it on, configDirectory.validate already refuses)	refused at render	yes
gremlin-server.yaml mounted on its own from another volume (ConfigMap subPath)	refused at render	yes
writePortToConfig + portManagedExternally	refused at render	yes
Native flavor	gremlin already refused there	existing native test
Real pod: image sh runs the script under readOnlyRootFilesystem, plugin binds the port	filed	#62

Known gaps

• End-to-end kind check of a non-default Gremlin port: Integration test: boot Gremlin on a non-default port via writePortToConfig (follow-up to #58) #62.
• Core option 1 (a GlobalConfiguration server-port setting applied after the yaml) was not pursued: it lives in ArcadeData/arcadedb. If it lands, this setting and the 8182 check can go.

Residual risk

• A top-level port: whose value sits on the next, indented line (block scalar style) would leave that line behind. Nothing in the image or the TinkerPop docs writes it that way.
• Turning writePortToConfig off again leaves the last written port: in the file (documented in the README: set it back by hand, or keep the value with portManagedExternally).
• Only the first YAML document of a multi-document file is meant; the plugin reads only one.

Adversarial pass

Phase 1.5 could not run: this session has no subagent tool, so no independent reviewer was spawned. The cases it would have probed were checked by hand and are in the table above (file mounted separately, seed disabled, no config volume, re-run, port change, quoting/prefix keys). The one finding from that self-check that could not be closed here is the missing real-pod test, filed as #62.

Review cycles

• cycle 1: cccc3f0: initial change. No claude bot review arrived within 15 minutes (reviews, inline comments and PR comments polled). This repository has no Claude Code Review workflow (gh workflow list: Integration, Latest Image Guard, CI, Release, Dependabot, pages), and feat(#52): allow a Gremlin port other than 8182 when gremlin-server.yaml sets it #60/fix(#59): check failedTemplate messages exactly and guard against unchecked assertions #61 got no bot review either. CI on cccc3f0: lint, unittest, config-keys and the three integration jobs all pass.

Deferred items

None (no review feedback received).

Final state

timeout: no automated reviewer is configured here, so a human review is needed before merge.

🤖 Generated with Claude Code