[robfrank]

Closes #66

Adds a real-pod check for the second route to a non-default Gremlin port, arcadedb.plugins.gremlin.portManagedExternally: true (#52). Until now it had only helm-unittest coverage. The new job integration-gremlin-port-external installs a single node with the plugin on 8185 and runs ci/integration-test-gremlin-external.sh. The script covers both ways a user's own gremlin-server.yaml can reach the server. First it writes the file on the config volume and restarts the pod. Then it uses helm upgrade to mount a second file, with port: 8186, from a ConfigMap on <configDirectory>/gremlin-server.yaml. On each route it checks that config-seed logs keeping existing gremlin-server.yaml with no set port: line and no GREMLIN_PORT env, that the plugin listens on the file's port and not the previous one, and that a TCP connect through the Service succeeds. On the volume route it also checks that the file is unchanged byte for byte. The latest-image guard gets the same job as integration-latest-gremlin-port-external. The helpers shared with the #62 suite (retry, listening, service_connect, the probe pod, and so on) move to ci/gremlin-lib.sh. The reusable workflow gains a gremlinPortRoute input (write | external, default write, so existing jobs are unchanged).

Test plan

• shellcheck -x on ci/gremlin-lib.sh, ci/integration-test-gremlin.sh, ci/integration-test-gremlin-external.sh: clean
• actionlint .github/workflows/*.yml: clean
• make lint: passes (chart untouched)
• Local kind (jvm, 1 replica, portManagedExternally, port 8185): make test-integration-gremlin-external passes all of phases 1-4
• Local kind regression for the refactor: make test-integration-gremlin on a writePortToConfig release with port 8183 still passes (8183 then 8184)
• Negative control: the new suite run against a writePortToConfig release on 8185 fails in phase 1 (nothing listens on 8182), so it does detect the chart moving the port
• CI: integration-gremlin-port-external and integration-gremlin-port green

Coverage

Invariant: with portManagedExternally: true, the Gremlin plugin binds the port that the user's own gremlin-server.yaml sets. config-seed never edits that file, and the Service reaches the port.

Entry point	Status
User file on the config volume (PVC), kept by config-seed across a restart	fixed here: phases 2-3
User file from a ConfigMap mounted on <configDirectory>/gremlin-server.yaml (the route the chart's own error message at _helpers.tpl:751 points to)	fixed here: phase 4 (helm upgrade)
Chart port alone does not move the plugin (stays on 8182 before the user file exists)	fixed here: phase 1
Upcoming image (latest)	fixed here: integration-latest-gremlin-port-external
Native flavor	not applicable: the chart refuses the Gremlin plugin on image.flavor=native (_helpers.tpl:152)
NetworkPolicy opening the port	argued: kind's default CNI (kindnet in kind v0.23) does not enforce NetworkPolicy, so a real-pod check would pass with or without the rule. It stays covered by tests/gremlin_port_external_test.yaml
External Service (service.external.enabled)	argued: it uses the same port list as the Service the suite connects through. Unit-tested in gremlin_port_external_test.yaml

Known gaps: None.

Adversarial pass

No subagent tool was available in this unattended run, so the Phase 1.5 independent pass did not run. I reviewed the work myself instead, and it found two things. First, the issue's suggested check covers only the on-volume file. The ConfigMap-mount route is a second real entry point, so it is covered here (phase 4). Second, NetworkPolicy and the native flavor cannot be tested on kind or do not apply; the evidence is in the table above.

Review cycles

• cycle 1: b7e2d1a: no review arrived within 15 minutes. No Claude Code Review workflow runs on this repo: the only run on the branch is CI - Lint, Unit Tests, Integration Tests, and feat(#62): boot Gremlin on a non-default port via writePortToConfig in CI #67 had no bot review either. All CI checks pass, including the new integration-gremlin-port-external (2m3s).

Deferred items

None.

Final state: timeout (no reviewer responded). The developer owns review and merge.

🤖 Generated with Claude Code