mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 13:16:24 +00:00
493178dd86
* fix(helm): honor redis-password from a user-managed Secret The bundled Redis StatefulSet derived its AUTH mode only from `redis.auth.password`, so a `redis.existingSecret` that carried both `redis-url` and `redis-password` left the gateway authenticating against a server started without `--requirepass`. Both probes used the no-auth path as well, so the Pod reported healthy while the gateway could not connect to it. Whether a user-managed Secret carries `redis-password` is only knowable at runtime, so the key is now read with `optional: true` and the entrypoint enables AUTH only when the value is nonempty. A Secret carrying only `redis-url` keeps the no-auth behavior instead of failing to start, and a stale `redis.auth.password` no longer wins over the selected Secret, matching what values.yaml documents. Refs #7149 * test(helm): cover Redis Secret authentication and share resolution Add the issue #7149 render-and-shell regression suite for chart-managed, user-managed and external Redis credentials. Resolve Secret precedence once for the Gateway, bundled server and chart-owned Secret, and clarify how optional user-managed passwords select AUTH at runtime. Regression coverage adapted from dakjdakd's commit 7e20745d678276ed33e8f8eafd2c576fa8ae9aec. Co-authored-by: dakjdakd <1428823446@qq.com> * test(helm): assert the stale value instead of an unused constant `test_bundled_redis_uses_optional_existing_secret_password` checked the module-level `PASSWORD` constant against the rendered manifest, but that constant is never an input to any of its six renders — the parametrized value is `ignored_password`. The guard could therefore never fail, so a template edit that started rendering `redis.auth.password` alongside a user-managed Secret would have gone unnoticed. Assert the parametrized value instead: it is the stale input the case is meant to keep out of the manifest. Verified the value is detectable in a render that does carry it (the chart-managed path renders it twice), so the assertion is no longer vacuous. Also fix the garbled sentence in `tests/AGENTS.md` that described this coverage as "stale values passwords". --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com> Co-authored-by: dakjdakd <1428823446@qq.com>