feat(helm): support easy & strict mode for k8s deployment

[imbajin]

Purpose of the PR

Make a fresh Helm installation straightforward on internal Kubernetes clusters. Previously, custom NodePorts and HTTP entrypoints required additional acknowledgements, the UI was disabled, and startup tools pulled a separate curl image. The default now installs the authenticated UI and API through automatic NodePorts, with persistent data and explicit component overrides.

Main Changes

• Add easy/strict defaults, optional temporary storage, native Service/Ingress settings, and an internal image registry override.
• Reuse Store/Server images for waiting and testing; coordinate configurable storage waits with startup probes and clarify PD credential errors.
• Honor client response-compression preferences, including explicit gzip exclusion and valid trailing-dot quality factors; document PD REST credentials, manual leader balance and Store replacement behavior.
• Shorten the README, fold uncommon settings, and provide complete internal-network, static-PV and GitOps examples. Existing releases retain their settings with --reuse-values.

Verifying these changes

• Earlier local checks passed Helm lint, template/unit/package checks, Kubernetes 1.23 manifest validation and shell fixtures. Java 17 Maven reactor compilation and response-compression tests were rerun after merging current ASF master and pass.

No fresh cluster acceptance run was performed for this update. The independent cluster report covers the earlier branch head and identifies two intermittent first-query failures; these remain under investigation. Follow the README installation example with a provisioned StorageClass, or use the static-PV example. --set persistence.enabled=false selects disposable storage for a fresh test release.

Does this PR potentially affect the following parts?

• Dependencies
• Modify configurations
• The public API
• Other affects (default UI, network exposure and storage behavior)
• Nope

Documentation Status

• Doc - TODO
• Doc - Done: paired website documentation is in docs: explain easy Helm deployments hugegraph-doc#527; merge both changes together.
• Doc - No Need

Documentation: helm/hugegraph/README.md, helm/hugegraph/docs/operations.md and helm/hugegraph/examples/.

Organization testing/review copy: hugegraph#309.

Conceptual overview

Conceptual illustration; not test or release-acceptance evidence.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.00%. Comparing base (92af2f8) to head (7590fd1).
⚠️ Report is 7 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3338      +/-   ##
============================================
- Coverage     54.31%   53.00%   -1.31%     
+ Complexity     2250     2185      -65     
============================================
  Files           770      762       -8     
  Lines         67952    67726     -226     
  Branches       9213     9285      +72     
============================================
- Hits          36905    35896    -1009     
- Misses        27470    28324     +854     
+ Partials       3577     3506      -71     

Flag	Coverage Δ
hstore	35.58% <51.35%> (?)
pd	49.19% <ø> (?)
server_memory	51.62% <100.00%> (?)
server_rocksdb	42.31% <51.35%> (?)
store	31.98% <ø> (?)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[imbajin]

Two P2 documentation corrections for the paired Helm changes

Reviewed Server commit 1ae2922 and documentation commit 02383e93626a5a76ecd839bd717eee7a3ff242b8.

1. Align the private-registry mirror inventory with the actual Server image. values.yaml uses server.image.repository=hugegraph/server, while the README, registry example and bilingual website inventory name hugegraph/hugegraph. Following that list would not mirror the image selected by the Server workload and inherited Helm test. Please make the repository names consistent and cover the documented inventory against the rendered images.

2. Update the paired operations guide's procedure references. Doc #527 still directs operators to the chart README for the partition-sharding procedure, full per-group checks and recovery sequence, but those procedures are no longer in the rewritten README. The new operations document describes constraints rather than the promised complete sequence. Please link the actual supported instructions or explicitly state the current recovery limits; this does not imply restoring old commands without validating their safety.

Sources:

hugegraph/helm/hugegraph/values.yaml

Line 288 in 1ae2922

repository: hugegraph/server

hugegraph/helm/hugegraph/README.md

Line 64 in 1ae2922

`hugegraph/hugegraph`, `hugegraph/hubble`) at the configured tags or digests:

https://github.com/apache/hugegraph-doc/blob/02383e93626a5a76ecd839bd717eee7a3ff242b8/content/en/docs/quickstart/hugegraph/hugegraph-helm-operations.md#L87

These are independently cross-checked source/documentation findings. No live Kubernetes deployment or recovery test was performed in this review.

Only the cited documentation/configuration facts were rechecked after the latest update; this is not a full review of the rebased PR.

[bitflicker64]

Blocking: no. Score: 9.5/10 (10 - 0.5 for one Minor). Summary: Fresh installs get the new easy defaults as intended, and existing releases keep their exposure and Hubble settings under --reuse-values, as the PR body and the #309 discussion state. The remaining gap is that the upgrade output does not tell anyone that the defaults changed. Evidence: helm lint and the chart's helm unittest suite pass (35 suites, 287 tests); a helm-unittest upgrade probe with live pre-PR objects renders the NodePort Server and the added Hubble objects. Not approving because the PR is still a draft and no live cluster upgrade was run.

Checked and not repeated: strict mode with an exposed Server, PD or Ingress now prints a NetworkPolicy warning in NOTES.txt; the Server image name in the README and registry example now matches hugegraph/server.

[imbajin]

[P2] Handle valid trailing-dot q-values before using negative values as the missing-token sentinel

At 93b848e, CompressInterceptor.java lines95–110 can select an encoding explicitly excluded by a valid Accept-Encoding header. The pinned Jersey3.0.3 HttpHeaderReader.readQualityFactor returns -2000 for both q=0. and q=1. (it leaves c as '.' in the no-fractional-digit branch). These forms are valid under RFC9110 §12.4.2. The new gzip>=0/identity>=0 tests treat this value as token absence.

Consequently, '*;q=1, gzip;q=0.' falls back to the wildcard and enables forbidden gzip. 'gzip;q=0.5, identity;q=1.' also enables gzip despite identity having higher preference. Please normalize or correctly parse these legal forms and add regression tests for explicit gzip exclusion and identity preference; relying on the parser's negative value as absence loses the explicit token semantics.

Evidence:

hugegraph/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/filter/CompressInterceptor.java

Lines 95 to 110 in 93b848e

	for (AcceptableToken token : HttpHeaderReader.readAcceptToken(accept)) {
	if (GZIP.equalsIgnoreCase(token.getToken())) {
	gzip = token.getQuality();
	} else if ("*".equals(token.getToken())) {
	wildcard = token.getQuality();
	} else if ("identity".equalsIgnoreCase(token.getToken())) {
	identity = token.getQuality();
	}
	}
	} catch (ParseException e) {
	return false;
	}
	int quality = gzip >= 0 ? gzip : wildcard;
	// If no encoding is acceptable, retain the plain response (RFC 9110, 12.4.1).
	// Rejecting it here could hide a POST that has already changed graph data.
	return quality > 0 && quality >= identity;

; https://github.com/eclipse-ee4j/jersey/blob/3.0.3/core-common/src/main/java/org/glassfish/jersey/message/internal/HttpHeaderReader.java#L194-L205 ; https://www.rfc-editor.org/rfc/rfc9110.html#section-12.4.2 . This is independently cross-checked source analysis, not a live HTTP reproduction.

[imbajin]

Addressed the trailing-dot q-value finding in the updated branch.

Legal q=0. and q=1. are normalized before the existing Jersey parser runs. This preserves explicit gzip exclusion over * and honors a higher identity preference. Regression tests use real Jersey request headers and check response bytes, Content-Encoding, Content-Length and Vary, with malformed neighboring values retained as negative controls. No additional parser or dependency was introduced.

Local Java 17 reactor compilation and the compression tests pass after merging current ASF master; formatting also passes. Current-head CI has started and is still pending.