[PR] [helm] Document and validate Secret-backed readiness probe auth [fluss]

["morazow (via GitHub)" <gi...@apache.org>]

morazow opened a new pull request, #4329:
URL: https://github.com/apache/fluss/pull/4329

   ## Summary
   
   The tablet readiness probe authenticates as a Fluss client, so on a SASL-enforced
   cluster it needs a credential. The only documented way to supply one is
   `tablet.readinessProbe.healthCheckAuth`, which the chart inlines into the
   StatefulSet's exec command, leaving the credential in plain text in the rendered
   manifest.
   
   The chart already has a Secret-backed route that nothing pointed at: a `secrets.env`
   entry named `READINESS_HEALTH_CHECK_AUTH` renders a `secretKeyRef` on both the tablet
   and coordinator containers, and the exec probe inherits the container environment, so
   `readiness-check.sh` reads it unchanged.
   
   - Document that route in `helm/values.yaml` and the Helm deployment guide.
   - Document that the probe principal needs `DESCRIBE` on the cluster resource when the
     authorizer is enabled.
   - Reject setting both forms at render time. Previously the inline `export` silently
     overrode the Secret-sourced value.
   
   No template logic or Java changes; the probe and the check tool are untouched.
   
   Related to #3926, which asks for the credential to be derived from `server.yaml` and
   would remove the need to supply one at all. This is the smaller, immediately available
   step.
   
   ## Test Plan
   
   - `helm lint helm` and `helm unittest helm`: 150/150 pass.
   - New case in `helm/tests/secrets_test.yaml` asserts the `secretKeyRef` env entry is
     present on the tablet container and that the probe command does not export the
     variable. Verified it fails if the probe always exports.
   - New case in `helm/tests/secrets_validate_test.yaml` asserts the conflict is rejected.
     Verified it fails without the validation rule.
   
   🤖 AI-assisted changes - reviewed by human developer
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org