fix(docker): integrate Hubble with PD deployment

[imbajin]

Summary

• add Hubble to release and development PD Compose deployments
• make Server and Hubble images and pull policies overridable
• configure Server PD registration, reachable URL, low-memory guard, and shared random JWT secret
• accept Bearer JWT in embedded Gremlin with one authenticator call while preserving Basic auth
• validate entrypoint and Compose contracts in CI

Related PR

• Hubble client counterpart: fix(hubble): use bearer token for authenticated clients hugegraph-toolchain#753
• This PR provides the Server and Compose side of the shared Bearer contract; fix(hubble): use bearer token for authenticated clients hugegraph-toolchain#753 makes Hubble send and preserve Bearer credentials. They are scoped independently but should be validated and released together.

Verification

• JDK 11 focused auth suite: 7 tests passed
• entrypoint generation, injection, and secret-reuse fixture: passed
• release and development Compose config: passed
• relevant Apache RAT checks: passed
• independent review and re-review: no actionable findings

[Copilot]

Pull request overview

This PR integrates HugeGraph Hubble into the single-node PD Compose deployments and extends the Server-side Docker/auth stack to support a shared JWT Bearer token contract (while preserving Basic auth) for embedded Gremlin and REST.

Changes:

• Add Hubble to release + dev Docker Compose stacks and document the new single-node workflow and required .env secrets.
• Enhance the server Docker entrypoint to configure PD registration/discovery settings, low-memory guard, and a shared/reused JWT token secret across REST + embedded Gremlin auth.
• Accept Authorization: Bearer <token> for HTTP Gremlin requests with targeted unit-test coverage and CI validation for entrypoint + Compose contracts.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/auth/WsAndHttpBasicAuthHandlerTest.java	Adds Bearer-token HTTP Gremlin auth tests and tightens Bearer token rejection cases.
hugegraph-server/hugegraph-dist/docker/test/test-docker-entrypoint.sh	Updates the unit test harness to source the refactored entrypoint helpers.
hugegraph-server/hugegraph-dist/docker/docker-entrypoint.sh	Adds property encoding/reuse helpers and maps new PD/auth env vars into config; generates/reuses JWT token secret.
hugegraph-server/hugegraph-dist/docker/docker-entrypoint-test.sh	New script to validate entrypoint behavior (env mapping, secret reuse, escaping) in CI.
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/WsAndHttpBasicAuthHandler.java	Adds Bearer parsing for HTTP Gremlin authorization while preserving Basic auth flow.
docker/README.md	Documents new single-node stacks (incl. Hubble), .env secret generation, and new env overrides.
docker/hugegraph-hubble.properties	New Hubble configuration for the Compose environment.
docker/docker-compose.yml	Adds Hubble service and makes Server/Hubble images + pull policy overridable; wires PD/auth env.
docker/docker-compose.dev.yml	Mirrors release Compose changes for dev builds; adds Hubble service and overrides.
.gitignore	Ignores docker/.env.
.github/workflows/server-ci.yml	Adds CI validation for entrypoint behavior and Compose rendering/contracts.
.dockerignore	Excludes /docker/.env from build contexts.

Suppressed comments (1)

hugegraph-server/hugegraph-dist/docker/docker-entrypoint.sh:97

• This length check sets LC_ALL=C globally, so the locale stays forced to C for the remainder of the entrypoint. If the goal is only to ensure ${#HG_SERVER_AUTH_TOKEN_SECRET} is counted in bytes, scope LC_ALL to just the arithmetic evaluation instead of mutating global environment.

if [[ -n "${HG_SERVER_AUTH_TOKEN_SECRET:-}" ]]; then
    LC_ALL=C
    if (( ${#HG_SERVER_AUTH_TOKEN_SECRET} < 32 )); then
        log "ERROR: HG_SERVER_AUTH_TOKEN_SECRET must be at least 32 bytes"
        exit 1

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.