feat(helm): integrate optional Vermeer with Hubble

.github/actions/helm-checks/action.yml

@@ -40,6 +40,8 @@ runs:
       helm lint helm/hugegraph -f helm/hugegraph/values-strict.yaml
       helm lint helm/hugegraph -f helm/hugegraph/examples/values-seatunnel-standalone.yaml
       helm lint helm/hugegraph -f helm/hugegraph/examples/values-seatunnel-cluster.yaml
+      helm lint helm/hugegraph --set vermeer.enabled=true
+      helm lint helm/hugegraph --set vermeer.enabled=true --set vermeer.mode=cluster --set mode=strict
 
   - name: packaged chart regression
     shell: 'bash -e {0}'
@@ -49,6 +51,14 @@ runs:
     shell: 'bash -e {0}'
     run: python3 -m unittest discover -s helm -p 'test_helm_seatunnel.py' -v
 
+  - name: Vermeer integration regression
+    shell: 'bash -e {0}'
+    run: python3 -m unittest discover -s helm -p 'test_helm_vermeer*.py' -v
+
+  - name: Shared metadata namespace regression
+    shell: 'bash -e {0}'
+    run: python3 -m unittest discover -s helm -p 'test_helm_metadata_cluster.py' -v
+
   - name: helm unittest
     shell: 'bash -e {0}'
     run: |
@@ -63,7 +73,8 @@ runs:
     shell: 'bash -e {0}'
     run: |
       for preset in "" "-f helm/hugegraph/values-single.yaml" "-f helm/hugegraph/values-cluster.yaml" "-f helm/hugegraph/values-strict.yaml" \
-        "-f helm/hugegraph/examples/values-seatunnel-standalone.yaml" "-f helm/hugegraph/examples/values-seatunnel-cluster.yaml"; do
+        "-f helm/hugegraph/examples/values-seatunnel-standalone.yaml" "-f helm/hugegraph/examples/values-seatunnel-cluster.yaml" \
+        "--set vermeer.enabled=true" "--set vermeer.enabled=true --set vermeer.mode=cluster --set mode=strict"; do
         # shellcheck disable=SC2086 # $preset intentionally splits into flags
         helm template ci helm/hugegraph $preset > /dev/null
       done
@@ -501,7 +512,8 @@ runs:
       echo "95f14e87aa28c09d5941f11bd024c1d02fdc0303ccaa23f61cef67bc92619d73  /tmp/kc.tar.gz" | sha256sum -c -
       tar -xzf /tmp/kc.tar.gz -C /tmp
       for preset in "" "-f helm/hugegraph/values-single.yaml" "-f helm/hugegraph/values-cluster.yaml" "-f helm/hugegraph/values-strict.yaml" \
-        "-f helm/hugegraph/examples/values-seatunnel-standalone.yaml" "-f helm/hugegraph/examples/values-seatunnel-cluster.yaml"; do
+        "-f helm/hugegraph/examples/values-seatunnel-standalone.yaml" "-f helm/hugegraph/examples/values-seatunnel-cluster.yaml" \
+        "--set vermeer.enabled=true" "--set vermeer.enabled=true --set vermeer.mode=cluster --set mode=strict"; do
         # shellcheck disable=SC2086 # $preset intentionally splits into flags
         helm template ci helm/hugegraph $preset | /tmp/kubeconform -strict -summary -kubernetes-version 1.23.0
       done

helm/hugegraph/Chart.yaml

@@ -17,9 +17,9 @@
 
 apiVersion: v2
 name: hugegraph-helm
-description: Helm chart for Apache HugeGraph HStore cluster with optional SeaTunnel
+description: Helm chart for Apache HugeGraph HStore cluster with optional SeaTunnel and Vermeer
 type: application
-version: 0.3.0
+version: 0.4.0
 # TODO: set appVersion to "1.8.0" when the release images are published.
 appVersion: "latest"
 kubeVersion: ">=1.23.0-0"
@@ -33,6 +33,7 @@ icon: https://hugegraph.apache.org/img/logo.svg
 sources:
   - https://github.com/apache/hugegraph
   - https://github.com/apache/seatunnel
+  - https://github.com/apache/hugegraph-computer/tree/master/vermeer
 maintainers:
   - name: HugeGraph Community
     url: https://hugegraph.apache.org/

helm/hugegraph/README.md

@@ -9,6 +9,8 @@ are not supported.
 Provide a default StorageClass or prepare matching PVs. The default installation
 needs **7 volumes**: 3 × 10 GiB for PD, 3 × 50 GiB for Store, and 1 × 1 GiB
 for Hubble. The chart creates PVCs; it does not create a storage provisioner.
+SeaTunnel and Vermeer are **disabled by default**, including in the single-node
+and cluster presets. Optional components add resources only when enabled.
 
 ## Install a published Chart
 
@@ -81,28 +83,63 @@ helm install hugegraph ./helm/hugegraph -n hugegraph --create-namespace \
 
 Inactive credential values may remain in the values file when auth is disabled.
 
-### Optional SeaTunnel
+### Optional components
 
-Set `seatunnel.enabled=true` to start one persistent hybrid member alongside HugeGraph;
+| Component | Default | Enable when needed |
+|---|---|---|
+| Hubble | Enabled | `hubble.enabled=false` selects API-only deployment |
+| SeaTunnel | Disabled | `seatunnel.enabled=true` adds data import/export and its native UI |
+| Vermeer | Disabled | `vermeer.enabled=true` adds graph computation, Hubble integration and its native UI |
+
+<details>
+<summary>SeaTunnel: optional import, export and migration</summary>
+
+Set `seatunnel.enabled=true` to start one long-running hybrid member alongside HugeGraph;
 set `seatunnel.mode=cluster` to use multiple members of the same native StatefulSet
 (two by default). SeaTunnel is disabled by default and its topology is independent
 of the HugeGraph single-/multi-node presets. Both modes include the engine's task UI.
-The HTTP Service inherits NodePort in `easy` mode or ClusterIP in `strict` mode;
-`seatunnel.service` can explicitly override the type and NodePort.
+The native HTTP Service remains ClusterIP in both easy and strict mode.
+Use an authorized port-forward when native administration is needed.
 
-Member/CLI port 5801 is restricted to same-release peers by a SeaTunnel ingress
-NetworkPolicy in every mode, including when the chart-wide policy flag is disabled.
-Easy mode leaves the authenticated HTTP entry open. Actual isolation requires CNI
-support and trusted namespace RBAC; full isolation additionally limits egress.
+HTTP and member/CLI port 5801 are restricted to necessary same-release callers
+in both modes, including when the chart-wide policy flag is disabled. Strict
+additionally limits egress. Actual isolation needs a supporting CNI and trusted
+namespace RBAC.
 
 The chart injects the same-release Server address, GraphSpace and administrator
 Secret references into the mounted Source/Sink examples. Create the target graph
 before submitting them manually; Helm does not create graphs or import data.
-UI and REST submission use a separate native HTTP Basic administrator account,
-whose generated Secret is retained and reused during online upgrades. Container
+UI and REST submission use a separate native HTTP Basic administrator account
+with a newly generated 6-character password in `easy` or 16 characters in `strict`; online upgrades reuse the
+existing Secret, including credentials created by older releases. Container
 security and scheduling options follow the other components; see the
 [SeaTunnel deployment guide](docs/seatunnel.md) for configuration and limits.
 
+</details>
+
+<details>
+<summary>Vermeer: optional graph computation with Hubble</summary>
+
+Enable Vermeer with `--set vermeer.enabled=true`. The default
+`vermeer.mode=standalone` runs one Master and one Worker as two containers in
+one Pod. Set `vermeer.mode=cluster` for one Master Pod and multiple Worker Pods
+(`vermeer.worker.replicas=3` by default). Both HugeGraph presets leave Vermeer
+disabled; choose the compute topology explicitly when enabling it.
+
+With Hubble enabled in its default PD mode, the chart configures the internal
+Master URL and service token automatically. Sign in to Hubble as the HugeGraph
+administrator, select an HStore graph, then load it and run an algorithm. The
+existing flow includes reload, task status/cancellation, paginated results and
+unload; it does not write results back into HugeGraph properties.
+
+Native Vermeer UI/API stays private behind ClusterIP in both modes. Optional
+administration uses port-forward and a separate generated password: 6 characters in `easy`, 16 in `strict`;
+Hubble needs no manual token configuration. Both engines always authenticate
+access, and their native HTTP/RPC policies allow only required internal callers.
+See the [Vermeer deployment guide](docs/vermeer.md) for administration and recovery.
+
+</details>
+
 ### Internal image registry
 
 Mirror the four component images (`hugegraph/pd`, `hugegraph/store`,
@@ -118,6 +155,11 @@ prefix. Set `imagePullSecrets` if the registry needs credentials.
 Store's wait init container and Helm test reuse the Store and Server images,
 which already contain `curl`; no separate curl image is needed by default.
 See the [complete registry example](examples/values-internal-registry.yaml).
+When enabled, also mirror `apache/seatunnel` and/or `hugegraph/vermeer` at the
+configured versions. Vermeer token initialization reuses its own image.
+The optional Vermeer image is pinned to the officially published Linux
+amd64/arm64 index. See [verified image and custom overrides](docs/vermeer.md#image-compatibility)
+for its tag, digest, source and publishing run. Normal enablement needs no image override.
 
 ### Storage
 
@@ -139,6 +181,18 @@ For a **new temporary installation**, add `--set persistence.enabled=false`
 to use `emptyDir`. Component storage flags override that global setting.
 PVC failures never cause an automatic fallback. Do not switch initialized
 PD/Store data between persistent and temporary storage.
+Vermeer adds separate Master and Worker data claims: two in standalone mode,
+or one Master claim plus one per Worker in cluster mode. Its storage flags
+inherit `persistence.enabled`; see [Vermeer storage](docs/vermeer.md#storage-and-recovery).
+
+### PD metadata namespace
+
+`metadataCluster` defaults to `hg-test`, preserving the namespace used by existing
+Server images. The chart gives Server and Store the same value so Store scans
+can find the Server's Schema. This is separate from a graph space or Raft group.
+Changing it does not migrate metadata; upgrades reject changes to a recorded
+namespace. See [metadata namespace adoption](docs/operations.md#pd-metadata-namespace)
+before upgrading a deployment that used custom metadata settings.
 
 ### Server service identity
 
@@ -182,13 +236,21 @@ still need verification with a running Linux cluster. See the
 
 ## Modes and entry points
 
+`values-single.yaml` and `values-cluster.yaml` select the HugeGraph topology.
+The independent `vermeer.mode` and `seatunnel.mode` select optional engine
+topologies; none of these presets enables an optional engine automatically.
+
 `mode: easy` is the default. `mode: strict` changes Server/Hubble to ClusterIP
-and enables NetworkPolicy; authentication, Hubble and persistence stay enabled.
+and enables full NetworkPolicy isolation; authentication, Hubble and persistence stay enabled.
 Use `--set mode=strict` or `-f helm/hugegraph/values-strict.yaml`.
 
 **Explicit component value > global value > mode default.** An explicit `false`
 is preserved; null component values inherit. The global settings are
-`persistence.enabled` and `global.imageRegistry`. No mode requires HTTPS.
+`persistence.enabled` and `global.imageRegistry`. SeaTunnel and Vermeer native
+Services are always ClusterIP and authenticated;
+their HTTP/RPC ingress stays restricted in both modes. No mode requires HTTPS.
+
+Server/Hubble entry choices:
 
 | Entry | Access | When to use it |
 |---|---|---|
@@ -206,7 +268,7 @@ Omission or `0` allocates automatically. Kubernetes validates the actual cluster
 range; the chart does not force `30000–32767`.
 
 A [hostless HTTP Ingress example](examples/values-http-ingress.yaml) is available.
-With NetworkPolicy enabled, add native rules for actual clients and controllers;
+With base-service NetworkPolicy enabled, add rules for actual clients and controllers;
 empty external rule lists are valid but can block access. Explicit Service and
 policy values override either mode. Legacy exposure acknowledgement fields are
 accepted for compatibility and no longer gate rendering.
@@ -221,6 +283,9 @@ with `-f`; see [values.yaml](values.yaml) for all fields and their comments.
 | `mode` | Entry and policy defaults | `easy` |
 | `pd.replicas` / `store.replicas` / `server.replicas` | Component replicas | `3` / `3` / `3` |
 | `hubble.enabled` | Install the UI | `true` |
+| `seatunnel.enabled` / `vermeer.enabled` | Install optional data/computation engines | `false` / `false` |
+| `vermeer.mode` | One Pod with two containers, or separate Master/Worker Pods | `standalone` |
+| `vermeer.worker.replicas` | Worker Pods in Vermeer cluster mode | `3` |
 | `server.auth.enabled` | Server authentication | `true` |
 | `server.service.type` / `hubble.service.type` | Explicit entry type; null inherits mode | resolved `NodePort` |
 | `pd.service.type` | PD client entry type | `ClusterIP` |
@@ -246,7 +311,7 @@ with `-f`; see [values.yaml](values.yaml) for all fields and their comments.
 - `values-single.yaml`: 1 PD + 1 Store + 1 Server, with Hubble and authentication.
 - `values-cluster.yaml`: required PD/Store anti-affinity, resources and controlled
   Store updates. NetworkPolicy inherits mode; the preset is a capacity starting point.
-- All client Services support native `externalTrafficPolicy`, `loadBalancerClass`,
+- Base PD/Server/Hubble client Services support native `externalTrafficPolicy`, `loadBalancerClass`,
   `loadBalancerIP`, `loadBalancerSourceRanges`, `externalIPs` and
   `allocateLoadBalancerNodePorts`, subject to cluster/controller support.
 - Resources, JVM options, scheduling, probes, HPA/PDB, metadata and external

helm/hugegraph/docs/distribution.md

@@ -48,11 +48,11 @@ helm install hugegraph ./hugegraph-helm -n hugegraph \
 ```
 
 Development packages append a workflow run number to the source chart version,
-for example `0.2.0-dev.123`. They may use `latest` service images. Helm OCI tags
+for example `0.4.0-dev.123`. They may use `latest` service images. Helm OCI tags
 come from the chart's SemVer version; `helm-dev` and `latest` are not Chart versions.
 
 Formal packages use the exact `Chart.version` maintained in source, for example
-`0.2.0`. They are published only after the corresponding HugeGraph service release
+`0.4.0`. They are published only after the corresponding HugeGraph service release
 exists and the chart selects published fixed component images. A source tag
 such as `helm-1.8.0` therefore denotes an already released service, not an
 advance preview. Chart fixes may be released independently from a reviewed master
@@ -138,3 +138,15 @@ default Store wait container and Helm test hook reuse component images. Explicit
 shown in the [private registry example](../examples/values-internal-registry.yaml).
 The mirror must preserve the selected image references and support the cluster's
 CPU architecture.
+
+SeaTunnel and Vermeer are disabled by default in every HugeGraph preset. When
+enabling either, also transfer its configured `apache/seatunnel` or
+`hugegraph/vermeer` image. Vermeer Master, Worker and token initialization use
+the same Vermeer image. Its default is the officially published
+`hugegraph/vermeer:helm-30b67d93e7d0`, pinned by a Linux amd64/arm64 OCI index
+digest. Preserve that index and the required platforms when mirroring it.
+The [Vermeer image reference](vermeer.md#image-compatibility) records the full
+digest, source commit, successful official publishing run and custom-tag override
+command. A tag override must also clear `vermeer.image.digest`, or set a different
+verified digest; the default digest otherwise continues to win. Hubble needs its
+native Vermeer adapter when selecting a custom build.