sync @ 88a1d74

deploy/scripts/test-generate.sh

@@ -437,6 +437,68 @@ else
   bad "Trino OAuth2: realm masih literal 'sicabe' atau SICABE_REALM tak diteruskan"
 fi
 
+# ─── 0t. Prefix REST Iceberg Nessie terparameter (NESSIE_ICEBERG_PREFIX) ──────
+# Regresi: path `/iceberg` dipatok → client yang Nessie-nya memakai prefix lain
+# (REST Iceberg di path berbeda) FAIL di gate fase 2 / Sling / StarRocks.
+_np=1
+grep -q 'export NESSIE_ICEBERG_PREFIX=' "${DEPLOY_DIR}/config/environment.defaults.sh" || _np=0
+grep -q 'ICEBERG_PREFIX="${NESSIE_ICEBERG_PREFIX:-/iceberg}"' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" || _np=0
+grep -q '${NESSIE_HOST_API}${ICEBERG_PREFIX}/v1/config' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" || _np=0
+grep -q '${NESSIE_ICEBERG_PREFIX:-/iceberg}/' "${DEPLOY_DIR}/bootstrap.sh" || _np=0
+grep -q '${NESSIE_ICEBERG_PREFIX:-/iceberg}/' "${DEPLOY_DIR}/scripts/seed-starrocks.sh" || _np=0
+grep -q 'NESSIE_URL:-http://nessie:19120}/iceberg/' "${DEPLOY_DIR}/bootstrap.sh" && _np=0
+grep -q 'NESSIE_URL:-http://nessie:19120}/iceberg/' "${DEPLOY_DIR}/scripts/seed-starrocks.sh" && _np=0
+if [[ "${_np}" == "1" ]]; then
+  ok "prefix REST Iceberg Nessie terparameter (NESSIE_ICEBERG_PREFIX, default /iceberg)"
+else
+  bad "prefix REST Iceberg Nessie masih literal '/iceberg' di salah satu tempat"
+fi
+
+# ─── 0u. Prometheus: MinIO EKSTERNAL ber-URL penuh → target host:port + scheme ─
+# Regresi: rewrite menempel port ke address MENTAH → `https://host:9000:9000` (invalid)
+# dan scheme job tetap `http` → scrape menembak http ke port TLS.
+_up_inv="${OUT}/inv-minio-url.yml"
+cat > "${_up_inv}" <<'YML'
+version: 1
+tls: { mode: none }
+hosts:
+  control: { address: 10.20.0.10, tiers: [identity, policy, pipeline, governance] }
+  compute: { address: 10.20.0.11, tiers: [coord, engine] }
+  state:   { address: 10.20.0.12, tiers: [state] }
+components:
+  minio: { address: https://minio.corp:9000 }
+YML
+_up=0
+if python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
+      "${_up_inv}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \
+      "${OUT}/uminio" "${DEPLOY_DIR}/scripts/render-config.sh" > "${OUT}/uminio.log" 2>&1; then
+  _upy="${OUT}/uminio/host-control/config/prometheus/prometheus.yml"
+  if grep -q 'targets: \["minio.corp:9000"\]' "${_upy}" 2>/dev/null \
+     && ! grep -q 'minio.corp:9000:9000' "${_upy}" 2>/dev/null \
+     && grep -A2 'job_name: minio$' "${_upy}" 2>/dev/null | grep -q 'scheme: https'; then
+    _up=1
+  fi
+fi
+if [[ "${_up}" == "1" ]]; then
+  ok "prometheus: MinIO eksternal URL penuh → target host:port + scheme https"
+else
+  bad "prometheus: target/scheme MinIO URL salah (port dobel atau scheme http)"
+fi
+
+# ─── 0v. verify-phase2: pesan FAIL menampilkan kode HTTP + penyebab ──────────
+# Tanpa ini, FAIL hanya "tidak merespon" → tak terlihat apakah 404 (path absen /
+# Iceberg REST belum aktif), 401 (auth), 500 (config), atau 000 (tak terjangkau).
+_v2f="${DEPLOY_DIR}/scripts/verify-phase2-storage.sh"
+_vh=1
+grep -q 'http_code() {' "${_v2f}" || _vh=0
+grep -q 'code_hint() {' "${_v2f}" || _vh=0
+grep -qF 'tidak merespon [HTTP ${code} — $(code_hint "${code}")]' "${_v2f}" || _vh=0
+if [[ "${_vh}" == "1" ]]; then
+  ok "verify-phase2: pesan FAIL menyertakan kode HTTP + penyebab (404/401/500/000)"
+else
+  bad "verify-phase2: pesan FAIL belum menampilkan kode HTTP + penyebab"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \