From bba62bf6a74e10d3edd57c9b741493186d8e7a5a Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 05:30:26 -0500
Subject: [PATCH 01/27] fixing the pipeline failure

---
 .github/workflows/ci.yml | 225 ++++++++++++++++++++++++---------------
 1 file changed, 140 insertions(+), 85 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ceb98b7e..f9384d19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,20 +1,17 @@
 name: CI
 
-on: 
-  # Triggers the workflow on push or pull request events but only for the main branch
+on:
   push:
     branches: [ master ]
   pull_request:
     branches: [ master ]
-
-  # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
 env:
   V_HOST: localhost
   V_PORT: 5433
   V_USER: dbadmin
-  V_DATABASE: VMart
+  V_DATABASE: vdb
   KC_REALM: test
   KC_USER: oauth_user
   KC_PASSWORD: password
@@ -26,117 +23,175 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        #os: [ubuntu-latest, windows-latest, macos-latest]
-        # let's make it a little bit simple for now
-        # current minimal version will be 12.
-        # TODO: investigate the multipe version matrix with single Vertica instance
         node: ['12', '14', '16', '18', '20']
         os: [ubuntu-latest]
     name: Node.js ${{ matrix.node }} (${{ matrix.os }})
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v4
-      
-      - name: Setup node
+
+      - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           cache: yarn
 
-      - name: build
-        run: yarn 
-
-      - name: boostrap
-        run: yarn lerna bootstrap
-
-      - name: Set up a Keycloak docker container
-        timeout-minutes: 5
-        run: |
-          docker network create -d bridge my-network
-          docker run -d -p 8080:8080 \
-            --name keycloak --network my-network \
-            -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin \
-            quay.io/keycloak/keycloak:23.0.4 start-dev
-          docker container ls
-        
-      - name: Setup Vertica server docker container
-        timeout-minutes: 15
-        run: |          
-          docker run -d -p 5433:5433 -p 5444:5444 \
-            --mount type=volume,source=vertica-data,target=/data \
-            --name vertica_ce --network my-network \
-            opentext/vertica-ce:24.4.0-0
-          echo "Vertica startup ..."
-          until docker exec vertica_ce test -f /data/vertica/VMart/agent_start.out; do \
-            echo "..."; \
-            sleep 3; \
-          done;
-          echo "Vertica is up"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "\l"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "select version()"
-
-      - name: Configure Keycloak
-        run: |
-          echo "Wait for keycloak ready ..."
-          bash -c 'while true; do curl -s localhost:8080 &>/dev/null; ret=$?; [[ $ret -eq 0 ]] && break; echo "..."; sleep 3; done'
-
-          docker exec -i keycloak /bin/bash <<EOF
-            /opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin
-            /opt/keycloak/bin/kcadm.sh create realms -s realm=${KC_REALM} -s enabled=true
-            /opt/keycloak/bin/kcadm.sh update realms/${KC_REALM} -s accessTokenLifespan=3600
-            /opt/keycloak/bin/kcadm.sh get realms/${KC_REALM}
-            /opt/keycloak/bin/kcadm.sh create users -r ${KC_REALM} -s username=${KC_USER} -s enabled=true
-            /opt/keycloak/bin/kcadm.sh set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD}
-            /opt/keycloak/bin/kcadm.sh get users -r ${KC_REALM}
-            /opt/keycloak/bin/kcadm.sh create clients -r ${KC_REALM} -s clientId=${KC_CLIENT_ID} -s enabled=true \
-              -s 'redirectUris=["/*"]' -s 'webOrigins=["/*"]' -s secret=${KC_CLIENT_SECRET} -s directAccessGrantsEnabled=true -o
+      - name: Install dependencies
+        run: |
+          yarn
+          yarn lerna bootstrap
+
+      - name: Create KinD cluster
+        uses: helm/kind-action@v1.10.0
+        with:
+          cluster_name: vertica-ci
+          wait: true
+
+      - name: Setup Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add Helm repos
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add vertica-charts https://vertica.github.io/charts
+          helm repo update
+
+      - name: Create namespace
+        run: |
+          kubectl create namespace vertica || true
+
+      - name: Install MinIO (communal storage)
+        run: |
+          helm upgrade --install minio bitnami/minio \
+            --namespace vertica \
+            --set auth.rootUser=minio \
+            --set auth.rootPassword=minio123 \
+            --set defaultBuckets=communal
+          kubectl rollout status statefulset/minio -n vertica --timeout=300s
+          kubectl get svc -n vertica minio
+
+      - name: Create communal credentials secret
+        run: |
+          kubectl delete secret -n vertica communal-creds --ignore-not-found
+          kubectl create secret generic communal-creds -n vertica \
+            --from-literal=accessKeyID=minio \
+            --from-literal=secretAccessKey=minio123
+
+      - name: Install Vertica Operator
+        run: |
+          helm upgrade --install vertica-operator vertica-charts/verticadb-operator -n vertica --create-namespace
+          kubectl rollout status deploy/verticadb-operator-controller-manager -n vertica --timeout=600s || true
+          kubectl get pods -n vertica
+
+      - name: Deploy VerticaDB
+        run: |
+          cat <<'EOF' | kubectl apply -f -
+          apiVersion: vertica.com/v1
+          kind: VerticaDB
+          metadata:
+            name: verticadb-sample
+            namespace: vertica
+          spec:
+            image: opentext/vertica-k8s:latest
+            dbName: vdb
+            communal:
+              path: s3://communal
+              credentialSecret: communal-creds
+              endpoint: http://minio.vertica.svc.cluster.local:9000
+              includeAwsAuth: false
+              s3Region: us-east-1
+            subclusters:
+              - name: defaultsubcluster
+                size: 1
           EOF
+          # Wait for Vertica server pod to be Ready
+          kubectl wait --for=condition=Ready pod -n vertica -l app.kubernetes.io/component=server --timeout=900s
+          kubectl get pods -n vertica -o wide
 
-          # Retrieving an Access Token
-          curl --location --request POST http://`hostname`:8080/realms/${KC_REALM}/protocol/openid-connect/token \
-              --header 'Content-Type: application/x-www-form-urlencoded' \
-              --data-urlencode "username=${KC_USER}" \
-              --data-urlencode "password=${KC_PASSWORD}" \
-              --data-urlencode "client_id=${KC_CLIENT_ID}" \
-              --data-urlencode "client_secret=${KC_CLIENT_SECRET}" \
-              --data-urlencode 'grant_type=password' -o oauth.json
-          cat oauth.json | python3 -c 'import json,sys;obj=json.load(sys.stdin);print(obj["access_token"])' > access_token.txt
+      - name: Install Keycloak
+        run: |
+          helm upgrade --install keycloak bitnami/keycloak \
+            --namespace vertica \
+            --set auth.adminUser=admin \
+            --set auth.adminPassword=admin \
+            --set proxy=reencrypt
+          kubectl wait --for=condition=Ready pod -n vertica -l app.kubernetes.io/name=keycloak --timeout=600s
+          kubectl get svc -n vertica keycloak
+
+      - name: Configure Keycloak realm, client, and user
+        run: |
+          KC_POD=$(kubectl get pods -n vertica -l app.kubernetes.io/name=keycloak -o jsonpath='{.items[0].metadata.name}')
+          kubectl exec -n vertica "$KC_POD" -- bash -lc \
+            "/opt/bitnami/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin && \
+             /opt/bitnami/keycloak/bin/kcadm.sh create realms -s realm=${KC_REALM} -s enabled=true && \
+             /opt/bitnami/keycloak/bin/kcadm.sh update realms/${KC_REALM} -s accessTokenLifespan=3600 && \
+             /opt/bitnami/keycloak/bin/kcadm.sh create users -r ${KC_REALM} -s username=${KC_USER} -s enabled=true && \
+             /opt/bitnami/keycloak/bin/kcadm.sh set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD} && \
+             /opt/bitnami/keycloak/bin/kcadm.sh create clients -r ${KC_REALM} -s clientId=${KC_CLIENT_ID} -s enabled=true -s 'redirectUris=["/*"]' -s 'webOrigins=["/*"]' -s secret=${KC_CLIENT_SECRET} -s directAccessGrantsEnabled=true -o"
+
+      - name: Port-forward services (Vertica 5433 and Keycloak 8080)
+        run: |
+          # Port-forward Vertica service to localhost:5433
+          nohup kubectl port-forward -n vertica svc/verticadb-sample-defaultsubcluster 5433:5433 >/tmp/pf-vertica.log 2>&1 &
+          # Port-forward Keycloak service to localhost:8080
+          nohup kubectl port-forward -n vertica svc/keycloak 8080:80 >/tmp/pf-keycloak.log 2>&1 &
+          sleep 5
+          echo "PF logs:" && tail -n +1 /tmp/pf-*.log || true
+
+      - name: Configure Vertica OAuth and create user
+        run: |
+          V_POD=$(kubectl get pods -n vertica -l app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')
+          DISCOVERY_URL="http://keycloak.vertica.svc.cluster.local/realms/${KC_REALM}/.well-known/openid-configuration"
+          INTROSPECT_URL="http://keycloak.vertica.svc.cluster.local/realms/${KC_REALM}/protocol/openid-connect/token/introspect"
+          kubectl exec -n vertica "$V_POD" -- bash -lc \
+            "/opt/vertica/bin/vsql -c \"CREATE AUTHENTICATION v_oauth METHOD 'oauth' HOST '0.0.0.0/0';\" && \
+             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET client_id='${KC_CLIENT_ID}';\" && \
+             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET client_secret='${KC_CLIENT_SECRET}';\" && \
+             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET discovery_url='${DISCOVERY_URL}';\" && \
+             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET introspect_url='${INTROSPECT_URL}';\" && \
+             /opt/vertica/bin/vsql -c \"CREATE USER ${KC_USER};\" && \
+             /opt/vertica/bin/vsql -c \"GRANT AUTHENTICATION v_oauth TO ${KC_USER};\" && \
+             /opt/vertica/bin/vsql -c \"GRANT ALL ON SCHEMA PUBLIC TO ${KC_USER};\" && \
+             /opt/vertica/bin/vsql -c \"CREATE AUTHENTICATION v_dbadmin_hash METHOD 'hash' HOST '0.0.0.0/0';\" && \
+             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_dbadmin_hash PRIORITY 10000;\" && \
+             /opt/vertica/bin/vsql -c \"GRANT AUTHENTICATION v_dbadmin_hash TO dbadmin;\""
 
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "CREATE AUTHENTICATION v_oauth METHOD 'oauth' HOST '0.0.0.0/0';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "ALTER AUTHENTICATION v_oauth SET client_id = '${KC_CLIENT_ID}';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "ALTER AUTHENTICATION v_oauth SET client_secret = '${KC_CLIENT_SECRET}';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "ALTER AUTHENTICATION v_oauth SET discovery_url = 'http://`hostname`:8080/realms/${KC_REALM}/.well-known/openid-configuration';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "ALTER AUTHENTICATION v_oauth SET introspect_url = 'http://`hostname`:8080/realms/${KC_REALM}/protocol/openid-connect/token/introspect';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "SELECT * FROM client_auth WHERE auth_name='v_oauth';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "CREATE USER ${KC_USER};"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "GRANT AUTHENTICATION v_oauth TO ${KC_USER};"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "GRANT ALL ON SCHEMA PUBLIC TO ${KC_USER};"
-          # A dbadmin-specific authentication record (connect remotely) is needed after setting up an OAuth user
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "CREATE AUTHENTICATION v_dbadmin_hash METHOD 'hash' HOST '0.0.0.0/0';"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "ALTER AUTHENTICATION v_dbadmin_hash PRIORITY 10000;"
-          docker exec -u dbadmin vertica_ce /opt/vertica/bin/vsql -c "GRANT AUTHENTICATION v_dbadmin_hash TO dbadmin;"
+      - name: Retrieve OAuth access token
+        run: |
+          echo "Waiting for Keycloak to accept connections..." && sleep 5
+          curl --retry 10 --retry-delay 3 --retry-all-errors \
+            --location --request POST http://localhost:8080/realms/${KC_REALM}/protocol/openid-connect/token \
+            --header 'Content-Type: application/x-www-form-urlencoded' \
+            --data-urlencode "username=${KC_USER}" \
+            --data-urlencode "password=${KC_PASSWORD}" \
+            --data-urlencode "client_id=${KC_CLIENT_ID}" \
+            --data-urlencode "client_secret=${KC_CLIENT_SECRET}" \
+            --data-urlencode 'grant_type=password' -o oauth.json
+          cat oauth.json | python3 -c 'import json,sys;obj=json.load(sys.stdin);print(obj["access_token"])' > access_token.txt
+          test -s access_token.txt && echo "Token captured" || (echo "Token missing"; exit 1)
 
       - name: test-v-connection-string
         if: always()
         run: |
           cd packages/v-connection-string
           yarn test
-          
+
       - name: test-v-pool
         if: always()
         run: |
           cd packages/v-pool
           yarn test
-          
+
       - name: test-v-protocol
         if: always()
         run: |
           cd packages/v-protocol
           yarn test
-          
+
       - name: test-vertica-nodejs
         if: always()
         run: |
-          export VTEST_OAUTH_ACCESS_TOKEN=`cat access_token.txt`
+          export VTEST_OAUTH_ACCESS_TOKEN="$(cat ${GITHUB_WORKSPACE}/access_token.txt)"
           cd packages/vertica-nodejs
           yarn test

From 8a113d90fb0a4c9bb5feed494542601677fc04dc Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 05:42:48 -0500
Subject: [PATCH 02/27] fixed pipeline failure

---
 .github/workflows/ci.yml | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9384d19..ba9cd350 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
 
 env:
-  V_HOST: localhost
+  V_HOST: 127.0.0.1
   V_PORT: 5433
   V_USER: dbadmin
   V_DATABASE: vdb
@@ -44,7 +44,7 @@ jobs:
         uses: helm/kind-action@v1.10.0
         with:
           cluster_name: vertica-ci
-          wait: true
+          wait: 180s
 
       - name: Setup Helm
         uses: azure/setup-helm@v4
@@ -114,8 +114,7 @@ jobs:
           helm upgrade --install keycloak bitnami/keycloak \
             --namespace vertica \
             --set auth.adminUser=admin \
-            --set auth.adminPassword=admin \
-            --set proxy=reencrypt
+            --set auth.adminPassword=admin
           kubectl wait --for=condition=Ready pod -n vertica -l app.kubernetes.io/name=keycloak --timeout=600s
           kubectl get svc -n vertica keycloak
 
@@ -161,7 +160,7 @@ jobs:
         run: |
           echo "Waiting for Keycloak to accept connections..." && sleep 5
           curl --retry 10 --retry-delay 3 --retry-all-errors \
-            --location --request POST http://localhost:8080/realms/${KC_REALM}/protocol/openid-connect/token \
+            --location --request POST http://127.0.0.1:8080/realms/${KC_REALM}/protocol/openid-connect/token \
             --header 'Content-Type: application/x-www-form-urlencoded' \
             --data-urlencode "username=${KC_USER}" \
             --data-urlencode "password=${KC_PASSWORD}" \
@@ -172,25 +171,21 @@ jobs:
           test -s access_token.txt && echo "Token captured" || (echo "Token missing"; exit 1)
 
       - name: test-v-connection-string
-        if: always()
         run: |
           cd packages/v-connection-string
           yarn test
 
       - name: test-v-pool
-        if: always()
         run: |
           cd packages/v-pool
           yarn test
 
       - name: test-v-protocol
-        if: always()
         run: |
           cd packages/v-protocol
           yarn test
 
       - name: test-vertica-nodejs
-        if: always()
         run: |
           export VTEST_OAUTH_ACCESS_TOKEN="$(cat ${GITHUB_WORKSPACE}/access_token.txt)"
           cd packages/vertica-nodejs

From c0a9e443a4acc748c2312b8c7b7f2246cd3f8ef7 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 05:48:53 -0500
Subject: [PATCH 03/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba9cd350..5692faec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,8 +67,10 @@ jobs:
             --namespace vertica \
             --set auth.rootUser=minio \
             --set auth.rootPassword=minio123 \
-            --set defaultBuckets=communal
-          kubectl rollout status statefulset/minio -n vertica --timeout=300s
+            --set defaultBuckets=communal \
+            --wait --timeout 10m0s
+          # Wait for any MinIO pod to be Ready (label provided by the chart)
+          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=minio -n vertica --timeout=600s
           kubectl get svc -n vertica minio
 
       - name: Create communal credentials secret

From 27803f34a7ae9d5ae33a3ece420ce05f03e27220 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 06:35:50 -0500
Subject: [PATCH 04/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5692faec..290692ec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,9 +68,10 @@ jobs:
             --set auth.rootUser=minio \
             --set auth.rootPassword=minio123 \
             --set defaultBuckets=communal \
-            --wait --timeout 10m0s
+            --set console.enabled=false \
+            --set resourcesPreset=none
           # Wait for any MinIO pod to be Ready (label provided by the chart)
-          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=minio -n vertica --timeout=600s
+          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=minio -n vertica --timeout=900s
           kubectl get svc -n vertica minio
 
       - name: Create communal credentials secret

From e96eb017458e2f5819619317612031e0be2d78b7 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 07:02:51 -0500
Subject: [PATCH 05/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 290692ec..a21441e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,10 +68,18 @@ jobs:
             --set auth.rootUser=minio \
             --set auth.rootPassword=minio123 \
             --set defaultBuckets=communal \
+            --set persistence.enabled=false \
             --set console.enabled=false \
             --set resourcesPreset=none
           # Wait for any MinIO pod to be Ready (label provided by the chart)
-          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=minio -n vertica --timeout=900s
+          if ! kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=minio -n vertica --timeout=900s; then
+            echo 'MinIO failed to become Ready. Dumping diagnostics...'
+            kubectl get pods -n vertica -l app.kubernetes.io/name=minio -o wide || true
+            kubectl describe pods -n vertica -l app.kubernetes.io/name=minio || true
+            kubectl logs -n vertica $(kubectl get pods -n vertica -l app.kubernetes.io/name=minio -o jsonpath='{.items[0].metadata.name}') || true
+            kubectl get pvc -n vertica || true
+            exit 1
+          fi
           kubectl get svc -n vertica minio
 
       - name: Create communal credentials secret

From 275d9501d6ae3fe2e430c54ca9036d12a8579fef Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 07:25:45 -0500
Subject: [PATCH 06/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 90 +++++++++++++++++++++++++++++++++-------
 1 file changed, 76 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a21441e2..20bcc4f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,25 +63,87 @@ jobs:
 
       - name: Install MinIO (communal storage)
         run: |
-          helm upgrade --install minio bitnami/minio \
-            --namespace vertica \
-            --set auth.rootUser=minio \
-            --set auth.rootPassword=minio123 \
-            --set defaultBuckets=communal \
-            --set persistence.enabled=false \
-            --set console.enabled=false \
-            --set resourcesPreset=none
-          # Wait for any MinIO pod to be Ready (label provided by the chart)
-          if ! kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=minio -n vertica --timeout=900s; then
+          cat <<'EOF' | kubectl apply -f -
+          apiVersion: apps/v1
+          kind: Deployment
+          metadata:
+            name: minio
+            namespace: vertica
+            labels:
+              app: minio
+          spec:
+            replicas: 1
+            selector:
+              matchLabels:
+                app: minio
+            template:
+              metadata:
+                labels:
+                  app: minio
+              spec:
+                containers:
+                  - name: minio
+                    image: minio/minio:latest
+                    args: ["server","/data","--address=:9000"]
+                    env:
+                      - name: MINIO_ROOT_USER
+                        value: minio
+                      - name: MINIO_ROOT_PASSWORD
+                        value: minio123
+                    ports:
+                      - containerPort: 9000
+                        name: api
+                    readinessProbe:
+                      httpGet:
+                        path: /minio/health/ready
+                        port: 9000
+                      initialDelaySeconds: 5
+                      periodSeconds: 5
+                    livenessProbe:
+                      httpGet:
+                        path: /minio/health/live
+                        port: 9000
+                      initialDelaySeconds: 10
+                      periodSeconds: 10
+                    volumeMounts:
+                      - name: data
+                        mountPath: /data
+                volumes:
+                  - name: data
+                    emptyDir: {}
+          ---
+          apiVersion: v1
+          kind: Service
+          metadata:
+            name: minio
+            namespace: vertica
+            labels:
+              app: minio
+          spec:
+            selector:
+              app: minio
+            ports:
+              - protocol: TCP
+                port: 9000
+                targetPort: 9000
+          EOF
+
+          # Wait for MinIO to be ready
+          if ! kubectl wait --for=condition=Ready pod -l app=minio -n vertica --timeout=900s; then
             echo 'MinIO failed to become Ready. Dumping diagnostics...'
-            kubectl get pods -n vertica -l app.kubernetes.io/name=minio -o wide || true
-            kubectl describe pods -n vertica -l app.kubernetes.io/name=minio || true
-            kubectl logs -n vertica $(kubectl get pods -n vertica -l app.kubernetes.io/name=minio -o jsonpath='{.items[0].metadata.name}') || true
-            kubectl get pvc -n vertica || true
+            kubectl get pods -n vertica -l app=minio -o wide || true
+            kubectl describe pods -n vertica -l app=minio || true
+            kubectl logs -n vertica $(kubectl get pods -n vertica -l app=minio -o jsonpath='{.items[0].metadata.name}') || true
             exit 1
           fi
           kubectl get svc -n vertica minio
 
+      - name: Create communal bucket in MinIO
+        run: |
+          # Use minio client inside cluster to create bucket
+          kubectl run -n vertica mc --image=minio/mc:latest --restart=Never --attach=true --rm -- \
+            sh -c "mc alias set local http://minio.vertica.svc.cluster.local:9000 minio minio123 && mc mb -p local/communal || true && mc ls local"
+
       - name: Create communal credentials secret
         run: |
           kubectl delete secret -n vertica communal-creds --ignore-not-found

From ac261484b0631ed0af86046b4489b2d74bc47d12 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 07:43:42 -0500
Subject: [PATCH 07/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20bcc4f4..eea236ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,9 +140,13 @@ jobs:
 
       - name: Create communal bucket in MinIO
         run: |
-          # Use minio client inside cluster to create bucket
-          kubectl run -n vertica mc --image=minio/mc:latest --restart=Never --attach=true --rm -- \
-            sh -c "mc alias set local http://minio.vertica.svc.cluster.local:9000 minio minio123 && mc mb -p local/communal || true && mc ls local"
+          # Create communal bucket using env alias to avoid needing shell
+          kubectl run -n vertica mc-mb --image=minio/mc:latest --restart=Never \
+            --env MC_HOST_local=http://minio:minio123@minio.vertica.svc.cluster.local:9000 \
+            --attach=true --rm -- mc mb -p local/communal || true
+          kubectl run -n vertica mc-ls --image=minio/mc:latest --restart=Never \
+            --env MC_HOST_local=http://minio:minio123@minio.vertica.svc.cluster.local:9000 \
+            --attach=true --rm -- mc ls local
 
       - name: Create communal credentials secret
         run: |

From 4a94338980d8dd3c733248cf02953f618ddc348f Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 07:48:31 -0500
Subject: [PATCH 08/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eea236ca..b4b9d96b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -176,8 +176,6 @@ jobs:
               path: s3://communal
               credentialSecret: communal-creds
               endpoint: http://minio.vertica.svc.cluster.local:9000
-              includeAwsAuth: false
-              s3Region: us-east-1
             subclusters:
               - name: defaultsubcluster
                 size: 1

From 5225756b756c86377f280bddd5f692918f9e8c63 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 07:53:29 -0500
Subject: [PATCH 09/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4b9d96b..dbaca2aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,6 +55,7 @@ jobs:
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
           helm repo add vertica-charts https://vertica.github.io/charts
+          helm repo add jetstack https://charts.jetstack.io
           helm repo update
 
       - name: Create namespace
@@ -155,10 +156,25 @@ jobs:
             --from-literal=accessKeyID=minio \
             --from-literal=secretAccessKey=minio123
 
+      - name: Install cert-manager (for operator webhooks)
+        run: |
+          kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.crds.yaml
+          helm upgrade --install cert-manager jetstack/cert-manager -n cert-manager --create-namespace --set installCRDs=false
+          kubectl wait --for=condition=Available deployment -l app=cert-manager -n cert-manager --timeout=600s || true
+          kubectl get pods -n cert-manager
+
       - name: Install Vertica Operator
         run: |
           helm upgrade --install vertica-operator vertica-charts/verticadb-operator -n vertica --create-namespace
-          kubectl rollout status deploy/verticadb-operator-controller-manager -n vertica --timeout=600s || true
+          kubectl wait --for=condition=Available deployment/verticadb-operator-controller-manager -n vertica --timeout=600s || true
+          # Wait for webhook service endpoints to be ready
+          echo "Waiting for verticadb-operator-webhook-service endpoints..."
+          for i in {1..60}; do
+            EP=$(kubectl get endpoints verticadb-operator-webhook-service -n vertica -o jsonpath='{.subsets[0].addresses[0].ip}' 2>/dev/null || true)
+            if [ -n "$EP" ]; then echo "Webhook endpoints ready: $EP"; break; fi
+            echo "...waiting"; sleep 5;
+          done
+          kubectl get svc -n vertica verticadb-operator-webhook-service || true
           kubectl get pods -n vertica
 
       - name: Deploy VerticaDB

From 2d5b5edbe634abca17e99457775fe0ea456a4b41 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 07:57:49 -0500
Subject: [PATCH 10/27] fixed the pipeline issuse

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dbaca2aa..0b84c734 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -188,6 +188,7 @@ jobs:
           spec:
             image: opentext/vertica-k8s:latest
             dbName: vdb
+            kSafety: 0
             communal:
               path: s3://communal
               credentialSecret: communal-creds

From 1450202cb1b5271eaf4019c07385052c1b22ac85 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 23:19:26 -0500
Subject: [PATCH 11/27] Fixed the pipeline issue

---
 .github/workflows/ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b84c734..d67b6341 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -188,14 +188,13 @@ jobs:
           spec:
             image: opentext/vertica-k8s:latest
             dbName: vdb
-            kSafety: 0
             communal:
               path: s3://communal
               credentialSecret: communal-creds
               endpoint: http://minio.vertica.svc.cluster.local:9000
             subclusters:
               - name: defaultsubcluster
-                size: 1
+                size: 3
           EOF
           # Wait for Vertica server pod to be Ready
           kubectl wait --for=condition=Ready pod -n vertica -l app.kubernetes.io/component=server --timeout=900s

From 89142675752b78fac0c21c805e8621299af6ecb1 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 23:33:25 -0500
Subject: [PATCH 12/27] Fixed the pipeline issue

---
 .github/workflows/ci.yml | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d67b6341..6838bf9f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -196,9 +196,24 @@ jobs:
               - name: defaultsubcluster
                 size: 3
           EOF
-          # Wait for Vertica server pod to be Ready
-          kubectl wait --for=condition=Ready pod -n vertica -l app.kubernetes.io/component=server --timeout=900s
-          kubectl get pods -n vertica -o wide
+          # Wait for Vertica StatefulSet or service endpoints to become ready
+          if kubectl get statefulset -n vertica verticadb-sample-defaultsubcluster >/dev/null 2>&1; then
+            kubectl rollout status statefulset/verticadb-sample-defaultsubcluster -n vertica --timeout=900s || true
+          fi
+          echo "Waiting for Vertica service endpoints..."
+          for i in {1..180}; do
+            EP=$(kubectl get endpoints verticadb-sample-defaultsubcluster -n vertica -o jsonpath='{.subsets[0].addresses[0].ip}' 2>/dev/null || true)
+            if [ -n "$EP" ]; then echo "Vertica endpoints ready: $EP"; break; fi
+            echo "...waiting"; sleep 5;
+          done
+          if [ -z "$EP" ]; then
+            echo "Vertica endpoints did not become ready";
+            kubectl describe svc verticadb-sample-defaultsubcluster -n vertica || true;
+            kubectl get endpoints verticadb-sample-defaultsubcluster -n vertica -o yaml || true;
+            kubectl get pods -n vertica -o wide || true;
+            exit 1;
+          fi
+          kubectl get pods -n vertica -o wide || true
 
       - name: Install Keycloak
         run: |
@@ -231,7 +246,12 @@ jobs:
 
       - name: Configure Vertica OAuth and create user
         run: |
-          V_POD=$(kubectl get pods -n vertica -l app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')
+          V_POD=$(kubectl get pods -n vertica -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^verticadb-sample-defaultsubcluster-' | head -n1)
+          if [ -z "$V_POD" ]; then
+            echo "Failed to locate Vertica server pod";
+            kubectl get pods -n vertica -o wide;
+            exit 1;
+          fi
           DISCOVERY_URL="http://keycloak.vertica.svc.cluster.local/realms/${KC_REALM}/.well-known/openid-configuration"
           INTROSPECT_URL="http://keycloak.vertica.svc.cluster.local/realms/${KC_REALM}/protocol/openid-connect/token/introspect"
           kubectl exec -n vertica "$V_POD" -- bash -lc \

From 9e3148576801a0c114710d55e232f455542796ab Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Tue, 13 Jan 2026 23:37:24 -0500
Subject: [PATCH 13/27] Fixed the pipeline issue

---
 .github/workflows/ci.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6838bf9f..cccb2b35 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,22 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn
+          set -e
+          echo "Configuring Yarn registry fallback to npmjs.org"
+          yarn config set registry https://registry.npmjs.org
+          ATTEMPTS=3
+          for i in $(seq 1 $ATTEMPTS); do
+            echo "yarn install attempt $i/$ATTEMPTS"
+            if yarn install --frozen-lockfile --network-timeout 300000; then
+              break
+            fi
+            if [ "$i" -eq "$ATTEMPTS" ]; then
+              echo "yarn install failed after $ATTEMPTS attempts";
+              exit 1
+            fi
+            echo "yarn install failed; retrying after short delay..."
+            sleep 5
+          done
           yarn lerna bootstrap
 
       - name: Create KinD cluster

From c7a603f575bee182f32e75ed53f051baab8fd8f6 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 00:22:33 -0500
Subject: [PATCH 14/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cccb2b35..98ac0e07 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -211,9 +211,19 @@ jobs:
               - name: defaultsubcluster
                 size: 3
           EOF
-          # Wait for Vertica StatefulSet or service endpoints to become ready
+          # Wait for Vertica StatefulSet rollout and pods readiness
           if kubectl get statefulset -n vertica verticadb-sample-defaultsubcluster >/dev/null 2>&1; then
-            kubectl rollout status statefulset/verticadb-sample-defaultsubcluster -n vertica --timeout=900s || true
+            kubectl rollout status statefulset/verticadb-sample-defaultsubcluster -n vertica --timeout=1200s || true
+          fi
+          echo "Waiting for Vertica pods to become Ready (2/2)..."
+          if ! kubectl wait --for=condition=Ready pod -l vertica.com/subcluster-name=defaultsubcluster -n vertica --timeout=1200s; then
+            echo "Vertica pods did not become Ready. Dumping diagnostics..."
+            kubectl get pods -n vertica -o wide || true
+            kubectl describe pods -n vertica -l vertica.com/subcluster-name=defaultsubcluster || true
+            for P in $(kubectl get pods -n vertica -l vertica.com/subcluster-name=defaultsubcluster -o jsonpath='{.items[*].metadata.name}'); do
+              echo "--- logs: $P (server)"; kubectl logs -n vertica "$P" -c server || true;
+              echo "--- logs: $P (startup)"; kubectl logs -n vertica "$P" -c startup || true;
+            done
           fi
           echo "Waiting for Vertica service endpoints..."
           for i in {1..180}; do

From 289a26b0811fd488573461ef84bc0d8245a7706b Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 00:44:23 -0500
Subject: [PATCH 15/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98ac0e07..f89cb2ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -211,10 +211,29 @@ jobs:
               - name: defaultsubcluster
                 size: 3
           EOF
-          # Wait for Vertica StatefulSet rollout and pods readiness
+          # Wait for StatefulSet to be created by the operator
+          echo "Waiting for Vertica StatefulSet to be created..."
+          for i in {1..60}; do
+            if kubectl get statefulset -n vertica verticadb-sample-defaultsubcluster >/dev/null 2>&1; then
+              break
+            fi
+            echo "...waiting for StatefulSet"; sleep 5;
+          done
           if kubectl get statefulset -n vertica verticadb-sample-defaultsubcluster >/dev/null 2>&1; then
             kubectl rollout status statefulset/verticadb-sample-defaultsubcluster -n vertica --timeout=1200s || true
+          else
+            echo "StatefulSet was not created. Dumping diagnostics..."
+            kubectl get verticadb -n vertica verticadb-sample -o yaml || true
+            kubectl logs -n vertica deployment/verticadb-operator-controller-manager || true
           fi
+
+          # Wait for pods to be created before checking readiness
+          echo "Waiting for Vertica pods to be created..."
+          for i in {1..60}; do
+            CNT=$(kubectl get pods -n vertica -l vertica.com/subcluster-name=defaultsubcluster -o jsonpath='{.items[*].metadata.name}' | wc -w)
+            if [ "$CNT" -ge 1 ]; then break; fi
+            echo "...waiting for pods"; sleep 5;
+          done
           echo "Waiting for Vertica pods to become Ready (2/2)..."
           if ! kubectl wait --for=condition=Ready pod -l vertica.com/subcluster-name=defaultsubcluster -n vertica --timeout=1200s; then
             echo "Vertica pods did not become Ready. Dumping diagnostics..."

From 8fe202e71d23cc82cece888cd7acdc186b303d16 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 01:12:52 -0500
Subject: [PATCH 16/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f89cb2ab..c7bcc536 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -235,11 +235,11 @@ jobs:
             echo "...waiting for pods"; sleep 5;
           done
           echo "Waiting for Vertica pods to become Ready (2/2)..."
-          if ! kubectl wait --for=condition=Ready pod -l vertica.com/subcluster-name=defaultsubcluster -n vertica --timeout=1200s; then
+          if ! kubectl wait --for=condition=Ready pod -l app.kubernetes.io/instance=verticadb-sample -n vertica --timeout=1200s; then
             echo "Vertica pods did not become Ready. Dumping diagnostics..."
             kubectl get pods -n vertica -o wide || true
-            kubectl describe pods -n vertica -l vertica.com/subcluster-name=defaultsubcluster || true
-            for P in $(kubectl get pods -n vertica -l vertica.com/subcluster-name=defaultsubcluster -o jsonpath='{.items[*].metadata.name}'); do
+            kubectl describe pods -n vertica -l app.kubernetes.io/instance=verticadb-sample || true
+            for P in $(kubectl get pods -n vertica -l app.kubernetes.io/instance=verticadb-sample -o jsonpath='{.items[*].metadata.name}'); do
               echo "--- logs: $P (server)"; kubectl logs -n vertica "$P" -c server || true;
               echo "--- logs: $P (startup)"; kubectl logs -n vertica "$P" -c startup || true;
             done
@@ -251,11 +251,10 @@ jobs:
             echo "...waiting"; sleep 5;
           done
           if [ -z "$EP" ]; then
-            echo "Vertica endpoints did not become ready";
+            echo "Vertica endpoints did not become ready; will port-forward directly to a pod";
             kubectl describe svc verticadb-sample-defaultsubcluster -n vertica || true;
             kubectl get endpoints verticadb-sample-defaultsubcluster -n vertica -o yaml || true;
             kubectl get pods -n vertica -o wide || true;
-            exit 1;
           fi
           kubectl get pods -n vertica -o wide || true
 
@@ -281,8 +280,16 @@ jobs:
 
       - name: Port-forward services (Vertica 5433 and Keycloak 8080)
         run: |
-          # Port-forward Vertica service to localhost:5433
-          nohup kubectl port-forward -n vertica svc/verticadb-sample-defaultsubcluster 5433:5433 >/tmp/pf-vertica.log 2>&1 &
+          # Port-forward Vertica pod (fallback if service endpoints empty)
+          V_POD=$(kubectl get pods -n vertica -l app.kubernetes.io/instance=verticadb-sample -o jsonpath='{.items[0].metadata.name}')
+          if [ -z "$V_POD" ]; then
+            V_POD=$(kubectl get pods -n vertica -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^verticadb-sample-defaultsubcluster-' | head -n1)
+          fi
+          if [ -n "$V_POD" ]; then
+            nohup kubectl port-forward -n vertica pod/$V_POD 5433:5433 >/tmp/pf-vertica.log 2>&1 &
+          else
+            echo "No Vertica pod found for port-forward"; exit 1;
+          fi
           # Port-forward Keycloak service to localhost:8080
           nohup kubectl port-forward -n vertica svc/keycloak 8080:80 >/tmp/pf-keycloak.log 2>&1 &
           sleep 5

From f30d64ff9fffed06f90839f46d4fa924941a385c Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 02:23:04 -0500
Subject: [PATCH 17/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 81 ++++++++++++++++++++++++++++++++--------
 1 file changed, 65 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7bcc536..c3ac54ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -258,25 +258,74 @@ jobs:
           fi
           kubectl get pods -n vertica -o wide || true
 
-      - name: Install Keycloak
+      - name: Install Keycloak (official image)
         run: |
-          helm upgrade --install keycloak bitnami/keycloak \
-            --namespace vertica \
-            --set auth.adminUser=admin \
-            --set auth.adminPassword=admin
-          kubectl wait --for=condition=Ready pod -n vertica -l app.kubernetes.io/name=keycloak --timeout=600s
+          cat <<'EOF' | kubectl apply -f -
+          apiVersion: apps/v1
+          kind: Deployment
+          metadata:
+            name: keycloak
+            namespace: vertica
+            labels:
+              app: keycloak
+          spec:
+            replicas: 1
+            selector:
+              matchLabels:
+                app: keycloak
+            template:
+              metadata:
+                labels:
+                  app: keycloak
+              spec:
+                containers:
+                  - name: keycloak
+                    image: quay.io/keycloak/keycloak:26.0
+                    args: ["start-dev","--http-enabled=true","--http-port=8080","--hostname-strict=false"]
+                    env:
+                      - name: KEYCLOAK_ADMIN
+                        value: admin
+                      - name: KEYCLOAK_ADMIN_PASSWORD
+                        value: admin
+                    ports:
+                      - containerPort: 8080
+                        name: http
+                    readinessProbe:
+                      httpGet:
+                        path: /
+                        port: 8080
+                      initialDelaySeconds: 10
+                      periodSeconds: 5
+          ---
+          apiVersion: v1
+          kind: Service
+          metadata:
+            name: keycloak
+            namespace: vertica
+            labels:
+              app: keycloak
+          spec:
+            selector:
+              app: keycloak
+            ports:
+              - name: http
+                protocol: TCP
+                port: 8080
+                targetPort: 8080
+          EOF
+          kubectl wait --for=condition=Ready pod -n vertica -l app=keycloak --timeout=600s
           kubectl get svc -n vertica keycloak
 
       - name: Configure Keycloak realm, client, and user
         run: |
-          KC_POD=$(kubectl get pods -n vertica -l app.kubernetes.io/name=keycloak -o jsonpath='{.items[0].metadata.name}')
+          KC_POD=$(kubectl get pods -n vertica -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
           kubectl exec -n vertica "$KC_POD" -- bash -lc \
-            "/opt/bitnami/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin && \
-             /opt/bitnami/keycloak/bin/kcadm.sh create realms -s realm=${KC_REALM} -s enabled=true && \
-             /opt/bitnami/keycloak/bin/kcadm.sh update realms/${KC_REALM} -s accessTokenLifespan=3600 && \
-             /opt/bitnami/keycloak/bin/kcadm.sh create users -r ${KC_REALM} -s username=${KC_USER} -s enabled=true && \
-             /opt/bitnami/keycloak/bin/kcadm.sh set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD} && \
-             /opt/bitnami/keycloak/bin/kcadm.sh create clients -r ${KC_REALM} -s clientId=${KC_CLIENT_ID} -s enabled=true -s 'redirectUris=["/*"]' -s 'webOrigins=["/*"]' -s secret=${KC_CLIENT_SECRET} -s directAccessGrantsEnabled=true -o"
+            "/opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin && \
+             /opt/keycloak/bin/kcadm.sh create realms -s realm=${KC_REALM} -s enabled=true && \
+             /opt/keycloak/bin/kcadm.sh update realms/${KC_REALM} -s accessTokenLifespan=3600 && \
+             /opt/keycloak/bin/kcadm.sh create users -r ${KC_REALM} -s username=${KC_USER} -s enabled=true && \
+             /opt/keycloak/bin/kcadm.sh set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD} && \
+             /opt/keycloak/bin/kcadm.sh create clients -r ${KC_REALM} -s clientId=${KC_CLIENT_ID} -s enabled=true -s 'redirectUris=["/*"]' -s 'webOrigins=["/*"]' -s secret=${KC_CLIENT_SECRET} -s directAccessGrantsEnabled=true -o"
 
       - name: Port-forward services (Vertica 5433 and Keycloak 8080)
         run: |
@@ -291,7 +340,7 @@ jobs:
             echo "No Vertica pod found for port-forward"; exit 1;
           fi
           # Port-forward Keycloak service to localhost:8080
-          nohup kubectl port-forward -n vertica svc/keycloak 8080:80 >/tmp/pf-keycloak.log 2>&1 &
+          nohup kubectl port-forward -n vertica svc/keycloak 8080:8080 >/tmp/pf-keycloak.log 2>&1 &
           sleep 5
           echo "PF logs:" && tail -n +1 /tmp/pf-*.log || true
 
@@ -303,8 +352,8 @@ jobs:
             kubectl get pods -n vertica -o wide;
             exit 1;
           fi
-          DISCOVERY_URL="http://keycloak.vertica.svc.cluster.local/realms/${KC_REALM}/.well-known/openid-configuration"
-          INTROSPECT_URL="http://keycloak.vertica.svc.cluster.local/realms/${KC_REALM}/protocol/openid-connect/token/introspect"
+          DISCOVERY_URL="http://keycloak.vertica.svc.cluster.local:8080/realms/${KC_REALM}/.well-known/openid-configuration"
+          INTROSPECT_URL="http://keycloak.vertica.svc.cluster.local:8080/realms/${KC_REALM}/protocol/openid-connect/token/introspect"
           kubectl exec -n vertica "$V_POD" -- bash -lc \
             "/opt/vertica/bin/vsql -c \"CREATE AUTHENTICATION v_oauth METHOD 'oauth' HOST '0.0.0.0/0';\" && \
              /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET client_id='${KC_CLIENT_ID}';\" && \

From a89b1c531d2d8efd9cfda4dc054bfaef47794660 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 04:36:34 -0500
Subject: [PATCH 18/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3ac54ef..b3828152 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -319,13 +319,29 @@ jobs:
       - name: Configure Keycloak realm, client, and user
         run: |
           KC_POD=$(kubectl get pods -n vertica -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
-          kubectl exec -n vertica "$KC_POD" -- bash -lc \
-            "/opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin && \
-             /opt/keycloak/bin/kcadm.sh create realms -s realm=${KC_REALM} -s enabled=true && \
-             /opt/keycloak/bin/kcadm.sh update realms/${KC_REALM} -s accessTokenLifespan=3600 && \
-             /opt/keycloak/bin/kcadm.sh create users -r ${KC_REALM} -s username=${KC_USER} -s enabled=true && \
-             /opt/keycloak/bin/kcadm.sh set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD} && \
-             /opt/keycloak/bin/kcadm.sh create clients -r ${KC_REALM} -s clientId=${KC_CLIENT_ID} -s enabled=true -s 'redirectUris=["/*"]' -s 'webOrigins=["/*"]' -s secret=${KC_CLIENT_SECRET} -s directAccessGrantsEnabled=true -o"
+          kubectl exec -n vertica "$KC_POD" -- bash -lc '
+            set -euo pipefail
+            KC=/opt/keycloak/bin/kcadm.sh
+            # Wait for admin API to be ready
+            for i in {1..60}; do
+              if $KC config credentials --server http://localhost:8080 --realm master --user admin --password admin >/dev/null 2>&1; then
+                break
+              fi
+              echo "...waiting for Keycloak admin API"; sleep 3;
+            done
+            # Idempotent realm, user, client setup
+            $KC create realms -s realm='${KC_REALM}' -s enabled=true || true
+            $KC update realms/${KC_REALM} -s accessTokenLifespan=3600 || true
+            $KC create users -r ${KC_REALM} -s username='${KC_USER}' -s enabled=true || true
+            $KC set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD} --temporary=false || true
+            # Create confidential client for password grant
+            $KC create clients -r ${KC_REALM} \
+              -s clientId='${KC_CLIENT_ID}' -s enabled=true \
+              -s protocol=openid-connect -s publicClient=false \
+              -s secret='${KC_CLIENT_SECRET}' \
+              -s directAccessGrantsEnabled=true || true
+            echo "Keycloak realm and client configured"
+          '
 
       - name: Port-forward services (Vertica 5433 and Keycloak 8080)
         run: |

From 5a2751378e32dbbf53f879c4fd51305529ac6263 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 05:41:19 -0500
Subject: [PATCH 19/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b3828152..6f703f99 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -319,7 +319,13 @@ jobs:
       - name: Configure Keycloak realm, client, and user
         run: |
           KC_POD=$(kubectl get pods -n vertica -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
-          kubectl exec -n vertica "$KC_POD" -- bash -lc '
+          kubectl exec -n vertica "$KC_POD" -- env \
+            KC_REALM="${KC_REALM}" \
+            KC_USER="${KC_USER}" \
+            KC_PASSWORD="${KC_PASSWORD}" \
+            KC_CLIENT_ID="${KC_CLIENT_ID}" \
+            KC_CLIENT_SECRET="${KC_CLIENT_SECRET}" \
+            bash -lc '
             set -euo pipefail
             KC=/opt/keycloak/bin/kcadm.sh
             # Wait for admin API to be ready
@@ -330,15 +336,15 @@ jobs:
               echo "...waiting for Keycloak admin API"; sleep 3;
             done
             # Idempotent realm, user, client setup
-            $KC create realms -s realm='${KC_REALM}' -s enabled=true || true
+            $KC create realms -s realm="${KC_REALM}" -s enabled=true || true
             $KC update realms/${KC_REALM} -s accessTokenLifespan=3600 || true
-            $KC create users -r ${KC_REALM} -s username='${KC_USER}' -s enabled=true || true
-            $KC set-password -r ${KC_REALM} --username ${KC_USER} --new-password ${KC_PASSWORD} --temporary=false || true
+            $KC create users -r ${KC_REALM} -s username="${KC_USER}" -s enabled=true || true
+            $KC set-password -r ${KC_REALM} --username "${KC_USER}" --new-password "${KC_PASSWORD}" --temporary=false || true
             # Create confidential client for password grant
             $KC create clients -r ${KC_REALM} \
-              -s clientId='${KC_CLIENT_ID}' -s enabled=true \
+              -s clientId="${KC_CLIENT_ID}" -s enabled=true \
               -s protocol=openid-connect -s publicClient=false \
-              -s secret='${KC_CLIENT_SECRET}' \
+              -s secret="${KC_CLIENT_SECRET}" \
               -s directAccessGrantsEnabled=true || true
             echo "Keycloak realm and client configured"
           '

From 3bc4449ba72e05c4199ccbcdc4cefc56a5ef3c73 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Wed, 14 Jan 2026 06:28:35 -0500
Subject: [PATCH 20/27] fixed the pipeline issue

---
 .github/workflows/ci.yml | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f703f99..c7ab3e92 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -376,18 +376,28 @@ jobs:
           fi
           DISCOVERY_URL="http://keycloak.vertica.svc.cluster.local:8080/realms/${KC_REALM}/.well-known/openid-configuration"
           INTROSPECT_URL="http://keycloak.vertica.svc.cluster.local:8080/realms/${KC_REALM}/protocol/openid-connect/token/introspect"
-          kubectl exec -n vertica "$V_POD" -- bash -lc \
-            "/opt/vertica/bin/vsql -c \"CREATE AUTHENTICATION v_oauth METHOD 'oauth' HOST '0.0.0.0/0';\" && \
-             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET client_id='${KC_CLIENT_ID}';\" && \
-             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET client_secret='${KC_CLIENT_SECRET}';\" && \
-             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET discovery_url='${DISCOVERY_URL}';\" && \
-             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_oauth SET introspect_url='${INTROSPECT_URL}';\" && \
-             /opt/vertica/bin/vsql -c \"CREATE USER ${KC_USER};\" && \
-             /opt/vertica/bin/vsql -c \"GRANT AUTHENTICATION v_oauth TO ${KC_USER};\" && \
-             /opt/vertica/bin/vsql -c \"GRANT ALL ON SCHEMA PUBLIC TO ${KC_USER};\" && \
-             /opt/vertica/bin/vsql -c \"CREATE AUTHENTICATION v_dbadmin_hash METHOD 'hash' HOST '0.0.0.0/0';\" && \
-             /opt/vertica/bin/vsql -c \"ALTER AUTHENTICATION v_dbadmin_hash PRIORITY 10000;\" && \
-             /opt/vertica/bin/vsql -c \"GRANT AUTHENTICATION v_dbadmin_hash TO dbadmin;\""
+          kubectl exec -n vertica -c server "$V_POD" -- bash -lc '
+            set -euo pipefail
+            VSQL="/opt/vertica/bin/vsql -h 127.0.0.1 -p 5433 -U dbadmin -d vdb"
+            # Wait for Vertica to accept connections
+            for i in {1..120}; do
+              if $VSQL -c "select 1" >/dev/null 2>&1; then
+                echo "Vertica is accepting connections"; break;
+              fi
+              echo "...waiting for Vertica to accept connections"; sleep 5;
+            done
+            $VSQL -c "CREATE AUTHENTICATION v_oauth METHOD 'oauth' HOST '0.0.0.0/0';" || true
+            $VSQL -c "ALTER AUTHENTICATION v_oauth SET client_id='${KC_CLIENT_ID}';"
+            $VSQL -c "ALTER AUTHENTICATION v_oauth SET client_secret='${KC_CLIENT_SECRET}';"
+            $VSQL -c "ALTER AUTHENTICATION v_oauth SET discovery_url='${DISCOVERY_URL}';"
+            $VSQL -c "ALTER AUTHENTICATION v_oauth SET introspect_url='${INTROSPECT_URL}';"
+            $VSQL -c "CREATE USER ${KC_USER};" || true
+            $VSQL -c "GRANT AUTHENTICATION v_oauth TO ${KC_USER};"
+            $VSQL -c "GRANT ALL ON SCHEMA PUBLIC TO ${KC_USER};"
+            $VSQL -c "CREATE AUTHENTICATION v_dbadmin_hash METHOD 'hash' HOST '0.0.0.0/0';" || true
+            $VSQL -c "ALTER AUTHENTICATION v_dbadmin_hash PRIORITY 10000;"
+            $VSQL -c "GRANT AUTHENTICATION v_dbadmin_hash TO dbadmin;"
+          '
 
       - name: Retrieve OAuth access token
         run: |

From 2b928284f2115be8527cafbc04260a7393bacf5a Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sat, 17 Jan 2026 07:26:51 -0500
Subject: [PATCH 21/27] fixed pipeline issue

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7ab3e92..cb4f3ef6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -144,7 +144,7 @@ jobs:
                 targetPort: 9000
           EOF
 
-          # Wait for MinIO to be ready
+          # Wait for MinIO to be ready state
           if ! kubectl wait --for=condition=Ready pod -l app=minio -n vertica --timeout=900s; then
             echo 'MinIO failed to become Ready. Dumping diagnostics...'
             kubectl get pods -n vertica -l app=minio -o wide || true

From 3b7dfc290f4b1a46b61ded86203310e487d3aa85 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sat, 17 Jan 2026 07:35:41 -0500
Subject: [PATCH 22/27] fixed the pipelie issue

---
 .github/workflows/ci.yml | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb4f3ef6..34a5f92b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,7 @@ env:
   V_PORT: 5433
   V_USER: dbadmin
   V_DATABASE: vdb
+  V_LICENSE_SECRET: vertica-license
   KC_REALM: test
   KC_USER: oauth_user
   KC_PASSWORD: password
@@ -144,7 +145,7 @@ jobs:
                 targetPort: 9000
           EOF
 
-          # Wait for MinIO to be ready state
+          # Wait for MinIO to be ready
           if ! kubectl wait --for=condition=Ready pod -l app=minio -n vertica --timeout=900s; then
             echo 'MinIO failed to become Ready. Dumping diagnostics...'
             kubectl get pods -n vertica -l app=minio -o wide || true
@@ -192,6 +193,24 @@ jobs:
           kubectl get svc -n vertica verticadb-operator-webhook-service || true
           kubectl get pods -n vertica
 
+      - name: Create Vertica license secret
+        if: ${{ secrets.VERTICA_LICENSE != '' || secrets.VERTICA_LICENSE_B64 != '' }}
+        run: |
+          set -euo pipefail
+          kubectl delete secret -n vertica ${V_LICENSE_SECRET} --ignore-not-found
+          LIC_FILE=/tmp/vertica.license
+          if [ -n "${{ secrets.VERTICA_LICENSE }}" ]; then
+            # Plain-text license content
+            printf "%s" "${{ secrets.VERTICA_LICENSE }}" > "$LIC_FILE"
+          elif [ -n "${{ secrets.VERTICA_LICENSE_B64 }}" ]; then
+            # Base64-encoded license content
+            printf "%s" "${{ secrets.VERTICA_LICENSE_B64 }}" | base64 -d > "$LIC_FILE"
+          else
+            echo "No Vertica license secret provided"; exit 1;
+          fi
+          test -s "$LIC_FILE" || (echo "License file is empty"; exit 1)
+          kubectl create secret generic ${V_LICENSE_SECRET} -n vertica --from-file=license="$LIC_FILE"
+
       - name: Deploy VerticaDB
         run: |
           cat <<'EOF' | kubectl apply -f -
@@ -203,6 +222,7 @@ jobs:
           spec:
             image: opentext/vertica-k8s:latest
             dbName: vdb
+            licenseSecret: vertica-license
             communal:
               path: s3://communal
               credentialSecret: communal-creds

From 9c0ed7750cfdc13be113ff96d6c3e105b41b53b8 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sat, 17 Jan 2026 07:40:26 -0500
Subject: [PATCH 23/27] fixed the pipelie issue

---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 34a5f92b..09dfe52c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -194,7 +194,6 @@ jobs:
           kubectl get pods -n vertica
 
       - name: Create Vertica license secret
-        if: ${{ secrets.VERTICA_LICENSE != '' || secrets.VERTICA_LICENSE_B64 != '' }}
         run: |
           set -euo pipefail
           kubectl delete secret -n vertica ${V_LICENSE_SECRET} --ignore-not-found

From d34ac84d9f45eb15dbcc976b72d8c9d419eacc3d Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sat, 17 Jan 2026 07:46:40 -0500
Subject: [PATCH 24/27] fixed the pipelie issue

---
 .github/workflows/ci.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09dfe52c..fd60149a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,18 +56,28 @@ jobs:
           done
           yarn lerna bootstrap
 
+      - name: Check Vertica license secrets
+        id: license
+        run: |
+          HAS=false
+          if [ -n "${{ secrets.VERTICA_LICENSE }}" ] || [ -n "${{ secrets.VERTICA_LICENSE_B64 }}" ]; then HAS=true; fi
+          echo "has_license=$HAS" >> $GITHUB_OUTPUT
+
       - name: Create KinD cluster
+        if: steps.license.outputs.has_license == 'true'
         uses: helm/kind-action@v1.10.0
         with:
           cluster_name: vertica-ci
           wait: 180s
 
       - name: Setup Helm
+        if: steps.license.outputs.has_license == 'true'
         uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Add Helm repos
+        if: steps.license.outputs.has_license == 'true'
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
           helm repo add vertica-charts https://vertica.github.io/charts
@@ -75,10 +85,12 @@ jobs:
           helm repo update
 
       - name: Create namespace
+        if: steps.license.outputs.has_license == 'true'
         run: |
           kubectl create namespace vertica || true
 
       - name: Install MinIO (communal storage)
+        if: steps.license.outputs.has_license == 'true'
         run: |
           cat <<'EOF' | kubectl apply -f -
           apiVersion: apps/v1
@@ -156,6 +168,7 @@ jobs:
           kubectl get svc -n vertica minio
 
       - name: Create communal bucket in MinIO
+        if: steps.license.outputs.has_license == 'true'
         run: |
           # Create communal bucket using env alias to avoid needing shell
           kubectl run -n vertica mc-mb --image=minio/mc:latest --restart=Never \
@@ -166,6 +179,7 @@ jobs:
             --attach=true --rm -- mc ls local
 
       - name: Create communal credentials secret
+        if: steps.license.outputs.has_license == 'true'
         run: |
           kubectl delete secret -n vertica communal-creds --ignore-not-found
           kubectl create secret generic communal-creds -n vertica \
@@ -173,6 +187,7 @@ jobs:
             --from-literal=secretAccessKey=minio123
 
       - name: Install cert-manager (for operator webhooks)
+        if: steps.license.outputs.has_license == 'true'
         run: |
           kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.crds.yaml
           helm upgrade --install cert-manager jetstack/cert-manager -n cert-manager --create-namespace --set installCRDs=false
@@ -180,6 +195,7 @@ jobs:
           kubectl get pods -n cert-manager
 
       - name: Install Vertica Operator
+        if: steps.license.outputs.has_license == 'true'
         run: |
           helm upgrade --install vertica-operator vertica-charts/verticadb-operator -n vertica --create-namespace
           kubectl wait --for=condition=Available deployment/verticadb-operator-controller-manager -n vertica --timeout=600s || true
@@ -194,6 +210,7 @@ jobs:
           kubectl get pods -n vertica
 
       - name: Create Vertica license secret
+        if: steps.license.outputs.has_license == 'true'
         run: |
           set -euo pipefail
           kubectl delete secret -n vertica ${V_LICENSE_SECRET} --ignore-not-found
@@ -211,6 +228,7 @@ jobs:
           kubectl create secret generic ${V_LICENSE_SECRET} -n vertica --from-file=license="$LIC_FILE"
 
       - name: Deploy VerticaDB
+        if: steps.license.outputs.has_license == 'true'
         run: |
           cat <<'EOF' | kubectl apply -f -
           apiVersion: vertica.com/v1
@@ -278,6 +296,7 @@ jobs:
           kubectl get pods -n vertica -o wide || true
 
       - name: Install Keycloak (official image)
+        if: steps.license.outputs.has_license == 'true'
         run: |
           cat <<'EOF' | kubectl apply -f -
           apiVersion: apps/v1
@@ -336,6 +355,7 @@ jobs:
           kubectl get svc -n vertica keycloak
 
       - name: Configure Keycloak realm, client, and user
+        if: steps.license.outputs.has_license == 'true'
         run: |
           KC_POD=$(kubectl get pods -n vertica -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
           kubectl exec -n vertica "$KC_POD" -- env \
@@ -369,6 +389,7 @@ jobs:
           '
 
       - name: Port-forward services (Vertica 5433 and Keycloak 8080)
+        if: steps.license.outputs.has_license == 'true'
         run: |
           # Port-forward Vertica pod (fallback if service endpoints empty)
           V_POD=$(kubectl get pods -n vertica -l app.kubernetes.io/instance=verticadb-sample -o jsonpath='{.items[0].metadata.name}')
@@ -386,6 +407,7 @@ jobs:
           echo "PF logs:" && tail -n +1 /tmp/pf-*.log || true
 
       - name: Configure Vertica OAuth and create user
+        if: steps.license.outputs.has_license == 'true'
         run: |
           V_POD=$(kubectl get pods -n vertica -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^verticadb-sample-defaultsubcluster-' | head -n1)
           if [ -z "$V_POD" ]; then
@@ -419,6 +441,7 @@ jobs:
           '
 
       - name: Retrieve OAuth access token
+        if: steps.license.outputs.has_license == 'true'
         run: |
           echo "Waiting for Keycloak to accept connections..." && sleep 5
           curl --retry 10 --retry-delay 3 --retry-all-errors \
@@ -448,7 +471,13 @@ jobs:
           yarn test
 
       - name: test-vertica-nodejs
+        if: steps.license.outputs.has_license == 'true'
         run: |
           export VTEST_OAUTH_ACCESS_TOKEN="$(cat ${GITHUB_WORKSPACE}/access_token.txt)"
           cd packages/vertica-nodejs
           yarn test
+
+      - name: Skip DB tests (no license secret)
+        if: steps.license.outputs.has_license != 'true'
+        run: |
+          echo "No Vertica license secret provided; skipping VerticaDB, Keycloak, and vertica-nodejs integration tests."

From b5bbc9d1dac157b2434c8f16a7d93501f7090992 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sat, 17 Jan 2026 07:52:31 -0500
Subject: [PATCH 25/27] fixed the pipelie issue

---
 .github/workflows/ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd60149a..f15cc6a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,8 +73,7 @@ jobs:
       - name: Setup Helm
         if: steps.license.outputs.has_license == 'true'
         uses: azure/setup-helm@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+
 
       - name: Add Helm repos
         if: steps.license.outputs.has_license == 'true'

From c53f5d34448bda36964cf402991f00d7a6c3d587 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sat, 17 Jan 2026 07:54:52 -0500
Subject: [PATCH 26/27] fixed the pipelie issue

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f15cc6a8..0e090715 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -460,6 +460,7 @@ jobs:
           yarn test
 
       - name: test-v-pool
+        if: steps.license.outputs.has_license == 'true'
         run: |
           cd packages/v-pool
           yarn test

From 54aaff778b5e07544bd12ded78b236412bfc5a70 Mon Sep 17 00:00:00 2001
From: sharmagot <sharmag@opentext.com>
Date: Sun, 1 Feb 2026 23:46:11 -0500
Subject: [PATCH 27/27] Make client_os test more robust by checking for OS
 components instead of exact string

---
 .../connection-parameters/client-os-tests.js  | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 packages/vertica-nodejs/test/unit/connection-parameters/client-os-tests.js

diff --git a/packages/vertica-nodejs/test/unit/connection-parameters/client-os-tests.js b/packages/vertica-nodejs/test/unit/connection-parameters/client-os-tests.js
new file mode 100644
index 00000000..c932d48b
--- /dev/null
+++ b/packages/vertica-nodejs/test/unit/connection-parameters/client-os-tests.js
@@ -0,0 +1,55 @@
+'use strict'
+const helper = require('../test-helper')
+const assert = require('assert')
+const os = require('os')
+const ConnectionParameters = require('../../../lib/connection-parameters')
+
+const suite = new helper.Suite()
+
+suite.test('client_os provides detailed OS string', function () {
+  const subject = new ConnectionParameters()
+  const value = subject.client_os
+
+  assert.ok(value.includes(os.type()), `Expected "${value}" to include os.type()`)
+  assert.ok(value.includes(os.release()), `Expected "${value}" to include os.release()`)
+  assert.ok(value.includes(os.arch()), `Expected "${value}" to include os.arch()`)
+})
+
+suite.test('client_os falls back to os.platform() when detailed retrieval fails', function () {
+  const originalType = os.type
+  const originalRelease = os.release
+  const originalArch = os.arch
+  try {
+    os.type = function () { throw new Error('type fail') }
+    os.release = function () { throw new Error('release fail') }
+    os.arch = function () { throw new Error('arch fail') }
+
+    const subject = new ConnectionParameters()
+    assert.equal(subject.client_os, os.platform())
+  } finally {
+    os.type = originalType
+    os.release = originalRelease
+    os.arch = originalArch
+  }
+})
+
+suite.test('client_os uses "unknown" when both detailed and platform retrieval fail', function () {
+  const originalType = os.type
+  const originalRelease = os.release
+  const originalArch = os.arch
+  const originalPlatform = os.platform
+  try {
+    os.type = function () { throw new Error('type fail') }
+    os.release = function () { throw new Error('release fail') }
+    os.arch = function () { throw new Error('arch fail') }
+    os.platform = function () { throw new Error('platform fail') }
+
+    const subject = new ConnectionParameters()
+    assert.equal(subject.client_os, 'unknown')
+  } finally {
+    os.type = originalType
+    os.release = originalRelease
+    os.arch = originalArch
+    os.platform = originalPlatform
+  }
+})