This is an automated email from the ASF dual-hosted git repository.
rmetzger pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new 14d9e6bcc57 [FLINK-38261] add catalog connection resource (#27504)
14d9e6bcc57 is described below
commit 14d9e6bcc57109589bf69773e5fcd4d0db01bad3
Author: Hao Li <[email protected]>
AuthorDate: Sat Mar 21 01:59:50 2026 -0700
[FLINK-38261] add catalog connection resource (#27504)
* [FLINK-38261] add catalog connection resource
* comments
---
.../flink/table/catalog/CatalogConnection.java | 73 +++++++++++++++++++
.../apache/flink/table/catalog/CatalogModel.java | 1 +
.../table/catalog/DefaultCatalogConnection.java | 78 ++++++++++++++++++++
.../table/catalog/DefaultSensitiveConnection.java | 83 ++++++++++++++++++++++
.../flink/table/catalog/SensitiveConnection.java | 68 ++++++++++++++++++
5 files changed, 303 insertions(+)
diff --git
a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogConnection.java
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogConnection.java
new file mode 100644
index 00000000000..24d4aefc688
--- /dev/null
+++
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogConnection.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.flink.table.catalog;
+
+import org.apache.flink.annotation.PublicEvolving;
+import org.apache.flink.table.secret.SecretStore;
+
+import javax.annotation.Nullable;
+
+import java.util.Map;
+
+/**
+ * Interface for a connection stored in a catalog.
+ *
+ * <p>A {@link CatalogConnection} contains non-sensitive connection
configuration that can be safely
+ * persisted in the catalog. Sensitive credentials are extracted and replaced
with identifier
+ * references to external secret management systems via the {@link
SecretStore}. See {@link
+ * SensitiveConnection} for connection containing sensitive information.
+ */
+@PublicEvolving
+public interface CatalogConnection {
+
+ /**
+ * Returns a map of string-based connection options.
+ *
+ * <p>These options contain non-sensitive configuration. Any sensitive
values (passwords,
+ * tokens, etc.) are replaced with references to {@link SecretStore}.
+ *
+ * @return connection options without plain secrets
+ */
+ Map<String, String> getOptions();
+
+ /**
+ * Get comment of the connection.
+ *
+ * @return comment of the connection
+ */
+ @Nullable
+ String getComment();
+
+ /**
+ * Get a deep copy of the CatalogConnection instance.
+ *
+ * @return a copy of the CatalogConnection instance
+ */
+ CatalogConnection copy();
+
+ /**
+ * Creates a basic implementation of this interface.
+ *
+ * @param options connection options without plain secrets
+ * @param comment optional comment
+ */
+ static CatalogConnection of(Map<String, String> options, @Nullable String
comment) {
+ return new DefaultCatalogConnection(options, comment);
+ }
+}
diff --git
a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogModel.java
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogModel.java
index fa8b32e4d90..832521b993b 100644
---
a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogModel.java
+++
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/CatalogModel.java
@@ -50,6 +50,7 @@ public interface CatalogModel {
*
* @return comment of the model.
*/
+ @Nullable
String getComment();
/**
diff --git
a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/DefaultCatalogConnection.java
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/DefaultCatalogConnection.java
new file mode 100644
index 00000000000..9d2ff332321
--- /dev/null
+++
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/DefaultCatalogConnection.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.flink.table.catalog;
+
+import org.apache.flink.annotation.Internal;
+
+import javax.annotation.Nullable;
+
+import java.util.Map;
+import java.util.Objects;
+
+import static org.apache.flink.util.Preconditions.checkNotNull;
+
+/** A catalog connection implementation. */
+@Internal
+public class DefaultCatalogConnection implements CatalogConnection {
+
+ private final Map<String, String> options;
+ private final @Nullable String comment;
+
+ protected DefaultCatalogConnection(Map<String, String> options, @Nullable
String comment) {
+ this.options = checkNotNull(options, "Options must not be null.");
+ this.comment = comment;
+ }
+
+ @Override
+ public Map<String, String> getOptions() {
+ return options;
+ }
+
+ @Override
+ public String getComment() {
+ return comment;
+ }
+
+ @Override
+ public CatalogConnection copy() {
+ return new DefaultCatalogConnection(this.options, this.comment);
+ }
+
+ @Override
+ public boolean equals(Object o) {
+ if (this == o) {
+ return true;
+ }
+ if (o == null || getClass() != o.getClass()) {
+ return false;
+ }
+ DefaultCatalogConnection that = (DefaultCatalogConnection) o;
+ return options.equals(that.options) && Objects.equals(comment,
that.comment);
+ }
+
+ @Override
+ public int hashCode() {
+ return Objects.hash(options, comment);
+ }
+
+ @Override
+ public String toString() {
+ return "DefaultCatalogConnection{" + "options=" + options + ",
comment=" + comment + "}";
+ }
+}
diff --git
a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/DefaultSensitiveConnection.java
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/DefaultSensitiveConnection.java
new file mode 100644
index 00000000000..c17f4f41eba
--- /dev/null
+++
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/DefaultSensitiveConnection.java
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.flink.table.catalog;
+
+import org.apache.flink.annotation.Internal;
+
+import javax.annotation.Nullable;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+import static org.apache.flink.util.Preconditions.checkNotNull;
+
+/** A sensitive connection implementation. */
+@Internal
+public class DefaultSensitiveConnection implements SensitiveConnection {
+
+ private final Map<String, String> options;
+ private final @Nullable String comment;
+
+ protected DefaultSensitiveConnection(Map<String, String> options,
@Nullable String comment) {
+ this.options = checkNotNull(options, "Options must not be null.");
+ this.comment = comment;
+ }
+
+ @Override
+ public Map<String, String> getOptions() {
+ return options;
+ }
+
+ @Override
+ public String getComment() {
+ return comment;
+ }
+
+ @Override
+ public boolean equals(Object o) {
+ if (this == o) {
+ return true;
+ }
+ if (o == null || getClass() != o.getClass()) {
+ return false;
+ }
+ DefaultSensitiveConnection that = (DefaultSensitiveConnection) o;
+ return options.equals(that.options) && Objects.equals(comment,
that.comment);
+ }
+
+ @Override
+ public int hashCode() {
+ return Objects.hash(options, comment);
+ }
+
+ @Override
+ public String toString() {
+ String maskedOptions =
+ options.entrySet().stream()
+ .collect(Collectors.toMap(Map.Entry::getKey, e ->
"****"))
+ .toString();
+ return "DefaultSensitiveConnection{"
+ + "options="
+ + maskedOptions
+ + ", comment="
+ + comment
+ + "}";
+ }
+}
diff --git
a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/SensitiveConnection.java
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/SensitiveConnection.java
new file mode 100644
index 00000000000..f7bb3c7cd61
--- /dev/null
+++
b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/catalog/SensitiveConnection.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.flink.table.catalog;
+
+import org.apache.flink.annotation.PublicEvolving;
+
+import javax.annotation.Nullable;
+
+import java.util.Map;
+
+/**
+ * Interface for a connection with resolved secrets.
+ *
+ * <p>A {@link SensitiveConnection} represents a complete connection
configuration with all secrets
+ * resolved and available as plain values. This interface is used temporarily
during connection
+ * resolution, merging catalog metadata with retrieved credential material.
+ *
+ * <p>This structure exists only at runtime and should never be persisted to
prevent credential
+ * exposure in storage systems.
+ */
+@PublicEvolving
+public interface SensitiveConnection {
+
+ /**
+ * Returns a map of string-based connection options.
+ *
+ * <p>These options contain the complete connection configuration
including plain secrets.
+ * Secret references from the {@link CatalogConnection} are replaced with
their actual values
+ * retrieved from external secret management systems.
+ *
+ * @return connection options with resolved plain secrets
+ */
+ Map<String, String> getOptions();
+
+ /**
+ * Get comment of the connection.
+ *
+ * @return comment of the connection
+ */
+ @Nullable
+ String getComment();
+
+ /**
+ * Creates a basic implementation of this interface.
+ *
+ * @param options connection options with resolved plain secrets
+ * @param comment optional comment
+ */
+ static SensitiveConnection of(Map<String, String> options, @Nullable
String comment) {
+ return new DefaultSensitiveConnection(options, comment);
+ }
+}
