lasdf1234 opened a new issue, #12297:
URL: https://github.com/apache/gravitino/issues/12297
### Describe the proposal
Provide pluggable management for entity connection secrets (catalog / schema
/
fileset properties such as JDBC passwords), so secret material is not stored
as
plaintext in metadata.
Approach (see design PR #12249):
- `GravitinoSecretProvider` SPI for write / read / delete behind durable URNs
- Named providers loaded from server configuration
- REST create/alter marks secrets via `secretBindings` / `secretReferences`
(and alter `@type`s); persistence stores URN strings only
- GET/list omit secret keys; server resolves secrets on use
Related prior discussions: #4681, #8850.
### Task list
- [ ] #12218 Add `GravitinoSecretProvider` SPI and in-memory provider
- [ ] Provider registry + `GET /configs/secrets/providers` discovery
- [ ] Resolve by URN recognition + omit-on-read on GET/list
- [ ] Write-through on create/alter (persist URN, call `writeSecret`)
- [ ] Entity REST (catalog / schema / fileset): secret maps, alter `@type`s,
drop/`removeProperty` cleanup; OpenAPI / clients
- [ ] Wire server-side resolve into catalog / connector load paths
- [ ] Docs and integration tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
