lasdf1234 opened a new pull request, #12366:
URL: https://github.com/apache/gravitino/pull/12366
### What changes were proposed in this pull request?
- Add create-time `secretBindings` / `secretReferences` for catalog, schema,
and fileset (API, DTOs, OpenAPI, Java/Python clients, REST, dispatchers).
- Introduce `SecretManager` for write-through / external-ref lifecycle
(`getSecretBindingUrns`, `getSecretReferenceUrns`, `writeSecrets`,
`rollbackWritten`).
- Introduce `SecretPropertyUtils` for request checks, URN recognition, and
applying URNs into properties.
- Nest `secretBindings` as `Map<String, Map<String, String>>` with
`provider` + `value`, so plaintext is not carried in `properties`.
- On create failure, roll back write-through secrets via `needSecretClean`.
### Why are the changes needed?
Entity create needs a typed way to bind secrets (write-through or external
reference) without leaving plaintext in persisted properties. This is part of
epic #12297.
Fix: #12297
### Does this PR introduce _any_ user-facing change?
- Yes. Create APIs / REST requests gain optional `secretBindings` and
`secretReferences`.
- `secretBindings` shape: property key → `{ "provider": "...", "value":
"..." }`.
- Persisted property values for those keys become secret URNs; GET paths
continue to hide secret URN properties.
### How was this patch tested?
- Unit tests: `TestSecretManager` and related create/DTO/REST test updates.
- `./gradlew :core:test --tests
org.apache.gravitino.secret.TestSecretManager -PskipITs`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
