lasdf1234 commented on issue #12921: URL: https://github.com/apache/gravitino/issues/12921#issuecomment-5537779607
After my investigation, the following problems were identified: 1. There is a real gap today: /configs/secrets/providers is mounted outside /api/*, so it bypasses authentication and audit. Unauthenticated callers can retrieve the full provider registry, including internal uri values. 2. It is not the same class of API as public GET /configs: /configs exists for the UI before login and is bounded by an explicit allowlist. The secrets-providers response exposes infrastructure topology and must not be anonymous discovery. 3. “Admin-only” requires the /api path: Without /api, there is no authenticated principal, so a serviceAdmin check is impossible. Keeping the endpoint under /configs cannot provide real authorization. 4. The privilege must match the scope: The provider registry is process-global configuration, not a metalake resource. In Gravitino, the matching global admin role is serviceAdmin. 5. Industry practice supports a management-plane API: Polaris does not expose this kind of provider list. Databricks / Unity Catalog keep encryption-key configuration listing on the account management plane for admin-level identities, not for anonymous or ordinary users. Conclusion: Moving under /api has additional benefits: The existing authentication filter and audit pipeline apply automatically, which improves compliance and traceability. The old anonymous path should be removed or deprecated so a second unprotected entry point does not remain. @jerryshao @markhoerth @roryqi What do you think? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
