nevzheng opened a new issue, #14393: URL: https://github.com/apache/gravitino/issues/14393
### What would you like to be improved? **Priority: P1** (scale in the parent epic; impact if hit, not scheduling) When a job is enqueued, the [drop path](https://github.com/apache/gravitino/blob/bb634defdc5663a8124be5fca1c8d9e52ac096ac/iceberg/iceberg-rest-server/src/main/java/org/apache/gravitino/iceberg/service/dispatcher/IcebergTableOperationExecutor.java#L166) copies `getIcebergCatalogProperties()`, which is the full catalog configuration, into the row. [IcebergCleanupJobPO](https://github.com/apache/gravitino/blob/bb634defdc5663a8124be5fca1c8d9e52ac096ac/iceberg/iceberg-rest-server/src/main/java/org/apache/gravitino/iceberg/service/cleanup/po/IcebergCleanupJobPO.java#L78) writes it as plain JSON into `iceberg_cleanup_job.file_io_props`. Observed symptoms (reproduced by a test in the parent epic): | Symptom | Effect | | ------- | ------ | | Secrets such as `s3-secret-access-key` and `jdbc-password` are stored unmasked, kept until the job ends plus `async-cleanup.retention-hours` (720 h by default), and readable by anyone with access to the entity store database or its backups. | Credential exposure. | | When the catalog's credentials are rotated, pending jobs keep using the old copy. | Their storage calls fail, and the jobs end `FAILED`. | ### How should we improve? Store the catalog id, which is already in the row, and rebuild FileIO from the current catalog configuration when the job runs. Only fall back to stored properties, encrypted, if the catalog no longer exists. Filed for discussion and prioritization; no fix is scheduled as part of this report. Parent: the async purge audit epic. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
