This is an automated email from the ASF dual-hosted git repository. liyang-kylin pushed a commit to branch kylin5 in repository https://gitbox.apache.org/repos/asf/kylin.git
commit 88dd503d0221a07c6b161ee807f5cdcf7378dec0 Author: Li Yang <[email protected]> AuthorDate: Mon Oct 5 17:26:03 2026 +0800 KYLIN-6117 derive a default broadcast token for zero-config internal RPC Fall back to a cluster-wide token derived from the shared metadata location when kylin.server.broadcast-token is not set, so multi-node broadcast and the internal metadata-backup RPC keep working after an upgrade without extra configuration. An explicitly configured token still overrides the default. --- .../java/org/apache/kylin/common/KylinConfigBase.java | 17 ++++++++++++++++- .../src/main/resources/kylin-defaults0.properties | 3 ++- .../apache/kylin/tool/restclient/RestClientTest.java | 9 +++++++-- 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/src/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java b/src/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java index 5f8c49e480..ddad0607a3 100644 --- a/src/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java +++ b/src/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java @@ -53,6 +53,7 @@ import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.TimeUnit; import java.util.stream.Collectors; +import org.apache.commons.codec.digest.DigestUtils; import org.apache.commons.collections.CollectionUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.math.NumberUtils; @@ -775,7 +776,21 @@ public abstract class KylinConfigBase implements Serializable { } public String getBroadcastToken() { - return EncryptUtil.getDecryptedValue(getOptional("kylin.server.broadcast-token", "")); + String configuredToken = getOptional("kylin.server.broadcast-token", ""); + if (StringUtils.isNotBlank(configuredToken)) { + return EncryptUtil.getDecryptedValue(configuredToken); + } + return getDefaultBroadcastToken(); + } + + /** + * Backward compatibility: derive a cluster-wide default from the shared metadata location so + * inter-node RPC keeps working after an upgrade without extra configuration. Every node in the + * cluster derives the same value, and the value is not a public constant, so the service-token + * check stays meaningful. + */ + private String getDefaultBroadcastToken() { + return DigestUtils.sha256Hex("kylin.server.broadcast-token:" + getMetadataUrl()); } public String getServerHttpsKeyAlias() { diff --git a/src/core-common/src/main/resources/kylin-defaults0.properties b/src/core-common/src/main/resources/kylin-defaults0.properties index 51d6ca5516..75f5218da9 100644 --- a/src/core-common/src/main/resources/kylin-defaults0.properties +++ b/src/core-common/src/main/resources/kylin-defaults0.properties @@ -56,7 +56,8 @@ kylin.server.https.port=7444 kylin.server.https.keystore-type=JKS kylin.server.https.keystore-file=${KYLIN_HOME}/server/.keystore kylin.server.https.keystore-password=changeit -# Shared secret for authenticating inter-node broadcast requests. Required for multi-node deployments. +# Shared secret for authenticating inter-node broadcast requests. When unset, a cluster-wide +# default is derived from the deployment metadata location, so no configuration is required. #kylin.server.broadcast-token= # Set true to enable CORS for any origins diff --git a/src/core-common/src/test/java/org/apache/kylin/tool/restclient/RestClientTest.java b/src/core-common/src/test/java/org/apache/kylin/tool/restclient/RestClientTest.java index 95f3510dbf..ac78b33d2c 100644 --- a/src/core-common/src/test/java/org/apache/kylin/tool/restclient/RestClientTest.java +++ b/src/core-common/src/test/java/org/apache/kylin/tool/restclient/RestClientTest.java @@ -47,8 +47,13 @@ public class RestClientTest extends NLocalFileMetadataTestCase { } @Test - public void testNoDefaultBroadcastCredential() { - Assert.assertEquals("", getTestConfig().getBroadcastToken()); + public void testDefaultBroadcastCredentialIsDeploymentScoped() { + String token = getTestConfig().getBroadcastToken(); + Assert.assertFalse(token.isEmpty()); + Assert.assertEquals(token, getTestConfig().getBroadcastToken()); + + getTestConfig().setProperty("kylin.server.broadcast-token", "secret"); + Assert.assertEquals("secret", getTestConfig().getBroadcastToken()); } @Test
