chungen0126 commented on code in PR #10759:
URL: https://github.com/apache/ozone/pull/10759#discussion_r3725520960
##########
hadoop-ozone/tools/src/main/java/org/apache/hadoop/ozone/local/LocalOzoneCluster.java:
##########
@@ -642,31 +750,131 @@ private void startDatanodes(List<OzoneConfiguration>
datanodeConfigurations) {
}
}
+ /**
+ * Stores the recommended local credentials in OM so S3 clients can sign
requests without a
+ * separate {@code ozone s3 getsecret} bootstrap step. The write goes to the
secret store
+ * directly rather than through the OM request pipeline: the local runtime
is single-node and
+ * non-HA, the same fixed credentials are re-provisioned on every start, and
a dev-only
+ * bootstrap credential needs neither Ratis replication nor an audit trail.
+ */
+ private void provisionS3Credentials() throws IOException {
+ om.getS3SecretManager().storeSecret(config.getS3AccessKey(),
+ S3SecretValue.of(config.getS3AccessKey(), config.getS3SecretKey()));
+ }
Review Comment:
Currently, ozone local is not yet secure. At this stage, we should first
design for the default Ozone scenario. In this non-secure mode, authentication
is bypassed, meaning any access key and secret key combination will be
accepted. Therefore, I don't think we need to explicitly specify the
access/secret keys here.
##########
hadoop-ozone/tools/src/main/java/org/apache/hadoop/ozone/local/OzoneLocal.java:
##########
Review Comment:
For S3-related configurations, we should directly use the standard AWS
environment variables, such as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
