This is an automated email from the ASF dual-hosted git repository.
damccorm pushed a commit to branch users/damccorm/enforce_gbek
in repository https://gitbox.apache.org/repos/asf/beam.git
The following commit(s) were added to refs/heads/users/damccorm/enforce_gbek by
this push:
new 41a0612e064 option description
41a0612e064 is described below
commit 41a0612e064f4bf751446e65b0d8fa5be4c538af
Author: Danny Mccormick <[email protected]>
AuthorDate: Mon Sep 29 13:34:23 2025 -0400
option description
---
sdks/python/apache_beam/options/pipeline_options.py | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/sdks/python/apache_beam/options/pipeline_options.py
b/sdks/python/apache_beam/options/pipeline_options.py
index 034073a41fe..c23725e8db2 100644
--- a/sdks/python/apache_beam/options/pipeline_options.py
+++ b/sdks/python/apache_beam/options/pipeline_options.py
@@ -1723,7 +1723,12 @@ class SetupOptions(PipelineOptions):
'When set, will replace all GroupByKey transforms in the pipeline '
'with EncryptedGroupByKey transforms using the secret passed in '
'the option. Beam will infer the secret type and value based on '
- 'secret itself. The option should be structured like: '
+ 'secret itself. This guarantees that any data at rest during the '
+ 'GBK will be encrypted. Many runners only store data at rest when '
+ 'performing a GBK, so this can be used to guarantee that data is '
+ 'not unencrypted. Runners with this behavior include the '
+ 'Dataflow, Flink, and Spark runners. The option should be '
+ 'structured like: '
'--encrypt=type:<secret_type>;<secret_param>:<value>, for example '
'--encrypt=type:GcpSecret;version_name:my_secret/versions/latest'))
