this-user commented on PR #6458: URL: https://github.com/apache/gravitino/pull/6458#issuecomment-2663330230
> I'm not sure if passing credentials via env variables is a good practice. It has some security flaws. A more secure way would be mount them via a volume. That's a fair point, but this is how it is commonly done, including by other Iceberg REST catalogue implementations and Spark as well if you running them inside containers. And most users would expect it to work this way. While it is certainly not ideal, I don't think it's substantially worse than other options, because if someone could gain access to the container's environment, they could surely gain access to the file system too. If you wanted to be more secure, you would have to avoid storing the credentials in clear text by deploying a solution like HashiCorp's Vault. But then you again run into the same issue: If someone gains access to the container, they can gain access to the credentials necessary for querying the Vault, and you end up in the same situation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
