yuqi1129 opened a new pull request, #11674: URL: https://github.com/apache/gravitino/pull/11674
### What changes were proposed in this pull request? Mark cloud storage credential properties as `hidden` in the fileset catalog property metadata, so they are filtered out of the `properties()` output: - `FilesetCatalogPropertiesMetadata` — new shared `STORAGE_CREDENTIAL_PROPERTY_ENTRIES` map (hidden entries) - `FilesetSchemaPropertiesMetadata` / `FilesetPropertiesMetadata` — reuse the same map (credentials may be set at any level) Hidden keys: `s3-access-key-id`, `s3-secret-access-key`, `oss-access-key-id`, `oss-secret-access-key`, `gcs-service-account-file`, `azure-storage-account-name`, `azure-storage-account-key`, `azure-client-secret`. Non-sensitive connection info (endpoint, region, role-arn, etc.) stays visible. Hiding does **not** break credential vending: the raw credentials remain available to the server-side credential manager via `propertiesWithCredentialProviders()` (which reads raw entity properties including hidden ones), and the matching credential provider is auto-injected by `BaseCatalog.addStorageCredentialProviders()`, so clients such as GVFS/Spark/Trino still obtain vended credentials. For legacy connectors without vending support, the server flag `gravitino.catalog.credential.backfillToProperties=true` restores the previous behavior. ### Why are the changes needed? For fileset catalogs, credential properties (S3/OSS/GCS/Azure keys) were not marked as `hidden`, so `catalog.properties()` exposed sensitive credentials to clients. The JDBC catalog already hides `jdbc-user`/`jdbc-password`; the fileset catalog should follow the same approach to prevent credential leakage. Fix: #11642 ### Does this PR introduce _any_ user-facing change? The listed credential properties are no longer returned by `catalog.properties()` / schema / fileset `properties()`. Behavior is unchanged for credential-vending clients. Connectors that relied on reading static credentials from properties and do not support vending must set `gravitino.catalog.credential.backfillToProperties=true`. ### How was this patch tested? Added unit tests: - `TestFilesetCatalogPropertiesMetadata` — credentials hidden across catalog/schema/fileset metadata; non-sensitive props stay visible. - `TestFilesetCatalogCredential` — end-to-end: `catalog.properties()` filters out credentials, while `propertiesWithCredentialProviders()` still retains them and auto-injects the S3 secret-key credential provider. `./gradlew :catalogs:catalog-fileset:test` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
