yuqi1129 commented on PR #11674: URL: https://github.com/apache/gravitino/pull/11674#issuecomment-4861766555
### How hiding fileset catalog credential properties affects GVFS credential fetching Background: #11642 hides the S3/OSS/Azure/GCS static credentials (ak/sk) from `catalog/schema/fileset.properties()`. Before this, GVFS could fall back to the static credentials returned by `catalog.properties()`. After hiding, that fallback is gone, so we need to check each case and fix the broken ones. | Case | Before hiding | After hiding (no fix) | Need fix? | How to fix | |---|---|---|---|---| | `vending=true`, client has no credentials | Static ak/sk is in `catalog.properties()`, the file system uses it | Static ak/sk is hidden. If the provider is not inferred, `getCredentials()` returns empty → AccessDenied | Yes | Infer the provider from static credentials at the fileset level (`CredentialUtils.getCredentialProvidersByOrder` falls back to infer, e.g. `s3-secret-key`), so `getCredentials()` returns credentials and vends them to the client (point 2) | | `vending=false`, client has no credentials | Uses static ak/sk from catalog | Static ak/sk is hidden → no credentials at all → AccessDenied | Yes | Throw a clear `AccessDeniedException` that tells the user to set `fs.gravitino.enableCredentialVending=true` or configure credentials on the client (point 3). Legacy connectors can use the server flag `gravitino.catalog.credential.backfillToProperties=true` to restore the old behavior | | `vending=false`, client has credentials | Client config is applied last and overrides catalog, client wins | Not affected, still uses client credentials | No | None | | `vending=true`, client has credentials | Vended credentials are applied last and **override** the client config, so the client's own ak/sk is silently ignored (not intuitive) | Same as before | Yes (clarify behavior) | Change the merge order: re-apply client config after vending, so the order becomes `client > vending > catalog`, same as the `vending=false` path | | `vending=true`, server returns empty credentials | Silently degrades, no log, hard to debug | Easier to hit after hiding (when catalog has no static credentials), still silent | Yes (observability) | When vending is on but `credentials.length == 0`, log a `WARN` telling the user to check the catalog static credentials or the `credential-providers` config | Final priority (same whether vending is on or off): `client config > server vended credentials > catalog/schema/fileset static properties`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
