jarredhj0214 opened a new issue, #12051:
URL: https://github.com/apache/gravitino/issues/12051
### Version
main branch
### Describe what's wrong
When using the Gravitino Flink connector with a Paimon catalog, some catalog
properties are passed through to the underlying Paimon/Flink runtime
configuration.
If the catalog contains storage-related credential properties, these
properties may appear in Flink job logs because Paimon logs the full dynamic
table options at INFO level.
Examples of sensitive property keys include:
- `gravitino.bypass.hadoop.fs.oss.accessKeyId`
- `gravitino.bypass.hadoop.fs.oss.accessKeySecret`
- `gravitino.bypass.hadoop.fs.bos.access.key`
- `gravitino.bypass.hadoop.fs.bos.secret.access.key`
This can expose sensitive configuration values in application logs.
### Error message and/or stacktrace
A Flink job log contains an INFO message from Paimon's Flink table factory
similar to:
```text
INFO org.apache.paimon.flink.AbstractFlinkTableFactory - Loading dynamic
table options for <table_name> in table config: { ...
fs.oss.accessKeyId=<masked>, fs.oss.accessKeySecret=<masked>,
fs.bos.access.key=<masked>, fs.bos.secret.access.key=<masked>, ... }
### How to reproduce
1. Create a Gravitino Paimon catalog.
2. Configure the catalog with storage-related bypass properties that include
sensitive credentials, such as OSS/BOS access keys.
3. Use the Gravitino Flink connector and enable the Gravitino catalog store.
4. Run a Flink job that reads or writes a Paimon table.
5. Check the Flink job logs.
The Paimon Flink table factory may print the full table configuration,
including sensitive catalog-derived properties.
### Additional context
This log is emitted from the Flink job process, not from the Gravitino
server process.
A short-term workaround is to raise the log level of the relevant Paimon
Flink logger to WARN in the Flink job's log4j configuration.
Potential improvements:
Avoid exposing sensitive catalog properties through loggable runtime
configuration where possible.
Mask sensitive property values before logging configuration maps.
Add masking for sensitive catalog property values in the Gravitino Web UI,
especially for keys containing terms such as secret, password, token,
credential, accessKey, or access.key.
Consider applying the same masking policy to catalog property API responses
if backward compatibility allows it, or provide a safe display representation
for UI usage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
