lasdf1234 opened a new issue, #12457: URL: https://github.com/apache/gravitino/issues/12457
### Describe the proposal Follow-up to epic #12297 (entity connection secrets). Secret values are persisted as **URNs** in catalog / schema / fileset properties. Default `loadCatalog` / GET omit those keys (safe for UI and generic clients). Remote runtimes that need connection secrets cannot recover plaintext today: - Spark / Flink / Trino connectors loading catalogs over the Java/Python client - Lance REST and Iceberg REST (IRC) configuring backends from Gravitino HTTP metadata - Any aux service not co-located with in-process `CatalogManager` plaintext injection `getCredentials` only covers credential-provider material, not arbitrary `secretBindings` / secret-manager keys. ### Proposed approach Add an **explicit** resolved-properties channel (dedicated REST + client APIs) that returns properties with secret URNs replaced by plaintext, while keeping default `loadCatalog` omit semantics unchanged. Wire connectors / Lance / IRC to that channel. Design: `design-docs/gravitino-secret-plaintext-property-delivery.md` (in the PR). ### Related - Epic: #12297 - Parent design: #12249 - Create-time secrets: #12366 (fileset), #12420 (catalog/schema) ### Task list - [ ] Core `load*ResolvedProperties` + `SecretPropertyUtils.buildResolvedProperties` - [ ] REST `GET .../properties?view=resolved` for catalog / schema / fileset - [ ] Java / Python clients + OpenAPI - [ ] Wire Spark / Flink / Trino / Lance / Iceberg REST consumers -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
