lasdf1234 opened a new issue, #12506:
URL: https://github.com/apache/gravitino/issues/12506
### Describe the feature
Add a dedicated delivery path for secret-backed entity properties (URN →
plaintext), separate from Load Catalog and credentials.
Remote Spark/Flink/Trino connectors need Vault-backed custom configuration,
but:
- Load Catalog (shared with UI) must not return secret keys or plaintext
- `getCredentials` is only for credential types, not arbitrary sensitive
properties
### Motivation
Without a new API surface, remote engines cannot obtain Vault-backed custom
properties under the current security model.
### Describe the solution
- API: `SupportsSecretProperties.getSecretProperties()`
- REST: `GET
/metalakes/{metalake}/objects/{type}/{fullName}/secret-properties` for catalog,
schema, and fileset
- Server: load entity properties, keep secret URN keys only, resolve via
`SecretManager.toPlaintextProperties`
- Java client, OpenAPI, and connector merge helpers for Spark/Flink JDBC and
Trino
- Authorization: `CAN_ACCESS_METADATA` (UI should not call this endpoint)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
