lasdf1234 opened a new pull request, #12507:
URL: https://github.com/apache/gravitino/pull/12507
### What changes were proposed in this pull request?
Add a dedicated delivery path for Vault-backed entity properties so remote
Spark/Flink/Trino connectors can obtain secret plaintext without exposing
secrets on Load Catalog or overloading credential vending.
- API: `SupportsSecretProperties.getSecretProperties()`
- REST: `GET
/metalakes/{metalake}/objects/{type}/{fullName}/secret-properties` (catalog,
schema, fileset)
- Core: `SecretPropertiesOperationDispatcher` loads entity props, keeps
secret URN keys only, resolves via `SecretManager.toPlaintextProperties`
- Java client, OpenAPI (`secret-properties.yaml`), and
`CatalogSecretProperties` helper
- Spark/Flink JDBC and Trino catalog connector merge secret properties into
engine config after credentials
### Why are the changes needed?
Load Catalog and UI must omit secret keys/URNs. `getCredentials` only covers
credential types. Remote connectors therefore need a separate, trusted API to
fetch arbitrary Vault-backed sensitive configuration.
Fix: #12506
### Does this PR introduce _any_ user-facing change?
1. New REST endpoint: `GET .../objects/{type}/{fullName}/secret-properties`
2. New API interface: `SupportsSecretProperties` on `Catalog` and `Fileset`
3. Java client: `catalog.supportsSecretProperties().getSecretProperties()`
4. No change to Load Catalog / schema / fileset responses (secrets still
omitted)
### How was this patch tested?
- [x] `./gradlew :common:test --tests
org.apache.gravitino.secret.TestCatalogSecretProperties`
- [x] `./gradlew :core:test --tests
org.apache.gravitino.secret.TestSecretPropertiesOperationDispatcher`
- [x] `./gradlew :server:test --tests
org.apache.gravitino.server.web.rest.TestMetadataObjectSecretPropertiesOperations`
- [x] `./gradlew :docs:build` (OpenAPI validation)
- [x] `./gradlew :spark-connector:spark-common:compileJava
:flink-connector:flink-common:compileJava
:trino-connector:trino-connector:compileJava`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
