LuciferYang commented on code in PR #13247:
URL: https://github.com/apache/gravitino/pull/13247#discussion_r4056478182
##########
catalogs/catalog-common/src/main/java/org/apache/gravitino/storage/CloudStorageCredentialPropertyKeys.java:
##########
@@ -50,7 +52,11 @@ public final class CloudStorageCredentialPropertyKeys {
S3Properties.GRAVITINO_S3_SECRET_ACCESS_KEY,
OSSProperties.GRAVITINO_OSS_ACCESS_KEY_SECRET,
AzureProperties.GRAVITINO_AZURE_STORAGE_ACCOUNT_KEY,
- COSProperties.GRAVITINO_COS_ACCESS_KEY_SECRET);
+ AzureProperties.GRAVITINO_AZURE_CLIENT_SECRET,
+ COSProperties.GRAVITINO_COS_ACCESS_KEY_SECRET,
+ GlueConstants.AWS_SECRET_ACCESS_KEY,
+ PaimonConstants.GRAVITINO_DLF_ACCESS_KEY_SECRET,
+ PaimonConstants.GRAVITINO_DLF_SECURITY_TOKEN);
Review Comment:
Thanks, you're right. I traced the flow to confirm:
`omitStaticCredentialProperties` filters a fileset catalog's `properties()`,
whose namespace (`FilesetCatalogPropertiesMetadata`) pulls in the shared
S3/OSS/Azure/GCS/COS property metadata but not Glue or Paimon.
`azure-client-secret` (from `AzurePropertiesMetadata`) does reach that map for
ABS/ADLS filesets, so it stays. The Glue and Paimon-DLF secrets are declared
only in their own catalogs' `PropertiesMetadata` (`hidden=true`, already masked
in their REST responses) and never enter the fileset properties map, so they
don't belong here. Narrowed the set to add only `azure-client-secret` in
315fbc1a0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
