LiJie20190102 commented on code in PR #13500: URL: https://github.com/apache/gravitino/pull/13500#discussion_r4225274503
########## conf/gravitino.conf.template: ########## @@ -69,7 +69,19 @@ gravitino.entity.store.relational.jdbcDriver = org.h2.Driver # The JDBC user name gravitino.entity.store.relational.jdbcUser = gravitino # The JDBC password -gravitino.entity.store.relational.jdbcPassword = gravitino +# This value can be plain text or encrypted (ENC(...) format). The default value below is +# the encrypted form of "gravitino" using the default master key "gravitino". +# To use your own encrypted password: +# 1. Encrypt your password using the provided tool: +# python3 scripts/encrypt_password.py encrypt "your-password" --key "your-master-key" +# or: +# java -cp libs/gravitino-common-*.jar org.apache.gravitino.utils.PasswordEncryptorCLI \ +# encrypt "your-password" --key "your-master-key" +# 2. Set the master encryption key as an environment variable: +# export GRAVITINO_PASSWORD_ENCRYPTION_KEY="your-master-key" +# 3. Replace the password value below with the ENC(...) output from step 1: +# gravitino.entity.store.relational.jdbcPassword = ENC(base64data) +gravitino.entity.store.relational.jdbcPassword = ENC(KuC3/zFBSkbDUC8T/YyzQuAccmSBzB4jH14wC7ueIH0WoIiFOteLS3OgyP20ll3F3+81aSs=) Review Comment: > The default value of gravitino.entity.store.relational.jdbcPassword change to encryption. Do you think this is feasible? @yuqi1129 @roryqi The default will stay plaintext `gravitino` — it's a publicly known dev default, encrypting it adds no real secrecy. Only when users set a custom master key and re-encrypt their password does the value become `ENC(...)`. This keeps backward compatibility for existing deployments. > This is a configuration file, so there is no need to provide detailed steps. Just explain the function of the configuration is sufficient. Agreed, will simplify the comment to just explain the config function. The detailed encryption steps will be documented in docs instead. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
