LiJie20190102 opened a new issue, #13755: URL: https://github.com/apache/gravitino/issues/13755
### Describe the feature Add a design document for encrypted secret storage in Apache Gravitino: - DB-backed `SecretProvider` (provisional type `db`) persisting secrets as AES-GCM ciphertext in the relational entity store - KMS-protected master key: at rest only as a KMS-wrapped blob; plaintext only in process memory - A new seal SPI (`wrap` / `unwrap`) separate from the read-only `KmsClient`, with `local`, AWS KMS, and GCP Cloud KMS implementations - Encrypted sensitive server configuration values (starting with `gravitino.entity.store.relational.jdbcPassword`) ### Motivation Sensitive credentials are exposed today: - Server configuration values such as `gravitino.entity.store.relational.jdbcPassword` are stored in cleartext in `gravitino.conf`. - Entity secrets management (#12252) ships only an in-memory provider for tests and local use; production deployments have no durable, encrypted secret backend. Plaintext at rest widens exposure through version control, shared storage, DB dumps, and container images. Encrypting the secret store requires a master key, and that key needs a real trust boundary — an external KMS — rather than another secret stored on the same host. Envelope encryption (a KMS-wrapped data key) is the established pattern on all major clouds. ### Describe the solution See the design document `design-docs/gravitino-secret-encryption.md` (PR to follow). ### Additional context _No response_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
