LiJie20190102 opened a new pull request, #13756: URL: https://github.com/apache/gravitino/pull/13756
### What changes were proposed in this pull request? Adds a design document `design-docs/gravitino-secret-encryption.md` for encrypted secret storage in Gravitino, extending the entity secrets design (`design-docs/gravitino-entity-secrets.md`) with a production-grade backend: - **DB-backed secret provider** (provisional type `db`): a `SecretProvider` implementation persisting secrets as AES-GCM ciphertext in the relational entity store. The SPI, URN reference model, REST contract, and server-side resolution are unchanged from the entity secrets design. - **KMS-protected master key**: the master key exists in plaintext only in process memory; on disk it appears only as a blob wrapped by an external KMS (envelope encryption). - **Seal SPI**: a new `wrap` / `unwrap` interface separate from the read-only `KmsClient`, with `local` (development/tests), AWS KMS, and GCP Cloud KMS implementations. - **Encrypted server configuration**: sensitive values (starting with `gravitino.entity.store.relational.jdbcPassword`) may be stored as ciphertext and are decrypted at startup with the in-memory master key. ### Why are the changes needed? The entity secrets management landed only an in-memory provider: values are Base64-encoded (encoding, not encryption) and storage is process-local, so production deployments currently have no durable, encrypted secret backend. Sensitive server configuration values are also stored in cleartext in `gravitino.conf`, which widens exposure through version control, shared storage, database dumps, and container images. Encrypting the secret store requires a master key, and that key needs a real trust boundary. A key read from the same host as the data it protects adds no boundary, so the design moves the boundary to an external KMS, which is contacted once per process start; the hot path stays local AES. Fix: #13755 ### Does this PR introduce _any_ user-facing change? No. This PR adds a design document only; no code, configuration, or API changes. ### How was this patch tested? Documentation-only change; no tests required. The document follows the structure and conventions of the existing design docs under `design-docs/` (background, goals, non-goals, solution investigations, proposal, task breakdown). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
