LiJie20190102 opened a new issue, #14398:
URL: https://github.com/apache/gravitino/issues/14398
### Describe the subtask
**Priority:** P0
**Dependencies:** #<id-2>
**Problem:** Nothing owns the master key lifecycle. Without a generated,
KMS-wrapped master
key that is unwrapped once at startup and held only in memory, neither the
DB-backed secret
provider nor encrypted configuration values have anything to decrypt with.
**Scope:**
- Operator tooling to generate a random 256-bit master key and wrap it with
the configured
seal, producing the blob stored as `gravitino.security.master.key.wrapped`.
- `MasterKeyHolder`: a process-wide holder backed by a wipeable `SecretKey`
/ `byte[]`,
zeroed on shutdown; the plaintext key is never logged, persisted, or
returned by any API.
- Startup ordering per the design doc (§5.3): `SealClientRegistry` → unwrap
master key →
`MasterKeyHolder` → decrypt encrypted config values → entity store
connects →
`SecretProviderRegistry` loads the `db` provider.
- When no wrapped master key is configured and no configuration value is
encrypted, the
server behaves exactly as today.
- Unit tests for the generation/wrap tooling and the holder lifecycle
(including
wipe-on-shutdown).
### Parent issue
#14396
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
