[
https://issues.apache.org/jira/browse/HIVE-25929?focusedWorklogId=782310&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-782310
]
ASF GitHub Bot logged work on HIVE-25929:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 17/Jun/22 08:44
Start Date: 17/Jun/22 08:44
Worklog Time Spent: 10m
Work Description: abstractdog commented on code in PR #3019:
URL: https://github.com/apache/hive/pull/3019#discussion_r899907375
##########
common/src/java/org/apache/hadoop/hive/conf/HiveConf.java:
##########
@@ -5455,6 +5455,22 @@ public static enum ConfVars {
+ ",hive.zookeeper.ssl.truststore.location"
+ ",hive.zookeeper.ssl.truststore.password",
"Comma separated list of configuration options which should not be
read by normal user like passwords"),
+ HIVE_CONF_PROPAGATE_EXEC_ENGINES("hive.conf.propagate.exec.engines",
+ "fs.s3.awsAccessKeyId"
Review Comment:
yes, if configs are dumped in logs then it's a security risk, but currently,
we have no other way to support 'less secure' option
('more secure' uses hadoop credential provider)
I don't have strong opinions about this one, so I'm closing this as invalid,
until we're not facing customer pressure to support it
Issue Time Tracking
-------------------
Worklog Id: (was: 782310)
Time Spent: 3h (was: 2h 50m)
> Let secret config properties to be propagated to Tez
> ----------------------------------------------------
>
> Key: HIVE-25929
> URL: https://issues.apache.org/jira/browse/HIVE-25929
> Project: Hive
> Issue Type: Bug
> Reporter: László Bodor
> Assignee: László Bodor
> Priority: Major
> Labels: pull-request-available
> Time Spent: 3h
> Remaining Estimate: 0h
>
> History in chronological order:
> HIVE-10508: removed some passwords from config that's propagated to execution
> engines
> HIVE-9013: introduced hive.conf.hidden.list, which is used instead of the
> hardcoded list in HIVE-10508
> the problem with HIVE-9013 is it's about to introduce a common method for
> removing sensitive data from Configuration, which absolutely makes sense in
> most of the cases (set command showing sensitive data), but can cause issues
> e.g. while using non-secure cloud connectors on a cluster, where instead of
> the hadoop credential provider API (which is considered the secure and proper
> way), passwords/secrets appear in the Configuration object (like:
> "fs.azure.account.oauth2.client.secret")
> 2 possible solutions:
> 1. introduce a new property like: "hive.conf.hidden.list.exec.engines" ->
> which defaults to "hive.conf.hidden.list" (configurable, but maybe just more
> confusing to users, having a new config property which should be understood
> and maintained on a cluster)
> 2. simply revert DAGUtils to use to old stripHivePasswordDetails introduced
> by HIVE-10508 (convenient, less confusing for users, but cannot be configured)
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
