Gokul Kolady has posted comments on this change. ( http://gerrit.cloudera.org:8080/24363 )
Change subject: IMPALA-14981: Add operator reconciler packaging ...................................................................... Patch Set 28: (3 comments) http://gerrit.cloudera.org:8080/#/c/24363/28/operator/impala-operator/main.py File operator/impala-operator/main.py: http://gerrit.cloudera.org:8080/#/c/24363/28/operator/impala-operator/main.py@52 PS28, Line 52: logger.info("Running: %s", " ".join(cmd)) We log full Helm command lines, including all --set values from spec.set. That can leak secrets into operator logs. Can we redact sensitive keys/values (or avoid logging full args) before logging commands? http://gerrit.cloudera.org:8080/#/c/24363/28/operator/impala-operator/main.py@110 PS28, Line 110: args.extend(["--set", f"{key}={val}"]) auth.ldap.bindPattern can contain commas (e.g. cn=#UID,dc=example,dc=org), and passing it through --set key=value makes Helm split on commas. That truncates the value and can break LDAP auth. Can we use --set-string with escaping (or write overrides to a temp values file and pass -f) for this field? http://gerrit.cloudera.org:8080/#/c/24363/28/operator/impala-operator/main.py@209 PS28, Line 209: target_ns = spec.get("namespace", namespace) We currently trust spec.namespace as the target namespace. Since ImpalaCluster is namespaced, can we enforce spec.namespace == metadata.namespace (or ignore spec.namespace and always use the object namespace)? Otherwise this allows cross-namespace reconcile/delete behavior if RBAC is broad. -- To view, visit http://gerrit.cloudera.org:8080/24363 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I9b66e32b00724221ead2f4975802a26b2be7e248 Gerrit-Change-Number: 24363 Gerrit-PatchSet: 28 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Comment-Date: Tue, 16 Jun 2026 22:31:51 +0000 Gerrit-HasComments: Yes
