You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "snazy (via GitHub)" <gi...@apache.org> on 2025/04/15 15:16:49 UTC
[PR] Auto-bootstrap: add verbose logging [polaris]
snazy opened a new pull request, #1376:
URL: https://github.com/apache/polaris/pull/1376
Log explicit messages around auto-bootstrapping and unnecessary/left-over secrets that are (still) available.
<!--
Possible security vulnerabilities: STOP here and contact security@apache.org instead!
Please update the title of the PR with a meaningful message - do not leave it "empty" or "generated"
Please update this summary field:
The summary should cover these topics, if applicable:
* the motivation for the change
* a description of the status quo, for example the current behavior
* the desired behavior
* etc
PR checklist:
- Do a self-review of your code before opening a pull request
- Make sure that there's good test coverage for the changes included in this PR
- Run tests locally before pushing a PR (./gradlew check)
- Code should have comments where applicable. Particularly hard-to-understand
areas deserve good in-line documentation.
- Include changes and enhancements to the documentation (in site/content/in-dev/unreleased)
- For Work In Progress Pull Requests, please use the Draft PR feature.
Make sure to add the information BELOW this comment.
Everything in this comment will NOT be added to the PR description.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy merged PR #1376:
URL: https://github.com/apache/polaris/pull/1376
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on code in PR #1376:
URL: https://github.com/apache/polaris/pull/1376#discussion_r2045053548
##########
quarkus/service/src/main/java/org/apache/polaris/service/quarkus/config/QuarkusProducers.java:
##########
@@ -159,9 +163,68 @@ public void maybeBootstrap(
MetaStoreManagerFactory factory,
QuarkusPersistenceConfiguration config,
RealmContextConfiguration realmContextConfiguration) {
+ var rootCredentialsSet = RootCredentialsSet.fromEnvironment();
+ var rootCredentials = rootCredentialsSet.credentials();
if (config.isAutoBootstrap()) {
- RootCredentialsSet rootCredentialsSet = RootCredentialsSet.fromEnvironment();
- factory.bootstrapRealms(realmContextConfiguration.realms(), rootCredentialsSet);
+ var realmIds = realmContextConfiguration.realms();
+
+ LOGGER.info(
+ "Bootstrapping realm(s) {}, if necessary, from root credentials set provided via the environment variable {} or Java system property {} ...",
+ realmIds.stream().map(r -> "'" + r + "'").collect(Collectors.joining(", ")),
+ RootCredentialsSet.ENVIRONMENT_VARIABLE,
+ RootCredentialsSet.SYSTEM_PROPERTY);
+
+ var result = factory.bootstrapRealms(realmIds, rootCredentialsSet);
+
+ result.forEach(
+ (realm, secrets) -> {
+ var principalSecrets = secrets.getPrincipalSecrets();
+
+ var log =
+ LOGGER
+ .atInfo()
+ .addArgument(realm)
+ .addArgument(RootCredentialsSet.ENVIRONMENT_VARIABLE)
+ .addArgument(RootCredentialsSet.SYSTEM_PROPERTY);
+ if (rootCredentials.containsKey(realm)) {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials taken from root credentials set provided via the environment variable {} or Java system property {}, not printed to stdout.");
+ } else {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials were not present in root credentials set provided via the environment variable {} or Java system property {}, see separate message printed to stdout.");
Review Comment:
In the admin tool [here](https://github.com/eric-maynard/polaris/blob/e9e53052abf5f72d9629fc79e2a9e43859c3286c/quarkus/admin/src/main/java/org/apache/polaris/admintool/BootstrapCommand.java#L116) we gate this behind a command-line argument, do we need to do something similar here or should we always print?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #1376:
URL: https://github.com/apache/polaris/pull/1376#issuecomment-2864554974
I'll look into that if noone else has a fix in progress :thinking:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on code in PR #1376:
URL: https://github.com/apache/polaris/pull/1376#discussion_r2073454839
##########
quarkus/service/src/main/java/org/apache/polaris/service/quarkus/config/QuarkusProducers.java:
##########
@@ -159,9 +163,68 @@ public void maybeBootstrap(
MetaStoreManagerFactory factory,
QuarkusPersistenceConfiguration config,
RealmContextConfiguration realmContextConfiguration) {
+ var rootCredentialsSet = RootCredentialsSet.fromEnvironment();
+ var rootCredentials = rootCredentialsSet.credentials();
if (config.isAutoBootstrap()) {
- RootCredentialsSet rootCredentialsSet = RootCredentialsSet.fromEnvironment();
- factory.bootstrapRealms(realmContextConfiguration.realms(), rootCredentialsSet);
+ var realmIds = realmContextConfiguration.realms();
+
+ LOGGER.info(
+ "Bootstrapping realm(s) {}, if necessary, from root credentials set provided via the environment variable {} or Java system property {} ...",
+ realmIds.stream().map(r -> "'" + r + "'").collect(Collectors.joining(", ")),
+ RootCredentialsSet.ENVIRONMENT_VARIABLE,
+ RootCredentialsSet.SYSTEM_PROPERTY);
+
+ var result = factory.bootstrapRealms(realmIds, rootCredentialsSet);
+
+ result.forEach(
+ (realm, secrets) -> {
+ var principalSecrets = secrets.getPrincipalSecrets();
+
+ var log =
+ LOGGER
+ .atInfo()
+ .addArgument(realm)
+ .addArgument(RootCredentialsSet.ENVIRONMENT_VARIABLE)
+ .addArgument(RootCredentialsSet.SYSTEM_PROPERTY);
+ if (rootCredentials.containsKey(realm)) {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials taken from root credentials set provided via the environment variable {} or Java system property {}, not printed to stdout.");
+ } else {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials were not present in root credentials set provided via the environment variable {} or Java system property {}, see separate message printed to stdout.");
+ String msg =
+ String.format(
+ "realm: %1s root principal credentials: %2s:%3s",
+ realm,
+ principalSecrets.getPrincipalClientId(),
+ principalSecrets.getMainSecret());
+ System.out.println(msg);
Review Comment:
I didn't want to change the behavior in this PR.
But I agree that generating and printing credentials isn't that great.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on PR #1376:
URL: https://github.com/apache/polaris/pull/1376#issuecomment-2861949731
It appears that we now double-print credentials, e.g.:
```
2025-05-07 23:40:06,767 INFO [org.apa.pol.ser.qua.con.QuarkusProducers] [,] [,,,] (Quarkus Main Thread) Bootstrapping realm(s) 'POLARIS', if necessary, from root credentials set provided via the environment variable POLARIS_BOOTSTRAP_CREDENTIALS or Java system property polaris.bootstrap.credentials ...
realm: POLARIS root principal credentials: c15135cbf0977e3d:a38976b705f0959e0017e0cef831122e
2025-05-07 23:40:06,819 INFO [org.apa.pol.ser.qua.con.QuarkusProducers] [,] [,,,] (Quarkus Main Thread) Realm 'POLARIS' automatically bootstrapped, credentials were not present in root credentials set provided via the environment variable POLARIS_BOOTSTRAP_CREDENTIALS or Java system property polaris.bootstrap.credentials, see separate message printed to stdout.
realm: POLARIS root principal credentials: c15135cbf0977e3d:a38976b705f0959e0017e0cef831122e
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #1376:
URL: https://github.com/apache/polaris/pull/1376#discussion_r2058640745
##########
quarkus/service/src/main/java/org/apache/polaris/service/quarkus/config/QuarkusProducers.java:
##########
@@ -159,9 +163,68 @@ public void maybeBootstrap(
MetaStoreManagerFactory factory,
QuarkusPersistenceConfiguration config,
RealmContextConfiguration realmContextConfiguration) {
+ var rootCredentialsSet = RootCredentialsSet.fromEnvironment();
+ var rootCredentials = rootCredentialsSet.credentials();
if (config.isAutoBootstrap()) {
- RootCredentialsSet rootCredentialsSet = RootCredentialsSet.fromEnvironment();
- factory.bootstrapRealms(realmContextConfiguration.realms(), rootCredentialsSet);
+ var realmIds = realmContextConfiguration.realms();
+
+ LOGGER.info(
+ "Bootstrapping realm(s) {}, if necessary, from root credentials set provided via the environment variable {} or Java system property {} ...",
+ realmIds.stream().map(r -> "'" + r + "'").collect(Collectors.joining(", ")),
+ RootCredentialsSet.ENVIRONMENT_VARIABLE,
+ RootCredentialsSet.SYSTEM_PROPERTY);
+
+ var result = factory.bootstrapRealms(realmIds, rootCredentialsSet);
+
+ result.forEach(
+ (realm, secrets) -> {
+ var principalSecrets = secrets.getPrincipalSecrets();
+
+ var log =
+ LOGGER
+ .atInfo()
+ .addArgument(realm)
+ .addArgument(RootCredentialsSet.ENVIRONMENT_VARIABLE)
+ .addArgument(RootCredentialsSet.SYSTEM_PROPERTY);
+ if (rootCredentials.containsKey(realm)) {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials taken from root credentials set provided via the environment variable {} or Java system property {}, not printed to stdout.");
+ } else {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials were not present in root credentials set provided via the environment variable {} or Java system property {}, see separate message printed to stdout.");
+ String msg =
+ String.format(
+ "realm: %1s root principal credentials: %2s:%3s",
+ realm,
+ principalSecrets.getPrincipalClientId(),
+ principalSecrets.getMainSecret());
+ System.out.println(msg);
Review Comment:
TBH, I do not think it's worth printing credentials to STDOUT at all. What's the use case for that that cannot be covered by user-provided credentials?
Cf. https://github.com/apache/polaris/issues/1428#issuecomment-2825877145
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Auto-bootstrap: add verbose logging [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on code in PR #1376:
URL: https://github.com/apache/polaris/pull/1376#discussion_r2058234373
##########
quarkus/service/src/main/java/org/apache/polaris/service/quarkus/config/QuarkusProducers.java:
##########
@@ -159,9 +163,68 @@ public void maybeBootstrap(
MetaStoreManagerFactory factory,
QuarkusPersistenceConfiguration config,
RealmContextConfiguration realmContextConfiguration) {
+ var rootCredentialsSet = RootCredentialsSet.fromEnvironment();
+ var rootCredentials = rootCredentialsSet.credentials();
if (config.isAutoBootstrap()) {
- RootCredentialsSet rootCredentialsSet = RootCredentialsSet.fromEnvironment();
- factory.bootstrapRealms(realmContextConfiguration.realms(), rootCredentialsSet);
+ var realmIds = realmContextConfiguration.realms();
+
+ LOGGER.info(
+ "Bootstrapping realm(s) {}, if necessary, from root credentials set provided via the environment variable {} or Java system property {} ...",
+ realmIds.stream().map(r -> "'" + r + "'").collect(Collectors.joining(", ")),
+ RootCredentialsSet.ENVIRONMENT_VARIABLE,
+ RootCredentialsSet.SYSTEM_PROPERTY);
+
+ var result = factory.bootstrapRealms(realmIds, rootCredentialsSet);
+
+ result.forEach(
+ (realm, secrets) -> {
+ var principalSecrets = secrets.getPrincipalSecrets();
+
+ var log =
+ LOGGER
+ .atInfo()
+ .addArgument(realm)
+ .addArgument(RootCredentialsSet.ENVIRONMENT_VARIABLE)
+ .addArgument(RootCredentialsSet.SYSTEM_PROPERTY);
+ if (rootCredentials.containsKey(realm)) {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials taken from root credentials set provided via the environment variable {} or Java system property {}, not printed to stdout.");
+ } else {
+ log.log(
+ "Realm '{}' automatically bootstrapped, credentials were not present in root credentials set provided via the environment variable {} or Java system property {}, see separate message printed to stdout.");
Review Comment:
This is the case when the realm's to be automatically bootstrapped, but the credentials are generated (not provided).
The above case (creds provided) never prints the credentials.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org