You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "brijesh1998 (via GitHub)" <gi...@apache.org> on 2026/04/06 09:04:59 UTC
[I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
brijesh1998 opened a new issue, #7387:
URL: https://github.com/apache/kyuubi/issues/7387
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [x] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.
### Describe the bug
### Bug
- `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line
starting from v1.10.2.
- Works correctly in: 1.10.1
- Impacted log line: https://github.com/apache/kyuubi/blob/master/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/EngineRef.scala#L258
### Steps to Reproduce
1. Set `kyuubi.server.redaction.regex=(?i)secret|credential|password|token|access[.]key` in
`kyuubi-defaults.conf`
2. Add sensitive config in `kyuubi-defaults.conf`, example: `spark.catalog.test.token=my_token`
2. Connect via beeline: `bin/beeline -u jdbc:kyuubi://192.168.0.4:10009/`
3. Observe the Kyuubi server log - the "Launching engine:" line shows the credential value in plain text: `--conf spark.catalog.test.token=my_token`
### Expected Behavior
The value should be redacted:
```
--conf spark.catalog.test.token=********(redacted)
```
### Possible Root Cause
[#7054](https://github.com/apache/kyuubi/pull/7054) added `.serverOnly` to `SERVER_SECRET_REDACTION_PATTERN`
```scala
val SERVER_SECRET_REDACTION_PATTERN: OptionalConfigEntry[Regex] =
buildConf("kyuubi.server.redaction.regex")
.serverOnly // <-- added in #7054
### Affects Version(s)
1.10.2/1.10.3/1.11.0/1.11.1
### Kyuubi Server Log Output
```logtalk
2026-04-06 14:31:54.490 INFO KyuubiSessionManager-exec-pool: Thread-66 org.apache.kyuubi.engine.EngineRef: Launching engine:
/Users/brijesh/Documents/spark-playground/spark-3.5.3-bin-hadoop3/bin/spark-submit \
--class org.apache.kyuubi.engine.spark.SparkSQLEngine \
--conf spark.hive.server2.thrift.resultset.default.fetch.size=1000 \
--conf spark.kyuubi.client.ipAddress=192.168.0.4 \
--conf spark.kyuubi.client.version=1.11.1 \
--conf spark.kyuubi.engine.appMgrInfo=eyJyZXNvdXJjZU1hbmFnZXIiOm51bGwsImt1YmVybmV0ZXNJbmZvIjp7ImNvbnRleHQiOm51bGwsIm5hbWVzcGFjZSI6bnVsbH19 \
--conf spark.kyuubi.engine.engineLog.path=/Users/brijesh/Documents/spark-playground/apache-kyuubi-1.11.1-bin/work/anonymous/kyuubi-spark-sql-engine.log.3 \
--conf spark.kyuubi.engine.submit.time=1775466114450 \
--conf spark.kyuubi.ha.addresses=192.168.0.4:2181 \
--conf spark.kyuubi.ha.engine.ref.id=1e1801f0-2b9f-48a5-a7c7-57c091d87207 \
--conf spark.kyuubi.ha.namespace=/kyuubi_1.11.1_USER_SPARK_SQL/anonymous/default \
--conf spark.kyuubi.ha.zookeeper.auth.type=NONE \
--conf spark.kyuubi.server.ipAddress=192.168.0.4 \
--conf spark.kyuubi.session.connection.url=192.168.0.4:10009 \
--conf spark.kyuubi.session.real.user=anonymous \
--conf spark.app.name=kyuubi_USER_SPARK_SQL_anonymous_default_1e1801f0-2b9f-48a5-a7c7-57c091d87207 \
--conf spark.catalog.test.credential=my_creds \
--conf spark.catalog.test.token=my_token \
--conf spark.kubernetes.driver.label.kyuubi-unique-tag=1e1801f0-2b9f-48a5-a7c7-57c091d87207 \
--conf spark.yarn.tags=KYUUBI,1e1801f0-2b9f-48a5-a7c7-57c091d87207 \
--proxy-user anonymous /Users/brijesh/Documents/spark-playground/apache-kyuubi-1.11.1-bin/externals/engines/spark/kyuubi-spark-sql-engine_2.12-1.11.1.jar
2026-04-06 14:32:02.990 INFO NIOServerCxn.Factory:/192.168.0.4:2181 org.apache.kyuubi.shaded.zookeeper.server.NIOServerCnxnFactory: Accepted socket connection from /192.168.0.4:56025
```
### Kyuubi Engine Log Output
```logtalk
```
### Kyuubi Server Configurations
```yaml
kyuubi.server.redaction.regex=(?i)secret|credential|password|token|access[.]key
spark.catalog.test.token=my_token
spark.catalog.test.credential=my_creds
```
### Kyuubi Engine Configurations
```yaml
```
### Additional context
_No response_
### Are you willing to submit PR?
- [x] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #7387:
URL: https://github.com/apache/kyuubi/issues/7387#issuecomment-4191295298
Hello @brijesh1998,
Thanks for finding the time to report the issue!
We really appreciate the community's efforts to improve Apache Kyuubi.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
Posted by "LamiumAmplexicaule (via GitHub)" <gi...@apache.org>.
LamiumAmplexicaule commented on issue #7387:
URL: https://github.com/apache/kyuubi/issues/7387#issuecomment-4394618974
@brijesh1998
Hello.
I’ve confirmed that the issue can be reproduced in Kyuubi Playground (1.11.0).
I think you’re planning to submit a PR—what changes are you planning to make?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
Posted by "brijesh1998 (via GitHub)" <gi...@apache.org>.
brijesh1998 commented on issue #7387:
URL: https://github.com/apache/kyuubi/issues/7387#issuecomment-4648397351
Hello @LamiumAmplexicaule,
Thanks a lot for picking this up!
Sorry! I could not get bandwidth to take it on myself, so really appreciate you stepping in.
I had a quick look at your PR and comment from @wangzhigang1999 (https://github.com/apache/kyuubi/pull/7451#issuecomment-4587409731), I think it's a very good suggestion.
Happy to wait for that to reshape before taking another look at the PR.
Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
Posted by "pan3793 (via GitHub)" <gi...@apache.org>.
pan3793 closed issue #7387: [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line
URL: https://github.com/apache/kyuubi/issues/7387
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
Posted by "LamiumAmplexicaule (via GitHub)" <gi...@apache.org>.
LamiumAmplexicaule commented on issue #7387:
URL: https://github.com/apache/kyuubi/issues/7387#issuecomment-4458246317
I opened a PR to address this issue.
If you have any concerns about the proposed fix or can suggest a better approach, I'd appreciate your comments.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [I] [Bug] `kyuubi.server.redaction.regex` no longer redacts sensitive values in the "Launching engine:" log line [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 commented on issue #7387:
URL: https://github.com/apache/kyuubi/issues/7387#issuecomment-4397560122
+1, following this as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org