You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hive.apache.org by "László Bodor (Jira)" <ji...@apache.org> on 2022/02/06 10:44:00 UTC
[jira] [Updated] (HIVE-25929) Let secret config properties to be propagated to Tez
[ https://issues.apache.org/jira/browse/HIVE-25929?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
László Bodor updated HIVE-25929:
--------------------------------
Description:
History in chronological order:
HIVE-10508: removed some passwords from config that's propagated to execution engines
HIVE-9013: introduced hive.conf.hidden.list, which is used instead of the hardcoded list in HIVE-10508
the problem with HIVE-9013 is it's about to introduce a common method for removing sensitive data from Configuration, which absolutely makes sense in most of the cases (set command showing sensitive data), but can cause issues e.g. while using non-secure cloud connectors on a cluster, where instead of the hadoop credential provider API (which is considered the secure and proper way), passwords/secrets appear in the Configuration object
2 possible solutions:
1. introduce a new property like: "hive.conf.hidden.list.exec.engines" -> which defaults to "hive.conf.hidden.list" (configurable, but maybe just confusing, having a new config property which should be understood and maintained on a cluster)
2. simply revert DAGUtils to use to old stripHivePasswordDetails introduced by HIVE-10508 (convenient, less confusing for users, but cannot be configured)
> Let secret config properties to be propagated to Tez
> ----------------------------------------------------
>
> Key: HIVE-25929
> URL: https://issues.apache.org/jira/browse/HIVE-25929
> Project: Hive
> Issue Type: Bug
> Reporter: László Bodor
> Assignee: László Bodor
> Priority: Major
>
> History in chronological order:
> HIVE-10508: removed some passwords from config that's propagated to execution engines
> HIVE-9013: introduced hive.conf.hidden.list, which is used instead of the hardcoded list in HIVE-10508
> the problem with HIVE-9013 is it's about to introduce a common method for removing sensitive data from Configuration, which absolutely makes sense in most of the cases (set command showing sensitive data), but can cause issues e.g. while using non-secure cloud connectors on a cluster, where instead of the hadoop credential provider API (which is considered the secure and proper way), passwords/secrets appear in the Configuration object
> 2 possible solutions:
> 1. introduce a new property like: "hive.conf.hidden.list.exec.engines" -> which defaults to "hive.conf.hidden.list" (configurable, but maybe just confusing, having a new config property which should be understood and maintained on a cluster)
> 2. simply revert DAGUtils to use to old stripHivePasswordDetails introduced by HIVE-10508 (convenient, less confusing for users, but cannot be configured)
--
This message was sent by Atlassian Jira
(v8.20.1#820001)