You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "george-zubrienko (via GitHub)" <gi...@apache.org> on 2025/01/03 20:30:47 UTC
[PR] Clarify setting credentials for root principals when bootstrapping [polaris]
george-zubrienko opened a new pull request, #611:
URL: https://github.com/apache/polaris/pull/611
Current documentation site doesn't say anything about where to get creds for root principal when using production (Postgres) metastore backend. Which leads to a successful bootstrap w/o an ability to use the server.
I've spent a couple hours figuring out how to control root principal credentials at bootstrap stage and finally found [yhis](https://github.com/apache/polaris/blob/50ef1bca3a2f32d79829fda313e71f62e8f2633a/polaris-core/src/main/java/org/apache/polaris/core/persistence/PrincipalSecretsGenerator.java#L69-L85) code piece, which answered my question, but let's update the docs as well!
NB: this is a documentation-only change.
<!--
Possible security vulnerabilities: STOP here and contact security@apache.org instead!
Please update the title of the PR with a meaningful message - do not leave it "empty" or "generated"
Please update this summary field:
The summary should cover these topics, if applicable:
* the motivation for the change
* a description of the status quo, for example the current behavior
* the desired behavior
* etc
PR checklist:
- Do a self-review of your code before opening a pull request
- Make sure that there's good test coverage for the changes included in this PR
- Run tests locally before pushing a PR (./gradlew check)
- Code should have comments where applicable. Particularly hard-to-understand
areas deserve good in-line documentation.
- Include changes and enhancements to the documentation (in site/content/in-dev/unreleased)
- For Work In Progress Pull Requests, please use the Draft PR feature.
Make sure to add the information BELOW this comment.
Everything in this comment will NOT be added to the PR description.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2569880755
Thanks @george-zubrienko. I think it’s a great idea to document the process for setting environment variables for client IDs and secrets, even before we finalize #461. This ensures users have clear guidance in the interim. Moreover, even after #461 is implemented, documenting this process will remain valuable as it provides clarity for users who prefer or need to use environment variables.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2569946497
I support #461, but it appears to have run into some turmoil in reviews. This docs change is non-controversial, I hope, so we could probably merge this PR first to make users' lives easier, and then fix doc conflicts in #461 when it is rebased.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2569882753
#461 currently [includes](https://github.com/apache/polaris/pull/461/files#diff-6e5e70cfe8639853041192417107e149300d1bcd164a3af04e9d041f1c5285e3R87) corresponding documentation changes. Fixing this bootstrap experience is incredibly important, and documenting the current broken state should probably not be as high of a priority as an actual fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2569871654
I think ideally we should try to resolve #461 first; rather than documenting how not to break the metastore, we can better design the service so as to make that impossible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "george-zubrienko (via GitHub)" <gi...@apache.org>.
george-zubrienko commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2573218703
> current broken state
I won't consider this as "broken state", as things work given the explanation of how they work is provided ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #611:
URL: https://github.com/apache/polaris/pull/611#discussion_r1902194714
##########
site/content/in-dev/unreleased/configuring-polaris-for-production.md:
##########
@@ -72,18 +72,54 @@ To use EclipseLink for metastore management, specify the configuration `metaStor
Before using Polaris when using a metastore manager other than `in-memory`, you must **bootstrap** the metastore manager. This is a manual operation that must be performed **only once** in order to prepare the metastore manager to integrate with Polaris. When the metastore manager is bootstrapped, any existing Polaris entities in the metastore manager may be **purged**.
-To bootstrap Polaris, run:
+By default, Polaris will create randomised `CLIENT_ID` and `CLIENT_SECRET` for the `root` principal and store their hashes in the metastore backend. In order to provide your own credentials for `root` principal (so you can request tokens via `api/catalog/v1/oauth/tokens`), set the following envrionment variables for realm name `polaris`:
Review Comment:
I'd avoid using `polaris` as a realm name, since the env variable name has two `POLARIS` then. How about a name like `my_realm`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2569937121
I agree that #461 is important, but this doesn’t seem to be an either-or situation. This documentation update is mostly compatible with the changes in #461, and we could always adjust the doc in case of any discrepancy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "george-zubrienko (via GitHub)" <gi...@apache.org>.
george-zubrienko commented on code in PR #611:
URL: https://github.com/apache/polaris/pull/611#discussion_r1903887362
##########
site/content/in-dev/unreleased/configuring-polaris-for-production.md:
##########
@@ -72,18 +72,54 @@ To use EclipseLink for metastore management, specify the configuration `metaStor
Before using Polaris when using a metastore manager other than `in-memory`, you must **bootstrap** the metastore manager. This is a manual operation that must be performed **only once** in order to prepare the metastore manager to integrate with Polaris. When the metastore manager is bootstrapped, any existing Polaris entities in the metastore manager may be **purged**.
-To bootstrap Polaris, run:
+By default, Polaris will create randomised `CLIENT_ID` and `CLIENT_SECRET` for the `root` principal and store their hashes in the metastore backend. In order to provide your own credentials for `root` principal (so you can request tokens via `api/catalog/v1/oauth/tokens`), set the following envrionment variables for realm name `polaris`:
Review Comment:
Good point, updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain merged PR #611:
URL: https://github.com/apache/polaris/pull/611
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Clarify setting credentials for root principals when bootstrapping [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on PR #611:
URL: https://github.com/apache/polaris/pull/611#issuecomment-2574130040
Thanks @george-zubrienko for the PR. Thanks @dimas-b and @eric-maynard for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org