[jira] [Commented] (MAPREDUCE-6741) add MR support to redact job conf properties from JHS

["Jason Lowe (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MAPREDUCE-6741?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15402713#comment-15402713 ] 

Jason Lowe commented on MAPREDUCE-6741:
---------------------------------------

Thanks for the patch!

Is it OK to expose the length of the original value?  Wondering if the replacement value should be a constant number of asterisks or something like "<redacted>" or "<removed>".

These properties are still visible via the AM UI while the job is running.  Should they be redacted there as well?

This should be making a copy of the configuration rather than doctoring it up directly with redacted values, tracking them in a separate map, then trying to patch it back later.  If anything is asynchronously looking at the config and needs one of those redacted values then we're setting ourselves up for a random failure that's difficult to debug.  Making a copy means we don't need to worry about tracking values and restoring anything later.

There should be an entry in mapred-default.xml with an appropriate description documenting the new property.

I recommend we drop the '-in-jhs' part of the property name since it's likely users will want this redacted everywhere eventually, even if it's not complete in this patch.

> add MR support to redact job conf properties from JHS
> -----------------------------------------------------
>
>                 Key: MAPREDUCE-6741
>                 URL: https://issues.apache.org/jira/browse/MAPREDUCE-6741
>             Project: Hadoop Map/Reduce
>          Issue Type: Improvement
>          Components: mrv2
>    Affects Versions: 2.7.2
>            Reporter: Haibo Chen
>            Assignee: Haibo Chen
>         Attachments: mapreduce6741.001.patch, mapreduce6741.002.patch, mapreduce6741.003.patch
>
>
> JHS today displays all Job conf properties in Web UI directly. Users may have some credentials or any sensitive information they added to the job conf but do not want to be shown in Web UI. It'd be nice if we can allow users to specify a set of properties which JHS will filter out when Job conf is displayed.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: mapreduce-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: mapreduce-issues-help@hadoop.apache.org