lasdf1234 commented on PR #13539: URL: https://github.com/apache/gravitino/pull/13539#issuecomment-5880880986
@diqiu50 Thanks for the detailed review. Replies below: **1. Explicit `credential-providers` blocks static recovery** Agreed — this was critical. Fixed in `BaseCatalog.propertiesWithCredentialProviders`: even when `credential-providers` is set explicitly, we still run `ensureDetectedCredentialProvidersListed` so complete static pairs (storage / JDBC / AWS / DLF) keep their `*-secret-key` (and related) providers listed. Explicit entries are not removed. Covered by `TestBaseCatalogCredentialSecrets`. **2. GVFS calls `getCredentials` uncached / Python key mapping** Fixed on both Java and Python GVFS: 1. Only merge static credentials (`expireTimeInMs == 0`); expiring/token providers are skipped so we do not trigger STS on every `ls`/`open`. 2. Cache successful static results per catalog name; transient REST failures are not cached so a later op can retry. 3. Log and continue on `RESTException` / `NotFound` (Python also handles `URLError`) instead of failing the FS op. 4. Python maps `credentialInfo` keys (e.g. `s3-access-key-id`) to GVFS option names (`s3_access_key_id`). Mock server also stubs empty `/credentials` for unit tests. **3. Fileset static overlay skips the scheme filter** Agreed. This is a fileset-path concern and is intentionally not in this PR. Tracked in the follow-up fileset PR (#13570) so catalog/credential recovery stays reviewable on its own here. **4. Trino/Flink swallow `RESTException` without logging** Fixed. Trino `CatalogConnectorManager` and Flink `PropertyUtils` now log WARN on `RESTException` (and DEBUG on `NotFound`/`Unsupported`) and continue with masked properties, aligned with Spark / Iceberg REST / GVFS. **5. Incomplete key pair disappears silently** Fixed. When only one half of a static access-key pair is present, we now WARN in `addStorageCredentialProviders` and in `AwsSecretKeyCredentialProvider` / `DlfSecretKeyCredentialProvider`, so the incomplete config is visible instead of disappearing silently. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
