aiceflower opened a new pull request, #5456: URL: https://github.com/apache/linkis/pull/5456
## Summary Remove the well-known hardcoded default cryptKey `"bdp-for-server"` that was shared by all Linkis deployments not explicitly configuring `wds.linkis.crypt.key`. ## Changes - Default value changed from `"bdp-for-server"` to empty string - Startup validation: empty / legacy default / keys < 16 chars cause `BDPInitServerException` (fail-closed) - Escape hatch: `linkis.crypt.key.allow.insecure=true` (default false) - All instances must share the same key — generate 24+ random chars before upgrading ## Affected files - `linkis-commons/linkis-module/.../ServerConfiguration.scala` (+39/-3) ## Deployment impact | Scenario | Behavior | |---|---| | cryptKey not configured | Refuses to start | | cryptKey = bdp-for-server | Refuses to start | | cryptKey = 16+ random | No impact | 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
