aajisaka commented on code in PR #7762: URL: https://github.com/apache/kyuubi/pull/7762#discussion_r4172652081
########## docs/security/internal_secure_access.md: ########## @@ -45,16 +45,39 @@ We strongly recommend restricting access to these secrets. Custom implementations of `EngineSecuritySecretProvider` are also supported for advanced secret management needs. +## Rolling upgrades from Kyuubi 1.11.1 or earlier + +Kyuubi 1.12 changed the internal access token format from a ciphertext encrypted with a static zero IV to a +ciphertext prefixed with a random IV. To interoperate with servers and engines from Kyuubi 1.11.1 or earlier, +use the following rolling upgrade procedure: + +1. Configure every replacement Kyuubi server with + `kyuubi.internal.security.crypto.compatibilityMode=MIGRATE`. The configuration is propagated to newly + launched engines. In this mode, Kyuubi issues legacy zero-IV tokens and accepts both token formats. +2. Replace all pre-1.12 servers and engines, then ensure that no pre-1.12 server or engine remains. Review Comment: Thanks. Updated in [90f00c2](https://github.com/apache/kyuubi/pull/7762/commits/90f00c2379544e9557df69ce78417df1043a24e0) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
