aajisaka commented on code in PR #7762:
URL: https://github.com/apache/kyuubi/pull/7762#discussion_r4172649073
##########
kyuubi-common/src/main/scala/org/apache/kyuubi/config/KyuubiConf.scala:
##########
@@ -3204,6 +3204,31 @@ object KyuubiConf {
.version("1.12.0")
.fallbackConf(ENGINE_SECURITY_CRYPTO_CIPHER_TRANSFORMATION)
+ object InternalSecurityCryptoCompatibilityMode extends Enumeration {
+ type InternalSecurityCryptoCompatibilityMode = Value
+
+ val STRICT, READ_COMPATIBLE, MIGRATE = Value
+ }
+
+ val INTERNAL_SECURITY_CRYPTO_COMPATIBILITY_MODE: ConfigEntry[String] =
+ buildConf("kyuubi.internal.security.crypto.compatibilityMode")
+ .doc("Controls internal access token compatibility. Supported values:
<ul>" +
+ "<li>STRICT: issue and accept only tokens with a prefixed random
IV.</li>" +
+ "<li>READ_COMPATIBLE: issue tokens with a prefixed random IV and
accept both token " +
+ "formats.</li>" +
+ "<li>MIGRATE: issue and accept both token formats using the legacy
static zero IV for " +
+ "issued tokens.</li>" +
+ "</ul> MIGRATE weakens token security and should only be used during a
rolling " +
+ "upgrade from Kyuubi 1.11.1 or earlier. This compatibility mode will
be removed in a " +
+ "future release.")
Review Comment:
Thanks. Updated in
[90f00c2](https://github.com/apache/kyuubi/pull/7762/commits/90f00c2379544e9557df69ce78417df1043a24e0)
##########
docs/deployment/migration-guide.md:
##########
@@ -24,6 +24,13 @@
* Since Kyuubi 1.13, the support of Flink engine for Flink 2.0 is deprecated,
and will be removed in the future.
* Since Kyuubi 1.13, `kyuubi.server.redaction.regex` defaults to
`(?i)secret|password|token|access[.]key` instead of being unset, so
`kyuubi.server.conf.retrieveMode=REDACTED` (the default) redacts matching
session-config keys/values out of the box; it also affects the command-line
arguments Kyuubi logs for spawned engine processes. Set it to a different
pattern to override.
+## Upgrading from Kyuubi 1.11.1 or earlier to 1.12.1 or later
Review Comment:
Updated to 1.11.x in
[90f00c2](https://github.com/apache/kyuubi/pull/7762/commits/90f00c2379544e9557df69ce78417df1043a24e0)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
