[HIVE-21047] Read the HMS backend database password and truststore password during PersistenceManagerFactory initialization time

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 4.0.0
• Component/s: Standalone Metastore
• Assignee: Unassigned
• Reporter: Morio Ramdenbourg
• Created: 16/Dec/18 01:44
• Updated: 16/Dec/18 01:49

Description

This was pointed out by vihangk1 as part of the review for HIVE-20992.

As part of the redaction of the javax.jdo.option.ConnectionPassword and metastore.dbaccess.ssl.truststore.password properties, they both use the Hadoop Credential Provider API to prevent the passwords from being stored in plain text.

However, these are both being read in setConf() in ObjectStore, thereby calling the expensive decrypt during every new database connection initialization despite these values almost never changing.

We should instead move these reads into the PersistenceManagerFactory initPMF() method and cache their values so they are only read once when the HMS starts.