[HIVE-25929] Let secret config properties to be propagated to Tez

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Labels: pull-request-available
• Assignee: László Bodor
• Reporter: László Bodor
• Created: 06/Feb/22 10:32
• Updated: 17/Jun/22 08:46
• Resolved: 17/Jun/22 08:46

Description

History in chronological order:
HIVE-10508: removed some passwords from config that's propagated to execution engines
HIVE-9013: introduced hive.conf.hidden.list, which is used instead of the hardcoded list in HIVE-10508

the problem with HIVE-9013 is it's about to introduce a common method for removing sensitive data from Configuration, which absolutely makes sense in most of the cases (set command showing sensitive data), but can cause issues e.g. while using non-secure cloud connectors on a cluster, where instead of the hadoop credential provider API (which is considered the secure and proper way), passwords/secrets appear in the Configuration object (like: "fs.azure.account.oauth2.client.secret")

2 possible solutions:
1. introduce a new property like: "hive.conf.hidden.list.exec.engines" -> which defaults to "hive.conf.hidden.list" (configurable, but maybe just more confusing to users, having a new config property which should be understood and maintained on a cluster)
2. simply revert DAGUtils to use to old stripHivePasswordDetails introduced by HIVE-10508 (convenient, less confusing for users, but cannot be configured)

Issue Links

• is related to: HIVE-9013 Hive set command exposes metastore db password
• is related to: HIVE-10508 Strip out password information from config passed to Tez/MR in cases where password encryption is not used
• links to: GitHub Pull Request #3019