[NIFI-3110] Allow template export to include variable registry references for sensitive values

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Affects Version/s: 1.1.0
• Component/s: Core Framework
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 28/Nov/16 18:11
• Updated: 18/Sep/23 18:12
• Resolved: 18/Sep/23 18:12

Description

By design, templates do not include any processor properties marked as sensitive by the PropertyDescriptor (e.g. encryption password, JDBC connection password, etc.). This is to prevent accidental data leakage when templates are exported and shared.

Now that the Variable Registry is available, templates should be able to export the value of a sensitive property if and only if it can be determined that the value is a reference to an entry in the Variable Registry rather than a literal sensitive value. This will support the efforts for enhancing the "SDLC" process of promoting flows from "development" to "QA/QE" and "production" environments, as the template/flow will not need to be modified to reference the distinct values (under the same reference) in each environment.

Issue Links

• Is contained by: NIFI-5627 Improve handling of sensitive properties
• is part of: NIFI-3311 Variable Registry Enhancements
• is related to: NIFI-2653 Encrypted configs should handle variable registry
• is related to: NIFI-3046 Use Variable Registry to populate fields that do not currently support EL
• relates to: NIFI-5270 my ftp password is "${password}" so nifi's LISTFtp won't use it.