hadoop-mapreduce-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jason Lowe (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (MAPREDUCE-6741) add MR support to redact job conf properties from JHS
Date Mon, 01 Aug 2016 19:56:20 GMT

    [ https://issues.apache.org/jira/browse/MAPREDUCE-6741?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15402713#comment-15402713
] 

Jason Lowe commented on MAPREDUCE-6741:
---------------------------------------

Thanks for the patch!

Is it OK to expose the length of the original value?  Wondering if the replacement value should
be a constant number of asterisks or something like "<redacted>" or "<removed>".

These properties are still visible via the AM UI while the job is running.  Should they be
redacted there as well?

This should be making a copy of the configuration rather than doctoring it up directly with
redacted values, tracking them in a separate map, then trying to patch it back later.  If
anything is asynchronously looking at the config and needs one of those redacted values then
we're setting ourselves up for a random failure that's difficult to debug.  Making a copy
means we don't need to worry about tracking values and restoring anything later.

There should be an entry in mapred-default.xml with an appropriate description documenting
the new property.

I recommend we drop the '-in-jhs' part of the property name since it's likely users will want
this redacted everywhere eventually, even if it's not complete in this patch.

> add MR support to redact job conf properties from JHS
> -----------------------------------------------------
>
>                 Key: MAPREDUCE-6741
>                 URL: https://issues.apache.org/jira/browse/MAPREDUCE-6741
>             Project: Hadoop Map/Reduce
>          Issue Type: Improvement
>          Components: mrv2
>    Affects Versions: 2.7.2
>            Reporter: Haibo Chen
>            Assignee: Haibo Chen
>         Attachments: mapreduce6741.001.patch, mapreduce6741.002.patch, mapreduce6741.003.patch
>
>
> JHS today displays all Job conf properties in Web UI directly. Users may have some credentials
or any sensitive information they added to the job conf but do not want to be shown in Web
UI. It'd be nice if we can allow users to specify a set of properties which JHS will filter
out when Job conf is displayed.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: mapreduce-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: mapreduce-issues-help@hadoop.apache.org


Mime
View raw message