Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mask AzureBlobStorage table engine credentials #75319

Conversation

garrettthomaskth
Copy link
Collaborator

Changelog category (leave one):

  • Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

mask AzureBlobStorage table engine credentials

Documentation entry for user-facing changes

  • Documentation is written (mandatory for new features)
Garretts-MBP.attlocal.net :) SELECT version()

SELECT version()

Query id: b4b6452a-085a-448c-9b06-3c18d779ab00

   ┌─version()──┐
1. │ 25.2.1.566 │
   └────────────┘

1 row in set. Elapsed: 0.001 sec. 

Garretts-MBP.attlocal.net :) SELECT query FROM system.query_log WHERE query_id = 'ea279bb9-b0f9-4ffa-88c7-764edb5c8be8'

SELECT query
FROM system.query_log
WHERE query_id = 'ea279bb9-b0f9-4ffa-88c7-764edb5c8be8'

Query id: 7c9c3baa-a642-408c-b0f7-b3a03aa07daf

   ┌─query─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
1. │ BACKUP ALL TO AzureBlobStorage('DefaultEndpointsProtocol=https;AccountName=test;AccountKey=2YUu...;EndpointSuffix=core.windows.net', 'test', 'test') │
   └───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

1 row in set. Elapsed: 0.004 sec. 

Garretts-MBP.attlocal.net :) SELECT query FROM system.query_log WHERE query_id = 'da64d380-c81e-43a4-8516-6dd1dd263c2d'

SELECT query
FROM system.query_log
WHERE query_id = 'da64d380-c81e-43a4-8516-6dd1dd263c2d'

Query id: 793b664a-c9a5-4c7d-a8ab-05e4f560b356

   ┌─query─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
1. │ SELECT * FROM azureBlobStorage('DefaultEndpointsProtocol=https;AccountName=test;AccountKey=[HIDDEN];EndpointSuffix=core.windows.net', 'test', 'test') │
   └───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

1 row in set. Elapsed: 0.003 sec. 

Garretts-MBP.attlocal.net :) 

Information about CI checks: https://clickhouse.com/docs/en/development/continuous-integration/

CI Settings (Only check the boxes if you know what you are doing)

All builds in Builds_1 and Builds_2 stages are always mandatory and will run independently of the checks below:

  • Only: Stateless tests
  • Only: Integration tests
  • Only: Performance tests

  • Skip: Style check
  • Skip: Fast test

  • Run all checks ignoring all possible failures (Resource-intensive. All test jobs execute in parallel).
  • Disable CI cache

@robot-ch-test-poll2 robot-ch-test-poll2 added the pr-bugfix Pull request with bugfix, not backported by default label Jan 31, 2025
@nikitamikhaylov nikitamikhaylov added the can be tested Allows running workflows for external contributors label Jan 31, 2025
@robot-clickhouse-ci-2
Copy link
Contributor

robot-clickhouse-ci-2 commented Jan 31, 2025

This is an automated comment for commit 74356dd with description of existing statuses. It's updated for the latest CI running

✅ Click here to open a full report in a separate page

Successful checks
Check nameDescriptionStatus
AST fuzzerRuns randomly generated queries to catch program errors. The build type is optionally given in parenthesis. If it fails, ask a maintainer for help✅ success
Bugfix validationChecks that either a new test (functional or integration) or there some changed tests that fail with the binary built on master branch✅ success
BuildsThere's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
BuzzHouse (asan)There's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
BuzzHouse (debug)There's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
BuzzHouse (msan)There's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
BuzzHouse (tsan)There's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
BuzzHouse (ubsan)There's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
ClickBenchRuns ClickBench with instant-attach table✅ success
Compatibility checkChecks that clickhouse binary runs on distributions with old libc versions. If it fails, ask a maintainer for help✅ success
Docker keeper imageThe check to build and optionally push the mentioned image to docker hub✅ success
Docker server imageThe check to build and optionally push the mentioned image to docker hub✅ success
Docs checkBuilds and tests the documentation✅ success
Fast testNormally this is the first check that is ran for a PR. It builds ClickHouse and runs most of stateless functional tests, omitting some. If it fails, further checks are not started until it is fixed. Look at the report to see which tests fail, then reproduce the failure locally as described here✅ success
Install packagesChecks that the built packages are installable in a clear environment✅ success
Integration testsThe integration tests report. In parenthesis the package type is given, and in square brackets are the optional part/total tests✅ success
Performance ComparisonMeasure changes in query performance. The performance test report is described in detail here. In square brackets are the optional part/total tests✅ success
Stateless testsRuns stateless functional tests for ClickHouse binaries built in various configurations -- release, debug, with sanitizers, etc✅ success
Stress testRuns stateless functional tests concurrently from several clients to detect concurrency-related errors✅ success
Style checkRuns a set of checks to keep the code style clean. If some of tests failed, see the related log from the report✅ success
Unit testsRuns the unit tests for different release types✅ success
Upgrade checkRuns stress tests on server version from last release and then tries to upgrade it to the version from the PR. It checks if the new server can successfully startup without any errors, crashes or sanitizer asserts✅ success

@kssenii kssenii self-assigned this Jan 31, 2025
void findAzureBlobStorageTableEngineSecretArguments()
{
/// azureBlobStorageCluster('cluster_name', 'conn_string/storage_account_url', ...) has 'conn_string/storage_account_url' as its second argument.
size_t url_arg_idx = is_cluster_function ? 1 : 0;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see build fails with

2025-01-31 02:31:13 In file included from /repo/src/Parsers/FunctionSecretArgumentsFinderAST.h:3:
2025-01-31 02:31:13 /repo/src/Parsers/FunctionSecretArgumentsFinder.h:548:30: error: use of undeclared identifier 'is_cluster_function'
2025-01-31 02:31:13   548 |         size_t url_arg_idx = is_cluster_function ? 1 : 0;
2025-01-31 02:31:13       |                              ^
2025-01-31 02:31:13 1 error generated.

Comment on lines 562 to 564
/// We should check other arguments first because we don't need to do any replacement in case of
/// azureBlobStorage(connection_string|storage_account_url, container_name, blobpath, format, [account_name, account_key, ...])
/// azureBlobStorageCluster(cluster, connection_string|storage_account_url, container_name, blobpath, format, [account_name, account_key, ...])
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
/// We should check other arguments first because we don't need to do any replacement in case of
/// azureBlobStorage(connection_string|storage_account_url, container_name, blobpath, format, [account_name, account_key, ...])
/// azureBlobStorageCluster(cluster, connection_string|storage_account_url, container_name, blobpath, format, [account_name, account_key, ...])
/// We should check other arguments first because we don't need to do any replacement in case of
/// AzureBlobStorage(connection_string|storage_account_url, container_name, blobpath, format) -- in this case there is no account_key
/// AzureBlobStorageCluster(cluster, connection_string|storage_account_url, container_name, blobpath, format) -- in this case there is no account_key

@kssenii kssenii added the pr-must-backport Pull request should be backported intentionally. Use this label with great care! label Feb 4, 2025
robot-clickhouse-ci-1 added a commit that referenced this pull request Feb 5, 2025
Cherry pick #75319 to 25.1: mask AzureBlobStorage table engine credentials
kssenii added a commit that referenced this pull request Feb 6, 2025
Backport #75319 to 25.1: mask AzureBlobStorage table engine credentials
robot-ch-test-poll1 added a commit that referenced this pull request Feb 6, 2025
Cherry pick #75319 to 24.11: mask AzureBlobStorage table engine credentials
robot-ch-test-poll1 added a commit that referenced this pull request Feb 6, 2025
Cherry pick #75319 to 24.12: mask AzureBlobStorage table engine credentials
@robot-ch-test-poll4 robot-ch-test-poll4 added the pr-backports-created Backport PRs are successfully created, it won't be processed by CI script anymore label Feb 6, 2025
robot-clickhouse-ci-2 added a commit that referenced this pull request Feb 6, 2025
Backport #75319 to 24.11: mask AzureBlobStorage table engine credentials
robot-ch-test-poll added a commit that referenced this pull request Feb 7, 2025
Backport #75319 to 24.12: mask AzureBlobStorage table engine credentials
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
can be tested Allows running workflows for external contributors pr-backports-created Backport PRs are successfully created, it won't be processed by CI script anymore pr-backports-created-cloud pr-bugfix Pull request with bugfix, not backported by default pr-must-backport Pull request should be backported intentionally. Use this label with great care! pr-synced-to-cloud The PR is synced to the cloud repo
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants