Fixes open-metadata/openmetadata-collate#7380: Keep JAVA_TOOL_OPTIONS secrets out of the startup logs (backport 2.0 #35402)

[mohityadav766]

Describe your changes:

Fixes open-metadata/openmetadata-collate#7380

Backport of #35402 to 2.0. It must ship in the same 2.0.x patch as open-metadata/openmetadata-collate#7420. On every pod start, the Collate chart's run-db-migrations init container runs this repo's bootstrap/openmetadata-ops.sh, with the same extraEnvs. With only the Collate backport, the server log would be clean while the migration log still printed the password.

When JAVA_TOOL_OPTIONS is set, for example to pass a truststore password from a Kubernetes secret, the JVM prints it to stderr at startup (Picked up JAVA_TOOL_OPTIONS: ...). No flag turns that off.

What changed:

• bin/openmetadata-server-start.sh, bootstrap/openmetadata-ops.sh and bin/openmetadata.sh now write the options to a -XX:VMOptionsFile and unset the variable.
  • The JVM parses that file exactly like JAVA_TOOL_OPTIONS, quotes and # included, and doesn't echo it.
  • The file is created in /dev/shm, falling back to $TMPDIR. It is opened on fd 3 and unlinked at once, so nothing stays on disk.
  • ps only shows -XX:VMOptionsFile=/dev/fd/3. That holds on the 2.0 Alpine images too: the JVM reads the file itself after the musl launcher re-exec.
  • The file goes ahead of the scripts' own options, so precedence is unchanged.
  • If neither directory is writable, the launchers print a one-line warning without the value and leave the variable to the JVM.
• The launcher changes are byte-identical to Fixes open-metadata/openmetadata-collate#7380: Keep JAVA_TOOL_OPTIONS secrets out of the startup logs #35402's. The docker smoke test assertion is left out, because 2.0 has no smoke test.

Type of change:

• Bug fix

High-level design:

N/A — backport of #35402.

Tests:

Use cases covered

• With JAVA_TOOL_OPTIONS set, its options still reach the JVM, and the value no longer appears in the server log, the migration log, logs/catalog.err, or the JVM's command line.
• Values containing # or quotes arrive exactly as JAVA_TOOL_OPTIONS would deliver them.
• The scripts' own options still take precedence, as before.

Unit tests

Not applicable: shell scripts only.

Backend integration tests

• Not applicable (no backend API changes).

Ingestion integration tests

• Not applicable (no ingestion changes).

Playwright (UI) tests

• Not applicable (no UI changes).

Manual testing performed

1. On 2.0, these three files were identical to the main base of Fixes open-metadata/openmetadata-collate#7380: Keep JAVA_TOOL_OPTIONS secrets out of the startup logs #35402, so this branch carries Fixes open-metadata/openmetadata-collate#7380: Keep JAVA_TOOL_OPTIONS secrets out of the startup logs #35402's final launchers byte for byte.

2. I ran those launchers with stub main classes under several shells:

   • macOS bash 3.2;
   • dash on Temurin 21 / Ubuntu (glibc);
   • busybox ash on the 2.0.5 Alpine image (musl), which is this branch's runtime.

   The values tested were -Dsmoke.p=changeit -Xmx256m, -Dsmoke.p=pa#ss, and -Dsmoke.p='pa#s"s' -Dsmoke.q="a b". Results:

   • nothing is printed;
   • every value arrives intact (changeit, pa#ss, pa#s"s, a b);
   • JAVA_TOOL_OPTIONS is gone from the environment and the command line, on musl too;
   • max heap is unchanged;
   • no options file is left behind.

3. On gcr.io/distroless/cc-debian13:debug-nonroot as uid 65532, I checked two edge cases:

   • with a read-only root filesystem, /dev/shm is still used;
   • with /dev/shm read-only as well, the launcher prints the one-line warning and falls back.

UI screen recording:

Not applicable — launcher scripts only, no UI.

Checklist:

• I have read the CONTRIBUTING document.
• My PR title is Fixes <issue-number>: <short explanation>
• My PR is linked to a GitHub issue via Fixes #<issue-number> above.
• I have commented on my code, particularly in hard-to-understand areas.
• I have added tests (unit / integration / Playwright as applicable) and listed them above.
• Decision check: no record needed. The rule is stated in each launcher.

🤖 Generated with Claude Code

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• Linked issue open-metadata/openmetadata-collate#7380 does not exist or is not accessible.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Changing three JVM launchers to pass JAVA_TOOL_OPTIONS through an unlinked file affects startup option delivery and could omit or alter JVM options if parsing or fallback differs.

Moves JAVA_TOOL_OPTIONS into a -XX:VMOptionsFile on /dev/shm (falling back to $TMPDIR) across the server start, ops bootstrap, and openmetadata.sh launchers, so secret values like truststore passwords no longer appear in startup logs. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}