Fixes open-metadata/openmetadata-collate#7380: Keep JAVA_TOOL_OPTIONS secrets out of the startup logs (backport 2.0 #35402)

bin/openmetadata-server-start.sh

@@ -76,6 +76,30 @@ else
   JAVA="$JAVA_HOME/bin/java"
 fi
 
+# The JVM echoes JAVA_TOOL_OPTIONS to stderr at startup ("Picked up JAVA_TOOL_OPTIONS: ..."), which
+# puts any secret set there, such as a truststore password, into the container log, and plain
+# arguments would show in ps instead. So pass the options in a -XX:VMOptionsFile: the JVM parses it
+# exactly like JAVA_TOOL_OPTIONS, quotes and '#' included, and does not echo it. The file is opened
+# on fd 3 and unlinked at once, tmpfs first, so ps only ever shows /dev/fd/3, even after musl's
+# launcher re-exec. It goes ahead of our options so ours still take precedence.
+JAVA_TOOL_ARGS=""
+if [ -n "$JAVA_TOOL_OPTIONS" ]; then
+  java_tool_options_file=""
+  for tmp_dir in /dev/shm "${TMPDIR:-/tmp}"; do
+    java_tool_options_file=$(mktemp "$tmp_dir/jvm-options.XXXXXX" 2>/dev/null) && break
+  done
+  if [ -n "$java_tool_options_file" ] &&
+    printf '%s\n' "$JAVA_TOOL_OPTIONS" > "$java_tool_options_file"; then
+    exec 3< "$java_tool_options_file"
+    JAVA_TOOL_ARGS="-XX:VMOptionsFile=/dev/fd/3"
+    unset JAVA_TOOL_OPTIONS
+  else
+    echo "Warning: could not write JAVA_TOOL_OPTIONS to /dev/shm or ${TMPDIR:-/tmp}," \
+      "so the JVM will print it at startup" >&2
+  fi
+  [ -z "$java_tool_options_file" ] || rm -f "$java_tool_options_file"
+fi
+
 # Set Debug options if enabled
 if [ "x$OPENMETADATA_DEBUG" != "x" ]; then
 
@@ -126,7 +150,7 @@ if [ "x$DAEMON_MODE" = "xtrue" ]; then
     # emits what logback already writes to the rotated logs/openmetadata.log. Silence the console
     # so this file only collects JVM and pre-logback output. CONSOLE_LOG_LEVEL=TRACE restores it.
     export CONSOLE_LOG_LEVEL="${CONSOLE_LOG_LEVEL:-OFF}"
-    nohup $JAVA $OPENMETADATA_HEAP_OPTS $OPENMETADATA_JVM_PERFORMANCE_OPTS $OPENMETADATA_GC_LOG_OPTS -cp $CLASSPATH $OPENMETADATA_OPTS "$APP_CLASS" "server" "$@" > "$CONSOLE_OUTPUT_FILE" 2>&1 < /dev/null &
+    nohup $JAVA $JAVA_TOOL_ARGS $OPENMETADATA_HEAP_OPTS $OPENMETADATA_JVM_PERFORMANCE_OPTS $OPENMETADATA_GC_LOG_OPTS -cp $CLASSPATH $OPENMETADATA_OPTS "$APP_CLASS" "server" "$@" > "$CONSOLE_OUTPUT_FILE" 2>&1 < /dev/null &
 else
-    exec $JAVA $OPENMETADATA_HEAP_OPTS $OPENMETADATA_JVM_PERFORMANCE_OPTS $OPENMETADATA_GC_LOG_OPTS -cp $CLASSPATH $OPENMETADATA_OPTS "$APP_CLASS" "server" "$@"
+    exec $JAVA $JAVA_TOOL_ARGS $OPENMETADATA_HEAP_OPTS $OPENMETADATA_JVM_PERFORMANCE_OPTS $OPENMETADATA_GC_LOG_OPTS -cp $CLASSPATH $OPENMETADATA_OPTS "$APP_CLASS" "server" "$@"
 fi

bin/openmetadata.sh

@@ -36,7 +36,7 @@ function catalogStart {
        # Export CONSOLE_LOG_LEVEL=TRACE before starting to get the old behaviour back.
        export CONSOLE_LOG_LEVEL="${CONSOLE_LOG_LEVEL:-OFF}"
        cd ${CATALOG_HOME}
-       nohup ${JAVA} ${CATALOG_HEAP_OPTS} ${CATALOG_JVM_PERF_OPTS} ${CATALOG_DEBUG_OPTS} ${CATALOG_GC_LOG_OPTS} ${CATALOG_JMX_OPTS} -cp ${CLASSPATH} "${APP_CLASS}" "server" "$@" 2>>"${ERR_FILE}" 1>>"${OUT_FILE}" &
+       nohup ${JAVA} ${JAVA_TOOL_ARGS} ${CATALOG_HEAP_OPTS} ${CATALOG_JVM_PERF_OPTS} ${CATALOG_DEBUG_OPTS} ${CATALOG_GC_LOG_OPTS} ${CATALOG_JMX_OPTS} -cp ${CLASSPATH} "${APP_CLASS}" "server" "$@" 2>>"${ERR_FILE}" 1>>"${OUT_FILE}" &
        cd - &> /dev/null
        echo $! > ${PID_FILE}
        echo $(catalogStatus)
@@ -151,6 +151,26 @@ else
   JAVA="${JAVA_HOME}/bin/java"
 fi
 
+# As in bin/openmetadata-server-start.sh: pass JAVA_TOOL_OPTIONS in a -XX:VMOptionsFile on fd 3,
+# so neither the JVM's startup echo nor ps shows it.
+JAVA_TOOL_ARGS=""
+if [ -n "$JAVA_TOOL_OPTIONS" ]; then
+  java_tool_options_file=""
+  for tmp_dir in /dev/shm "${TMPDIR:-/tmp}"; do
+    java_tool_options_file=$(mktemp "$tmp_dir/jvm-options.XXXXXX" 2>/dev/null) && break
+  done
+  if [ -n "$java_tool_options_file" ] &&
+    printf '%s\n' "$JAVA_TOOL_OPTIONS" > "$java_tool_options_file"; then
+    exec 3< "$java_tool_options_file"
+    JAVA_TOOL_ARGS="-XX:VMOptionsFile=/dev/fd/3"
+    unset JAVA_TOOL_OPTIONS
+  else
+    echo "Warning: could not write JAVA_TOOL_OPTIONS to /dev/shm or ${TMPDIR:-/tmp}," \
+      "so the JVM will print it at startup" >&2
+  fi
+  [ -z "$java_tool_options_file" ] || rm -f "$java_tool_options_file"
+fi
+
 if [[ "x${CATALOG_HEAP_OPTS}" = "x" ]]; then
     export CATALOG_HEAP_OPTS="-Xmx2G -Xms2G"
 fi

bootstrap/openmetadata-ops.sh

@@ -53,6 +53,26 @@ else
   CLASSPATH=`mvn -pl openmetadata-service -q exec:exec -Dexec.executable=echo -Dexec.args="%classpath"`
 fi
 
-${JAVA} -Dbootstrap.dir=$BOOTSTRAP_DIR  -cp ${CLASSPATH} ${OPENMETADATA_SETUP_MAIN_CLASS} -c $CONFIG_FILE_PATH "$@"
+# As in bin/openmetadata-server-start.sh: pass JAVA_TOOL_OPTIONS in a -XX:VMOptionsFile on fd 3,
+# so neither the JVM's startup echo nor ps shows it.
+JAVA_TOOL_ARGS=""
+if [ -n "$JAVA_TOOL_OPTIONS" ]; then
+  java_tool_options_file=""
+  for tmp_dir in /dev/shm "${TMPDIR:-/tmp}"; do
+    java_tool_options_file=$(mktemp "$tmp_dir/jvm-options.XXXXXX" 2>/dev/null) && break
+  done
+  if [ -n "$java_tool_options_file" ] &&
+    printf '%s\n' "$JAVA_TOOL_OPTIONS" > "$java_tool_options_file"; then
+    exec 3< "$java_tool_options_file"
+    JAVA_TOOL_ARGS="-XX:VMOptionsFile=/dev/fd/3"
+    unset JAVA_TOOL_OPTIONS
+  else
+    echo "Warning: could not write JAVA_TOOL_OPTIONS to /dev/shm or ${TMPDIR:-/tmp}," \
+      "so the JVM will print it at startup" >&2
+  fi
+  [ -z "$java_tool_options_file" ] || rm -f "$java_tool_options_file"
+fi
+
+${JAVA} ${JAVA_TOOL_ARGS} -Dbootstrap.dir=$BOOTSTRAP_DIR  -cp ${CLASSPATH} ${OPENMETADATA_SETUP_MAIN_CLASS} -c $CONFIG_FILE_PATH "$@"
 exit $?