improve

src/common/secret/src/secret_manager.rs

@@ -41,11 +41,12 @@ impl LocalSecretManager {
     /// Initialize the secret manager with the given temp file path, cluster id, and encryption key.
     /// # Panics
     /// Panics if fail to create the secret file directory.
-    pub fn init(temp_file_dir: Option<String>, cluster_id: String) {
+    pub fn init(temp_file_dir: String, cluster_id: String, worker_id: u32) {
         // use `get_or_init` to handle concurrent initialization in single node mode.
         INSTANCE.get_or_init(|| {
-            let temp_file_dir = temp_file_dir.unwrap_or_else(|| "./secrets".to_string());
-            let secret_file_dir = PathBuf::from(temp_file_dir).join(cluster_id);
+            let secret_file_dir = PathBuf::from(temp_file_dir)
+                .join(cluster_id)
+                .join(worker_id.to_string());
             std::fs::remove_dir_all(&secret_file_dir).ok();
             std::fs::create_dir_all(&secret_file_dir).unwrap();
 
@@ -62,7 +63,7 @@ impl LocalSecretManager {
     pub fn global() -> &'static LocalSecretManager {
         // Initialize the secret manager for unit tests.
         #[cfg(debug_assertions)]
-        LocalSecretManager::init(None, "test".to_string());
+        LocalSecretManager::init("./tmp".to_string(), "test_cluster".to_string(), 0);
 
         INSTANCE.get().unwrap()
     }

src/compute/src/lib.rs

@@ -138,8 +138,13 @@ pub struct ComputeNodeOpts {
     pub connector_rpc_endpoint: Option<String>,
 
     /// The path of the temp secret file directory.
-    #[clap(long, hide = true, env = "RW_TEMP_SECRET_FILE_DIR")]
-    pub temp_secret_file_dir: Option<String>,
+    #[clap(
+        long,
+        hide = true,
+        env = "RW_TEMP_SECRET_FILE_DIR",
+        default_value = "./secrets"
+    )]
+    pub temp_secret_file_dir: String,
 }
 
 impl risingwave_common::opts::Opts for ComputeNodeOpts {

src/compute/src/server.rs

@@ -219,6 +219,7 @@ pub async fn compute_node_serve(
     LocalSecretManager::init(
         opts.temp_secret_file_dir,
         meta_client.cluster_id().to_string(),
+        worker_id,
     );
 
     // Initialize observer manager.

src/frontend/src/lib.rs

@@ -144,8 +144,13 @@ pub struct FrontendOpts {
     pub enable_barrier_read: Option<bool>,
 
     /// The path of the temp secret file directory.
-    #[clap(long, hide = true, env = "RW_TEMP_SECRET_FILE_DIR")]
-    pub temp_secret_file_dir: Option<String>,
+    #[clap(
+        long,
+        hide = true,
+        env = "RW_TEMP_SECRET_FILE_DIR",
+        default_value = "./secrets"
+    )]
+    pub temp_secret_file_dir: String,
 }
 
 impl risingwave_common::opts::Opts for FrontendOpts {

src/frontend/src/session.rs

@@ -322,6 +322,7 @@ impl FrontendEnv {
         LocalSecretManager::init(
             opts.temp_secret_file_dir,
             meta_client.cluster_id().to_string(),
+            worker_id,
         );
 
         // This `session_params` should be initialized during the initial notification in `observer_manager`

src/meta/node/src/lib.rs

@@ -193,8 +193,13 @@ pub struct MetaNodeOpts {
     pub secret_store_private_key_hex: Option<String>,
 
     /// The path of the temp secret file directory.
-    #[clap(long, hide = true, env = "RW_TEMP_SECRET_FILE_DIR")]
-    pub temp_secret_file_dir: Option<String>,
+    #[clap(
+        long,
+        hide = true,
+        env = "RW_TEMP_SECRET_FILE_DIR",
+        default_value = "./secrets"
+    )]
+    pub temp_secret_file_dir: String,
 }
 
 impl risingwave_common::opts::Opts for MetaNodeOpts {

src/meta/node/src/server.rs

@@ -30,7 +30,9 @@ use risingwave_common_service::{MetricsManager, TracingExtractLayer};
 use risingwave_meta::barrier::StreamRpcManager;
 use risingwave_meta::controller::catalog::CatalogController;
 use risingwave_meta::controller::cluster::ClusterController;
-use risingwave_meta::manager::{MetaStoreImpl, MetadataManager, SystemParamsManagerImpl};
+use risingwave_meta::manager::{
+    MetaStoreImpl, MetadataManager, SystemParamsManagerImpl, META_NODE_ID,
+};
 use risingwave_meta::rpc::election::dummy::DummyElectionClient;
 use risingwave_meta::rpc::intercept::MetricsMiddlewareLayer;
 use risingwave_meta::rpc::ElectionClientRef;
@@ -519,7 +521,11 @@ pub async fn start_service_as_election_leader(
     )
     .await?;
 
-    LocalSecretManager::init(opts.temp_secret_file_dir, env.cluster_id().to_string());
+    LocalSecretManager::init(
+        opts.temp_secret_file_dir,
+        env.cluster_id().to_string(),
+        META_NODE_ID,
+    );
 
     let notification_srv = NotificationServiceImpl::new(
         env.clone(),

src/meta/src/manager/env.rs

@@ -285,7 +285,7 @@ pub struct MetaOpts {
     // The private key for the secret store, used when the secret is stored in the meta.
     pub secret_store_private_key: Option<Vec<u8>>,
     /// The path of the temp secret file directory.
-    pub temp_secret_file_dir: Option<String>,
+    pub temp_secret_file_dir: String,
 
     pub table_info_statistic_history_times: usize,
 }
@@ -349,7 +349,7 @@ impl MetaOpts {
             max_trivial_move_task_count_per_loop: 256,
             max_get_task_probe_times: 5,
             secret_store_private_key: Some("0123456789abcdef".as_bytes().to_vec()),
-            temp_secret_file_dir: None,
+            temp_secret_file_dir: "./secrets".to_string(),
             table_info_statistic_history_times: 240,
         }
     }

src/tests/simulation/src/cluster.rs

@@ -450,6 +450,8 @@ impl Cluster {
                 "hummock+sim://hummockadmin:[email protected]:9301/hummock001",
                 "--data-directory",
                 "hummock_001",
+                "--temp-secret-file-dir",
+                &format!("./secrets/meta-{i}"),
             ]);
             handle
                 .create_node()
@@ -477,6 +479,8 @@ impl Cluster {
                 "0.0.0.0:4566",
                 "--advertise-addr",
                 &format!("192.168.2.{i}:4566"),
+                "--temp-secret-file-dir",
+                &format!("./secrets/frontend-{i}"),
             ]);
             handle
                 .create_node()
@@ -505,6 +509,8 @@ impl Cluster {
                 "6979321856",
                 "--parallelism",
                 &conf.compute_node_cores.to_string(),
+                "--temp-secret-file-dir",
+                &format!("./secrets/compute-{i}"),
             ]);
             handle
                 .create_node()