github-actions[bot] commented on code in PR #68540:
URL: https://github.com/apache/doris/pull/68540#discussion_r4357329983
##########
fe/fe-filesystem/fe-filesystem-gcs/src/main/java/org/apache/doris/filesystem/gcs/GcsFileSystemProperties.java:
##########
@@ -119,6 +135,26 @@ public static GcsFileSystemProperties of(Map<String,
String> properties) {
@Override
public void validate() {
validateHmacDialect("gs", "GCS");
Review Comment:
[P2] Separate Glue metadata roles from GCS storage validation
With `provider=GCP`, native or anonymous GCS authentication, and
`glue.role_arn`, this unconditional `validateHmacDialect` call rejects the
catalog before FileIO construction:
`S3CompatSignals.hasAwsOnlyCredentialOptions(rawProperties)` includes
`glue.role_arn`, `glue.external_id`, and nondefault
`glue.credentials_provider_type`. Those settings authenticate the independent
Glue metadata client. The new `anonymousGcsFileIoDoesNotAssumeTheGlueRole` test
necessarily throws at `catalogOptions(raw)` for this reason, before exercising
the new factory. Exclude metadata-scoped credentials from GCS storage
validation and cover both role/provider-chain metadata authentication. This
differs from the existing Glue region and anonymous-provider reports, whose
downstream assignments are now repaired.
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergCatalogFactory.java:
##########
@@ -450,6 +453,45 @@ public static Map<String, String>
buildCatalogProperties(IcebergCatalogPropertie
// s3tables: bespoke instantiation. Preserve the skeleton's
base+impl routing.
break;
}
+ chosenS3.ifPresent(storage ->
storage.toBackendProperties().ifPresent(backend -> {
+ Optional<GcsAuth> auth = GcsAuthResolver.resolve(backend.toMap());
+ if (auth.filter(GcsAuth::isAnonymous).isPresent()) {
+ if (IcebergCatalogProperties.TYPE_GLUE.equals(flavor)) {
+ // Glue metadata still needs AWS credentials when the GCS
objects are public.
+ opts.put(S3FileIOProperties.CLIENT_FACTORY,
AnonymousS3FileIOAwsClientFactory.class.getName());
+ } else {
+ opts.put(AwsClientProperties.CLIENT_CREDENTIALS_PROVIDER,
+
"software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider");
Review Comment:
[P2] Preserve REST SigV4 credentials for anonymous GCS storage
For a REST catalog with `provider=GCP`,
`gs.credential_provider_type=ANONYMOUS`,
`iceberg.rest.signing-name=execute-api`, `iceberg.rest.sigv4-enabled=true`, and
a signing region, valid ambient AWS credentials should authenticate the REST
endpoint. This assignment replaces that default chain with
`AnonymousCredentialsProvider`. Iceberg's [REST credentials
selection](https://github.com/apache/iceberg/blob/apache-iceberg-1.11.0/aws/src/main/java/org/apache/iceberg/aws/AwsProperties.java#L451-L497)
uses this shared provider when explicit REST keys are absent, so the initial
REST config request is unsigned and an endpoint requiring SigV4 rejects it
before any public GCS object is read. Scope anonymous credentials to FileIO
here too. This is a distinct REST metadata path from the existing Glue thread;
the new Glue-only branch leaves REST in this `else`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
