yuqi1129 opened a new issue, #11734: URL: https://github.com/apache/gravitino/issues/11734
### What would you like to be improved? `AwsIrsaCredentialGenerator` currently obtains the OIDC token for AWS STS `AssumeRoleWithWebIdentity` by reading the env-driven token file directly (`WebIdentityTokenFileCredentialsProvider`). Different deployments source this token differently (a file on disk for K8s/IRSA, OAuth2 client_credentials for VMs, JWT bearer for service accounts, ...), so hardcoding the file-from-env pattern is limiting. Introduce a pluggable `WebIdentityTokenSource` SPI plus a built-in `file` source, and refactor `AwsIrsaCredentialGenerator` to retrieve the token through the SPI. Existing IRSA behavior stays unchanged; other sources can be added later. ### How should we improve? - Add a `WebIdentityTokenSource` SPI (service-loaded) with a `file` implementation that reads the token from a configured path, falling back to `AWS_WEB_IDENTITY_TOKEN_FILE`. - Refactor `AwsIrsaCredentialGenerator` to use the SPI. - New optional keys: `s3-web-identity-token-source` (default `file`), `s3-web-identity-token-file`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
