yuqi1129 opened a new pull request, #11853:
URL: https://github.com/apache/gravitino/pull/11853
### What changes were proposed in this pull request?
Apply vended credentials to server-side Iceberg catalog configuration for
both Gravitino Iceberg catalog operations and Iceberg REST dynamic catalog
configuration.
This PR:
- Applies credentials generated by catalog credential providers to Iceberg
catalog properties.
- Makes Iceberg REST dynamic catalog configuration inject all supported
vended credentials, not only JDBC credentials.
- Handles null `supportsCredentials()` defensively when collecting catalog
credentials.
- Adds tests for:
- Server-side Iceberg catalog credential provider injection.
- Iceberg REST dynamic provider injection of `AwsIrsaCredential`.
- `FileWebIdentityTokenSource` with Fileset and GVFS credential paths
using a local fake STS server.
### Why are the changes needed?
Server-side Iceberg S3FileIO did not receive credentials generated from web
identity flows such as `FileWebIdentityTokenSource`. As a result, Azure/OIDC
web identity based flows could vend credentials for some paths, but Iceberg
REST server-side S3 access was not configured with the generated AWS session
credentials.
Fix: #11850
### Does this PR introduce _any_ user-facing change?
No new user-facing API or property key is introduced.
Existing credential vending configuration, including `aws-irsa` and
`s3-web-identity-token-source=file`, now also applies to server-side Iceberg
FileIO configuration.
### How was this patch tested?
- `./gradlew :common:test --tests
org.apache.gravitino.credential.TestCredentialPropertiesUtils`
- `./gradlew :bundles:aws:test --tests
org.apache.gravitino.s3.credential.TestAwsIrsaCredentialGenerator`
- `./gradlew :iceberg:iceberg-rest-server:test --tests
org.apache.gravitino.iceberg.service.provider.TestDynamicIcebergConfigProvider`
- `./gradlew :catalogs:catalog-lakehouse-iceberg:test --tests
org.apache.gravitino.catalog.lakehouse.iceberg.TestIcebergCatalogOperations`
- `./gradlew :clients:filesystem-hadoop3:test --tests
org.apache.gravitino.filesystem.hadoop.integration.test.FilesetS3WebIdentityCredentialIT`
- `git diff --check`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
