lasdf1234 commented on code in PR #11901:
URL: https://github.com/apache/gravitino/pull/11901#discussion_r3535542999
##########
docs/iceberg-rest-service.md:
##########
@@ -428,18 +432,62 @@ Refer to [HTTPS
Configuration](./security/how-to-use-https.md#apache-iceberg-res
#### Backend Authentication
-For JDBC backend, you can use the `gravitino.iceberg-rest.jdbc-user` and
`gravitino.iceberg-rest.jdbc-password` to authenticate the JDBC connection. For
Hive backend, you can use the `gravitino.iceberg-rest.authentication.type` to
specify the authentication type, and use the
`gravitino.iceberg-rest.authentication.kerberos.principal` and
`gravitino.iceberg-rest.authentication.kerberos.keytab-uri` to authenticate the
Kerberos connection.
+For the JDBC catalog backend, use `gravitino.iceberg-rest.jdbc-user` and
`gravitino.iceberg-rest.jdbc-password` to authenticate the JDBC metadata store
connection. Use `gravitino.iceberg-rest.authentication.type` to specify how the
catalog backend accesses the warehouse storage. When the warehouse is on HDFS,
set it to `kerberos` or `simple`, and configure
`gravitino.iceberg-rest.authentication.kerberos.principal` and
`gravitino.iceberg-rest.authentication.kerberos.keytab-uri` for Kerberos
authentication.
+
+For the Hive catalog backend, `gravitino.iceberg-rest.authentication.type`
controls both Hive Metastore and HDFS access. When using Kerberos, also
configure `gravitino.iceberg-rest.hive.metastore.sasl.enabled` and related Hive
Metastore Kerberos properties.
+
The detailed configuration items are as follows:
-| Configuration item |
Description
| Default value | Required
| Since Version |
-|---------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
-| `gravitino.iceberg-rest.authentication.type` |
The type of authentication for Iceberg rest catalog backend. This configuration
only applicable for Hive backend, and only supports `Kerberos`, `simple`
currently. As for JDBC backend, only username/password authentication was
supported now. | `simple` | No
| 0.7.0-incubating |
-| `gravitino.iceberg-rest.authentication.impersonation-enable` |
Whether to enable impersonation for the Iceberg catalog
| `false` | No
| 0.7.0-incubating |
-| `gravitino.iceberg-rest.hive.metastore.sasl.enabled` |
Whether to enable SASL authentication protocol when connect to Kerberos Hive
metastore.
| `false` | No, This value should be true in most case(Some will
use SSL protocol, but it rather rare) if the value of
`gravitino.iceberg-rest.authentication.type` is Kerberos. | 0.7.0-incubating |
-| `gravitino.iceberg-rest.authentication.kerberos.principal` |
The principal of the Kerberos authentication
| (none) | required if the value of
`gravitino.iceberg-rest.authentication.type` is Kerberos.
| 0.7.0-incubating |
-| `gravitino.iceberg-rest.authentication.kerberos.keytab-uri` |
The URI of The keytab for the Kerberos authentication.
| (none) | required if the value of
`gravitino.iceberg-rest.authentication.type` is Kerberos.
| 0.7.0-incubating |
-| `gravitino.iceberg-rest.authentication.kerberos.check-interval-sec` |
The check interval of Kerberos credential for Iceberg catalog.
| 60 | No
| 0.7.0-incubating |
-| `gravitino.iceberg-rest.authentication.kerberos.keytab-fetch-timeout-sec` |
The fetch timeout of retrieving Kerberos keytab from
`authentication.kerberos.keytab-uri`.
| 60 | No
| 0.7.0-incubating |
+| Configuration item
| Description
| Default value | Required
| Since Version |
+|
----------------------------------------------------------------------------- |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ----------------- |
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| -------------------- |
+| `gravitino.iceberg-rest.authentication.type`
| The authentication type for HDFS warehouse access. Supports `kerberos` and
`simple` for Hive and JDBC catalog backends.
| `simple` | No
| 0.7.0-incubating |
+| `gravitino.iceberg-rest.authentication.impersonation-enable`
| Whether to enable impersonation for the Iceberg catalog
| `false` | No
| 0.7.0-incubating |
+| `gravitino.iceberg-rest.hive.metastore.sasl.enabled`
| Whether to enable SASL authentication protocol when connect to Kerberos Hive
metastore.
| `false` | No, This value should be true in most
case(Some will use SSL protocol, but it rather rare) if the value of
`gravitino.iceberg-rest.authentication.type` is kerberos. |
0.7.0-incubating |
Review Comment:
Got resolved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
