bharos opened a new issue, #12367:
URL: https://github.com/apache/gravitino/issues/12367
### What would you like to be improved?
Credential vending has no integration coverage that runs in CI. The
credential vending ITs are gated by
`@EnabledIfEnvironmentVariable("GRAVITINO_TEST_CLOUD_IT")`, which is not set in
any workflow, so they only run manually against a real cloud account.
### How should we improve?
Add a MinIO container to `ContainerSuite`, plus a subclass of
`IcebergRESTCloudTokenAuthorizationBaseIT` that uses it. MinIO is S3-compatible
and enforces `AssumeRole` session policies, so the read-only vs writable
credential behaviour is testable without a cloud account or secrets, and the
existing cloud-token tests would run in CI.
Verified locally: the vended token could write when `MODIFY_TABLE` was
active, and returned `AccessDenied` on `PutObject` when it was not.
Once this is in place, the role-narrowing case from #11968 is a small
addition on top.
Raised on the Slack dev channel; @roryqi indicated adding a MinIO container
is fine.
I can work on this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
