bharos opened a new pull request, #12410: URL: https://github.com/apache/gravitino/pull/12410
### What changes were proposed in this pull request? Adds a MinIO container and an Iceberg REST integration test that uses it, so credential vending is covered by a test that runs in CI. - `MinIOContainer` in `integration-test-common`, using the public `minio/minio` image, following the same hardcoded-image pattern as `MySQLContainer` and `ClickHouseContainer`. - `ContainerSuite.startMinIOContainer()` / `getMinIOContainer()`, mirroring the existing LocalStack methods. - `IcebergRESTMinIOTokenAuthorizationIT`, which implements the four cloud hooks of `IcebergRESTCloudTokenAuthorizationBaseIT` against MinIO. MinIO enforces the session policy attached to an `AssumeRole` request, so the privilege-to-credential mapping is observable without a cloud account. `S3TokenGenerator.getArnPrefix()` returns `arn:aws:s3:::` for a MinIO role ARN, so the session policy that gets generated is the same one sent to AWS. The three test methods on `IcebergRESTCloudTokenAuthorizationBaseIT` now run through this subclass. The existing cloud-specific subclasses stay gated behind `GRAVITINO_TEST_CLOUD_IT` and are unchanged. ### Why are the changes needed? Every credential vending IT is gated by `@EnabledIfEnvironmentVariable(named = "GRAVITINO_TEST_CLOUD_IT", matches = "true")`. That variable is not set in any workflow and no workflow supplies cloud credentials, so these tests only run manually against a personal cloud account. The result is that whether a caller receives a writable or a read-only storage credential has no automated protection against regressions. Fix: #12367 ### Does this PR introduce _any_ user-facing change? No. Test only. ### How was this patch tested? `./gradlew :iceberg:iceberg-rest-server:test --tests "*IcebergRESTMinIOTokenAuthorizationIT*" -PskipTests -PtestMode=embedded -PskipDockerTests=false` All three tests pass locally: a caller with `MODIFY_TABLE` can write with the vended credential, and a caller with only `SELECT_TABLE` is rejected at the storage layer when it attempts to write. Opening as a draft because this has only been run in **embedded** mode. Deploy mode exercises `downloadCloudBundleJar()` / `copyCloudBundleJar()`, which follow the S3 subclass but have not been run locally — I would like to see CI cover that before marking it ready. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
