lasdf1234 opened a new pull request, #12950: URL: https://github.com/apache/gravitino/pull/12950
### What changes were proposed in this pull request? Forward `X-Iceberg-Access-Delegation: vended-credentials` when a federated Iceberg REST catalog (`catalog-backend: rest`) loads a table, and rewrite remote credential refresh endpoints to this IRC catalog. `FederatedCatalogWrapper.loadTable` previously ignored `requestCredential` and used Iceberg's `RESTCatalog.loadTable`, which does not send the access-delegation header. Scan-plan federation already forwarded the header; load table now uses the same authenticated REST GET path. ### Why are the changes needed? Fix: #12949 A REST-backend Iceberg catalog dropped the client's credential-vending request. The near-end IRC logged `credential vending: true`, but the forwarded load arrived at the remote catalog with `access delegation: null`. Direct loads against the remote returned `storage-credentials`; federated loads returned only metadata, so engines failed on the first data read. ### Does this PR introduce _any_ user-facing change? Yes. Clients that send `X-Iceberg-Access-Delegation: vended-credentials` through a federated Iceberg REST catalog now receive remote `storage-credentials` on `loadTable`, matching a direct load against the remote catalog. No new APIs or property keys. ### How was this patch tested? - `./gradlew :iceberg:iceberg-rest-server:test --tests org.apache.gravitino.iceberg.service.TestCatalogWrapperForREST --tests org.apache.gravitino.iceberg.service.TestIcebergRESTUtils -PskipITs` - New unit tests cover header forwarding on vended federated load, omitting the header when vending is not requested, and rewriting upstream refresh endpoints. Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
