lasdf1234 opened a new pull request, #13138:
URL: https://github.com/apache/gravitino/pull/13138
### What changes were proposed in this pull request?
Allow built-in Iceberg maintenance jobs to authenticate when the Gravitino
server has authenticators enabled:
- Resolve auth from `gravitino.optimizer.auth.*` / `GRAVITINO_AUTH_*` via
`GravitinoAuthSettings` and apply it in `GravitinoClientUtils`.
- Pass auth placeholders through built-in Iceberg job template environments;
drop unresolved `{{placeholders}}` so unauthenticated deployments keep working.
- Apply the same credentials to Spark Iceberg REST catalog (`rest.auth.*`)
for rewrite/expire/update-stats jobs.
- Propagate optimizer auth into jobConf from the optimizer CLI /
`GravitinoJobSubmitter`.
- Document the new auth configuration keys.
### Why are the changes needed?
With `gravitino.authenticators` enabled, `builtin-iceberg-update-stats`
fails on unauthenticated Gravitino API callbacks, and Spark Iceberg jobs fail
against Iceberg REST catalogs that require credentials.
Fix: #13137
### Does this PR introduce _any_ user-facing change?
Yes. New optional optimizer auth settings (`gravitino.optimizer.auth.type`
and related username/password/OAuth keys) and matching jobConf / environment
variables for built-in Iceberg jobs.
### How was this patch tested?
- `TestGravitinoAuthSettings`
- `TestIcebergUpdateStatsJob` / `TestIcebergRewriteDataFilesJob` /
`TestIcebergExpireSnapshotsJob`
- `TestGravitinoJobSubmitter`
- `TestJobTemplate`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
