roryqi opened a new pull request, #13928:
URL: https://github.com/apache/gravitino/pull/13928
### What changes were proposed in this pull request?
- Allow the AWS IRSA credential generator to initialize without `s3-role-arn`
and fall back to `AWS_ROLE_ARN`.
- Generate an ADLS directory-scoped SAS for the common directory of multiple
paths in the same storage account and container.
- Reject incompatible ADLS paths with an error that identifies the paths.
- Add unit tests for the AWS fallback and ADLS multi-path behavior.
### Why are the changes needed?
AWS IRSA currently validates `s3-role-arn` before its environment-variable
fallback can run. ADLS credential vending rejects Iceberg tables that define
`write.data.path` or `write.metadata.path` because it requires exactly one
unique path.
Fix: #13927
### Does this PR introduce _any_ user-facing change?
Yes.
- `aws-irsa` can use the pod's `AWS_ROLE_ARN` when `s3-role-arn` is unset.
- `adls-token` supports multiple table paths when they can be covered by one
directory-scoped SAS.
- ADLS paths from different accounts or containers produce a clearer error.
No property keys or public APIs are added or removed.
### How was this patch tested?
```shell
./gradlew :bundles:aws:test :bundles:azure:test
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
