diqiu50 opened a new issue, #14031: URL: https://github.com/apache/gravitino/issues/14031
### Version main branch ### Describe what's wrong For an Iceberg catalog with a Hive or JDBC backend, the Flink connector fetches catalog-level credentials once in `GravitinoIcebergCatalog.open()` and never refreshes them. - `s3-token`, `gcs-token`, `adls-token`, `oss-token` and `cos-token` vend nothing at catalog level, so Flink silently receives no storage credential. - `aws-irsa` vends a credential at catalog level, but it is never refreshed and expires after `s3-token-expire-in-secs` (default 3600). The docs say the Flink connector consumes vended credentials automatically (`docs/security/credential-vending.md`), which is not true for these providers. ### Error message and/or stacktrace With `aws-irsa`, the job fails with `ExpiredToken` about an hour after it starts. With the other token providers, Flink fails with an S3 access error unless the Flink nodes have their own credentials. ### How to reproduce 1. Create an Iceberg catalog with `catalog-backend=hive`, an S3 warehouse and `credential-providers=aws-irsa`. 2. Run a Flink streaming job that reads or writes a table in this catalog. 3. The job fails with `ExpiredToken` after about an hour. ### Additional context A REST backend with `data-access=vended-credentials` is not affected, because the inner Iceberg REST catalog gets per-table, refreshable credentials. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
