This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch gh-pages
in repository https://gitbox.apache.org/repos/asf/iceberg-go.git
The following commit(s) were added to refs/heads/gh-pages by this push:
new 2dd20a037 deploy: 5d377f16bc3a5da0abd59a80204e73698bde7af2
2dd20a037 is described below
commit 2dd20a037534c9c7296d35b79b34eb5f36aaa21a
Author: laskoviymishka <[email protected]>
AuthorDate: Wed Sep 23 21:27:46 2026 +0000
deploy: 5d377f16bc3a5da0abd59a80204e73698bde7af2
---
configuration.html | 30 ++++++++++++++++++++++--------
print.html | 30 ++++++++++++++++++++++--------
searchindex.js | 2 +-
searchindex.json | 2 +-
4 files changed, 46 insertions(+), 18 deletions(-)
diff --git a/configuration.html b/configuration.html
index e26ad1d36..f17c75f58 100644
--- a/configuration.html
+++ b/configuration.html
@@ -385,23 +385,37 @@ import _
"github.com/apache/iceberg-go/io/gocloud/azure" // abfs, abfs
</tbody></table>
</div>
<h3 id="azure-data-lake-storage--blob"><a class="header"
href="#azure-data-lake-storage--blob">Azure Data Lake Storage / Blob</a></h3>
-<p>Authentication is selected based on the property keys present
(<code>io/gocloud/azure/azure.go</code>):</p>
+<p>Authentication is selected in the following order
(<code>io/gocloud/azure/azure.go</code>); the first applicable option wins, and
if none of 1-4 apply the default credential chain (5) is used:</p>
<ol>
-<li>Shared key: both <code>adls.auth.shared-key.account.name</code> and
<code>adls.auth.shared-key.account.key</code> set.</li>
-<li>Per-host SAS token: <code>adls.sas-token.<hostname></code>
(prefix-matched against the storage account host).</li>
-<li>Per-host connection string:
<code>adls.connection-string.<hostname></code>.</li>
-<li>Managed identity: <code>adls.auth.managed-identity.enabled</code> set to a
truthy value.</li>
+<li>Shared key: a nonempty <code>adls.auth.shared-key.account.name</code>
selects this path and requires a nonempty
<code>adls.auth.shared-key.account.key</code>.</li>
+<li>Per-host SAS token: <code>adls.sas-token.<hostname></code>, where
<code><hostname></code> exactly matches the storage account hostname (for
example, <code>myaccount.dfs.core.windows.net</code>).</li>
+<li>Per-account connection string:
<code>adls.connection-string.<account-name></code> (for example,
<code>adls.connection-string.myaccount</code>).</li>
+<li>Managed identity: <code>adls.auth.managed-identity.enabled</code> set to
exactly <code>"true"</code> selects this path and uses
<code>ManagedIdentityCredential</code> directly. Set
<code>adls.client-id</code> to select a user-assigned managed identity;
otherwise, the system-assigned managed identity is used.</li>
+<li>Default credential chain: <code>DefaultAzureCredential</code>, which
includes managed identity among its credential sources.</li>
</ol>
+<blockquote>
+<p><strong>Note on cross-client parity.</strong> The two properties in step 4
diverge from the
+other clients. <code>adls.auth.managed-identity.enabled</code> is Go-specific:
neither
+Iceberg Java nor PyIceberg defines a property that forces
+<code>ManagedIdentityCredential</code>, so catalog properties that set it do
not carry
+over. <code>adls.client-id</code> collides in name only — PyIceberg reads it
as a service
+principal client ID used together with <code>adls.client-secret</code> and
+<code>adls.tenant-id</code>, neither of which iceberg-go defines (see the
+<a
href="https://py.iceberg.apache.org/configuration/#azure-data-lake";>PyIceberg
ADLS configuration</a>),
+while Java's <code>AzureProperties</code> defines no
<code>adls.client-id</code> at all. Here it is
+only ever read as a user-assigned managed identity ID, and only when step 4 is
+selected.</p>
+</blockquote>
<p>Tuning properties:</p>
<div class="table-wrapper"><table><thead><tr><th>Key
(constant)</th><th>Purpose</th></tr></thead><tbody>
<tr><td><code>adls.auth.shared-key.account.name</code>
(<code>io.ADLSSharedKeyAccountName</code>)</td><td>Account name.</td></tr>
<tr><td><code>adls.auth.shared-key.account.key</code>
(<code>io.ADLSSharedKeyAccountKey</code>)</td><td>Account key.</td></tr>
<tr><td><code>adls.sas-token.<host></code> (prefix
<code>io.ADLSSasTokenPrefix</code>)</td><td>Per-host SAS token.</td></tr>
-<tr><td><code>adls.connection-string.<host></code> (prefix
<code>io.ADLSConnectionStringPrefix</code>)</td><td>Per-host connection
string.</td></tr>
-<tr><td><code>adls.client-id</code>
(<code>io.ADLSClientID</code>)</td><td>Client/application ID for AAD
auth.</td></tr>
+<tr><td><code>adls.connection-string.<account-name></code> (prefix
<code>io.ADLSConnectionStringPrefix</code>)</td><td>Per-account connection
string.</td></tr>
+<tr><td><code>adls.client-id</code>
(<code>io.ADLSClientID</code>)</td><td>Client ID of a user-assigned managed
identity. Used only when the explicit managed-identity authentication path is
selected.</td></tr>
<tr><td><code>adls.endpoint</code>
(<code>io.ADLSEndpoint</code>)</td><td>Storage domain (e.g.
<code>blob.core.windows.net</code>).</td></tr>
<tr><td><code>adls.protocol</code>
(<code>io.ADLSProtocol</code>)</td><td><code>http</code> or
<code>https</code>.</td></tr>
-<tr><td><code>adls.auth.managed-identity.enabled</code>
(<code>io.ADLSManagedIdentityEnabled</code>)</td><td>Enable Azure Managed
Identity auth.</td></tr>
+<tr><td><code>adls.auth.managed-identity.enabled</code>
(<code>io.ADLSManagedIdentityEnabled</code>)</td><td>Set to exactly
<code>"true"</code> to use <code>ManagedIdentityCredential</code>
directly, subject to the precedence above.</td></tr>
</tbody></table>
</div>
<h2 id="environment-variables"><a class="header"
href="#environment-variables">Environment variables</a></h2>
diff --git a/print.html b/print.html
index 31511838b..716190a55 100644
--- a/print.html
+++ b/print.html
@@ -672,23 +672,37 @@ import _
"github.com/apache/iceberg-go/io/gocloud/azure" // abfs, abfs
</tbody></table>
</div>
<h3 id="azure-data-lake-storage--blob"><a class="header"
href="#azure-data-lake-storage--blob">Azure Data Lake Storage / Blob</a></h3>
-<p>Authentication is selected based on the property keys present
(<code>io/gocloud/azure/azure.go</code>):</p>
+<p>Authentication is selected in the following order
(<code>io/gocloud/azure/azure.go</code>); the first applicable option wins, and
if none of 1-4 apply the default credential chain (5) is used:</p>
<ol>
-<li>Shared key: both <code>adls.auth.shared-key.account.name</code> and
<code>adls.auth.shared-key.account.key</code> set.</li>
-<li>Per-host SAS token: <code>adls.sas-token.<hostname></code>
(prefix-matched against the storage account host).</li>
-<li>Per-host connection string:
<code>adls.connection-string.<hostname></code>.</li>
-<li>Managed identity: <code>adls.auth.managed-identity.enabled</code> set to a
truthy value.</li>
+<li>Shared key: a nonempty <code>adls.auth.shared-key.account.name</code>
selects this path and requires a nonempty
<code>adls.auth.shared-key.account.key</code>.</li>
+<li>Per-host SAS token: <code>adls.sas-token.<hostname></code>, where
<code><hostname></code> exactly matches the storage account hostname (for
example, <code>myaccount.dfs.core.windows.net</code>).</li>
+<li>Per-account connection string:
<code>adls.connection-string.<account-name></code> (for example,
<code>adls.connection-string.myaccount</code>).</li>
+<li>Managed identity: <code>adls.auth.managed-identity.enabled</code> set to
exactly <code>"true"</code> selects this path and uses
<code>ManagedIdentityCredential</code> directly. Set
<code>adls.client-id</code> to select a user-assigned managed identity;
otherwise, the system-assigned managed identity is used.</li>
+<li>Default credential chain: <code>DefaultAzureCredential</code>, which
includes managed identity among its credential sources.</li>
</ol>
+<blockquote>
+<p><strong>Note on cross-client parity.</strong> The two properties in step 4
diverge from the
+other clients. <code>adls.auth.managed-identity.enabled</code> is Go-specific:
neither
+Iceberg Java nor PyIceberg defines a property that forces
+<code>ManagedIdentityCredential</code>, so catalog properties that set it do
not carry
+over. <code>adls.client-id</code> collides in name only — PyIceberg reads it
as a service
+principal client ID used together with <code>adls.client-secret</code> and
+<code>adls.tenant-id</code>, neither of which iceberg-go defines (see the
+<a
href="https://py.iceberg.apache.org/configuration/#azure-data-lake";>PyIceberg
ADLS configuration</a>),
+while Java's <code>AzureProperties</code> defines no
<code>adls.client-id</code> at all. Here it is
+only ever read as a user-assigned managed identity ID, and only when step 4 is
+selected.</p>
+</blockquote>
<p>Tuning properties:</p>
<div class="table-wrapper"><table><thead><tr><th>Key
(constant)</th><th>Purpose</th></tr></thead><tbody>
<tr><td><code>adls.auth.shared-key.account.name</code>
(<code>io.ADLSSharedKeyAccountName</code>)</td><td>Account name.</td></tr>
<tr><td><code>adls.auth.shared-key.account.key</code>
(<code>io.ADLSSharedKeyAccountKey</code>)</td><td>Account key.</td></tr>
<tr><td><code>adls.sas-token.<host></code> (prefix
<code>io.ADLSSasTokenPrefix</code>)</td><td>Per-host SAS token.</td></tr>
-<tr><td><code>adls.connection-string.<host></code> (prefix
<code>io.ADLSConnectionStringPrefix</code>)</td><td>Per-host connection
string.</td></tr>
-<tr><td><code>adls.client-id</code>
(<code>io.ADLSClientID</code>)</td><td>Client/application ID for AAD
auth.</td></tr>
+<tr><td><code>adls.connection-string.<account-name></code> (prefix
<code>io.ADLSConnectionStringPrefix</code>)</td><td>Per-account connection
string.</td></tr>
+<tr><td><code>adls.client-id</code>
(<code>io.ADLSClientID</code>)</td><td>Client ID of a user-assigned managed
identity. Used only when the explicit managed-identity authentication path is
selected.</td></tr>
<tr><td><code>adls.endpoint</code>
(<code>io.ADLSEndpoint</code>)</td><td>Storage domain (e.g.
<code>blob.core.windows.net</code>).</td></tr>
<tr><td><code>adls.protocol</code>
(<code>io.ADLSProtocol</code>)</td><td><code>http</code> or
<code>https</code>.</td></tr>
-<tr><td><code>adls.auth.managed-identity.enabled</code>
(<code>io.ADLSManagedIdentityEnabled</code>)</td><td>Enable Azure Managed
Identity auth.</td></tr>
+<tr><td><code>adls.auth.managed-identity.enabled</code>
(<code>io.ADLSManagedIdentityEnabled</code>)</td><td>Set to exactly
<code>"true"</code> to use <code>ManagedIdentityCredential</code>
directly, subject to the precedence above.</td></tr>
</tbody></table>
</div>
<h2 id="environment-variables"><a class="header"
href="#environment-variables">Environment variables</a></h2>
diff --git a/searchindex.js b/searchindex.js
index ef1a6ef6d..c4ba92b38 100644
--- a/searchindex.js
+++ b/searchindex.js
@@ -1 +1 @@
-Object.assign(window.search,
{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#
[...]
\ No newline at end of file
+Object.assign(window.search,
{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#
[...]
\ No newline at end of file
diff --git a/searchindex.json b/searchindex.json
index ead48439a..deb9b2cd6 100644
--- a/searchindex.json
+++ b/searchindex.json
@@ -1 +1 @@
-{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#4-write-some-arrow-data","get
[...]
\ No newline at end of file
+{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#4-write-some-arrow-data","get
[...]
\ No newline at end of file
