suhyeon729 opened a new pull request, #10858:
URL: https://github.com/apache/seatunnel/pull/10858
<!--
Thank you for contributing to SeaTunnel! Please make sure that your code
changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
## Contribution Checklist
- Make sure that the pull request corresponds to a [GITHUB
issue](https://github.com/apache/seatunnel/issues).
- Name the pull request in the form "[Feature] [component] Title of the
pull request", where *Feature* can be replaced by `Hotfix`, `Bug`, etc.
- Minor fixes should be named following this pattern: `[hotfix] [docs] Fix
typo in README.md doc`.
-->
Fixes: #10302
### Purpose of this pull request
<!-- Describe the purpose of this pull request. For example: This pull
request adds checkstyle plugin.-->
This PR adds support for **Kubernetes IRSA (IAM Roles for Service
Accounts)** in S3-based authentication for the Zeta engine's S3 checkpoint
storage. This is a follow-up to address the technical requirements from #10324.
As discussed with @DanielLeens, this PR follows a **staged approach** to
ensure project stability:
1. **AWS SDK Alignment :** Aligned the `aws-java-sdk-bundle` version to
`1.12.770` in `seatunnel-dist`. This ensures
`WebIdentityTokenCredentialsProvider` and `DefaultAWSCredentialsProviderChain`
are available at runtime, preventing `ClassNotFoundException`.
2. **Minimal Hadoop Changes :** Maintained the Hadoop core version at
`3.1.4` to avoid the risks of a broad runtime upgrade. Full runtime
compatibility (requiring Hadoop 3.3.x) will be handled in a subsequent
dedicated PR.
3. **Focus on Checkpoint Storage :** As suggested by the reviewer, changes
to the S3File connector enum and its documentation have been excluded from this
PR to keep the scope focused on checkpoint storage recovery paths.
### Does this PR introduce _any_ user-facing change?
<!--
Note that it means *any* user-facing change including all aspects such as
the documentation fix.
If yes, please clarify the previous behavior and the change this PR proposes
- provide the console output, description and/or an example to show the
behavior difference if possible.
If possible, please also clarify if this is a user-facing change compared to
the released SeaTunnel versions or within the unreleased branches such as dev.
If no, write 'No'.
If you are adding/modifying connector documents, please follow our new
specifications: https://github.com/apache/seatunnel/issues/4544.
-->
Yes (Structural changes for future IRSA support).
- **Previous behavior:** S3 checkpoint storage failed in EKS environments
using IRSA because the older AWS SDK (1.11.271) lacked the necessary credential
providers.
- **New behavior:** Users can now configure IRSA-based authentication for S3
checkpoint storage. By upgrading the SDK bundle to 1.12.770,
`DefaultAWSCredentialsProviderChain` can now detect EKS workload identity
environment variables.
- **Documentation:** Added a MinIO configuration example to the checkpoint
storage documentation (ZH).
<!--
If tests were added, say they were added here. Please make sure to add some
test cases that check the changes thoroughly including negative and positive
cases if possible.
If it was tested in a way different from regular unit tests, please clarify
how you tested step by step, ideally copy and paste-able, so that other
reviewers can test and check, and descendants can verify in the future.
If tests were not added, please describe why they were not added and/or why
it was difficult to add.
If you are adding E2E test cases, maybe refer to
https://github.com/apache/seatunnel/blob/dev/seatunnel-e2e/seatunnel-connector-v2-e2e/connector-cdc-mysql-e2e/src/test/resources/mysqlcdc_to_mysql.conf,
here is a good example.
-->
- **Provider Propagation Test:** Added a lightweight unit test
(`S3ConfigurationProviderTest`) to verify that the `S3Configuration` correctly
propagates the IRSA provider class into the Hadoop configuration.
- **Classpath Verification:** Added `S3FileCheckpointWithIRSATest`
(annotated with `@Disabled`) to verify class availability. This test can be
enabled locally in a live EKS environment to validate end-to-end checkpoint IO.
- **Build Validation:** Confirmed that the project compiles successfully and
all existing tests pass under the aligned AWS SDK version.
-
### Check list
* [ ] If any new Jar binary package adding in your PR, please add License
Notice according
[New License
Guide](https://github.com/apache/seatunnel/blob/dev/docs/en/developer/new-license.md)
* [X] If necessary, please update the documentation to describe the new
feature. https://github.com/apache/seatunnel/tree/dev/docs
* [ ] If necessary, please update `incompatible-changes.md` to describe the
incompatibility caused by this PR.
* [X] If you are contributing the connector code, please check that the
following files are updated:
1. Update
[plugin-mapping.properties](https://github.com/apache/seatunnel/blob/dev/plugin-mapping.properties)
and add new connector information in it
2. Update the pom file of
[seatunnel-dist](https://github.com/apache/seatunnel/blob/dev/seatunnel-dist/pom.xml)
5. Add ci label in
[label-scope-conf](https://github.com/apache/seatunnel/blob/dev/.github/workflows/labeler/label-scope-conf.yml)
6. Add e2e testcase in
[seatunnel-e2e](https://github.com/apache/seatunnel/tree/dev/seatunnel-e2e/seatunnel-connector-v2-e2e/)
7. Update connector
[plugin_config](https://github.com/apache/seatunnel/blob/dev/config/plugin_config)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
