Following the discussion on GitHub, starting a dev thread on credential vending behavior in Apache Polaris catalog federation.
https://github.com/apache/polaris/discussions/4929 I am evaluating catalog federation behavior in a data lakehouse setup using Apache Iceberg with Apache Polaris. Architecture: - One central enterprise catalog - Multiple BU (Business Unit) level child catalogs federated into the central catalog Expected flow (based on my understanding): - Client queries an Iceberg table through the central catalog - Central catalog forwards the request to the appropriate BU catalog after RBAC validation - BU catalog returns table metadata and vended credentials - Central catalog returns the BU catalog’s metadata and the same vended credentials back to the client Actual behavior observed: - BU catalog does return metadata + vended credentials - Central catalog drops/ignores the BU-provided vended credentials - Central catalog generates new vended credentials and sends that to the client instead Question: What is the intended credential vending model for catalog federation? - Should the central catalog propagate the vended credentials returned by the child catalog to the client (credential pass-through)? Or - Should the central catalog always generate and return its own vended credentials, regardless of whether the child catalog has already vended credentials? I'm interested in understanding the intended design philosophy for federation and whether supporting vended credential pass-through is something the community believes should be part of Polaris. -- Thanks & Regards, Rajesh Bulleddula
