I-am-aman commented on code in PR #17468:
URL: https://github.com/apache/iceberg/pull/17468#discussion_r3706636045
##########
gcp/src/main/java/org/apache/iceberg/gcp/gcs/PrefixedStorage.java:
##########
@@ -158,6 +158,10 @@ private Credentials credentials(GCPProperties properties) {
return NoCredentials.getInstance();
} else if (properties.impersonateServiceAccount().isPresent()) {
return buildImpersonatedCredentials(properties);
+ } else if (properties.tokenCredentialProvider().isPresent()) {
+ // A custom provider yields a self-refreshing GoogleCredentials (e.g.
built from a
+ // caller-supplied source credential), addressing static-token expiry
for non-vended setups.
+ return
GcsTokenCredentialProviders.from(properties.properties()).credential();
Review Comment:
Going ahead with the second suggestion - precedence Javadoc.
1. Users may have base configs with gcs.token-credential-provider and
environment-specific overrides adding gcs.impersonate.service-account. When
merged, both properties coexist. Preconditions.checkState fails at Properties
construction time, breaking this legitimate config layering pattern. The
override should just "win" at credential selection time, not fail the entire
config load.
2. Selection vs Validation: This is about which credential to use (selection
logic in credentials() method at runtime), not whether the config is valid
(validation logic in Properties constructor at startup). Multiple auth
properties being present isn't a configuration error - it's a selection
decision. Preconditions.checkState in the constructor treats it as validation
failure when it should just be a runtime precedence rule. Vended path with both
oauth2 and credentials provider already sets this precedent.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
