singhpk234 commented on code in PR #17332:
URL: https://github.com/apache/iceberg/pull/17332#discussion_r3991949287
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -1429,6 +1429,67 @@ paths:
5XX:
$ref: '#/components/responses/ServerErrorResponse'
+ /v1/{prefix}/namespaces/{namespace}/tables/{table}/presign:
Review Comment:
> just add the same header to the sign request (the Catalog can still
choose, but it helps to signify what the client can support)
I am assuming in the current execution we need to start sending pre-sign is
the client is expecting pre-signed urls only though i wonder if we introduce
this header, what happens to existing clients using this endpoint which will
not send this header, should we add no header means remote-sign ? because the
fact this endpoint is called it means someone wants to access only ... unlike
loadTable where it would be just metadata (if this
X-Iceberg-Access-Delegation)...
https://github.com/apache/iceberg/blob/99c291d5ce837b21aa0b68e07fcad04a405e1c30/open-api/rest-catalog-open-api.yaml#L2157
will clean up the spec pr soon
regarding having mixed mode ... presently the sdks either just do credential
vending or just to remote signing ... to read the metadata / data files ...
there might be preference for folks who want to read the data / metadata via
vended creds but read the file.uri via pre-signing (in case these files are not
part of same file or belong to entirely different prefix) ? how will a client
be configured in that mode ? (may be question for future discussion)
cc @RussellSpitzer
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
