singhpk234 opened a new pull request, #18081:
URL: https://github.com/apache/iceberg/pull/18081
## Summary
Adds REST support for encrypted tables using client-side KMS credentials,
with an
opt-in hybrid mode for REST-provided storage access.
By default, encrypted REST tables reject server-provided storage access
because
the server-side KMS credential spec is not ready. A new catalog property,
`rest.encryption.use-client-kms-creds`, allows clients to explicitly opt
into
using REST-provided storage access while still using client-side KMS
credentials.
## Behavior
- Default: encrypted REST tables use client-side storage access and
client-side
KMS credentials.
- If an encrypted table receives REST-provided storage access, the client
fails
unless `rest.encryption.use-client-kms-creds=true`.
- REST-provided storage access includes:
- `storage-credentials`
- `remote-signing-config`
- In hybrid mode, REST-provided storage access is allowed, but KMS
credentials are
still loaded only from client-side catalog properties.
- Existing remote-signing endpoint wiring is unchanged.
## Tests
- Added REST catalog tests for encrypted tables with vended storage
credentials
and remote signing config.
- Added REST scan-planning tests for encrypted tables with returned storage
credentials.
- Added coverage ensuring KMS client initialization uses client-side
properties
instead of server-returned config.
Validation run:
```bash
git diff --check
./gradlew :iceberg-core:spotlessCheck
./gradlew :iceberg-core:test --tests
org.apache.iceberg.rest.TestRESTCatalog
--tests org.apache.iceberg.rest.TestRESTScanPlanning
———
AI Disclosure
- Model: GPT-5
- Platform/Tool: Codex
- Human Oversight: [unknown - human to fill in]
- Prompt Summary: Implemented review feedback for REST encrypted table
handling
with client-side KMS credentials and an opt-in hybrid path for
REST-provided
storage access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
