singhpk234 commented on code in PR #17155:
URL: https://github.com/apache/iceberg/pull/17155#discussion_r4213114249
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2157,9 +2157,19 @@ components:
to supply access via any or none of the requested mechanisms.
- Specific properties and handling for `vended-credentials` and
`remote-signing`
+ Specific properties and handling for `vended-credentials`,
`remote-signing`, and `kms-vended-credentials`
are documented in the `LoadTableResult` schema section of this spec
document.
+ `kms-vended-credentials` does not subsume `vended-credentials`.
Clients that support both storage
+ and KMS credential vending should request both mechanisms for
encrypted table operations.
+
+ For encrypted table operations, delegated credential sourcing should
be consistent across storage
+ and KMS access. If a catalog honors REST access delegation for such an
operation, it should return
+ all delegated credentials required by the operation, including storage
credentials and KMS
+ credentials. If the catalog cannot return the complete delegated
credential set, it should not
+ return partial delegated credentials for that operation; the client
remains responsible for
+ providing all credentials locally.
Review Comment:
can you please elaborate more ? are we saying here that server when request
for both storage and kms creds then server just can't send storage creds ?
wouldn't the client just fail ? or can the server just not already fail such
request which it can't fulfill ?
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2157,9 +2157,19 @@ components:
to supply access via any or none of the requested mechanisms.
- Specific properties and handling for `vended-credentials` and
`remote-signing`
+ Specific properties and handling for `vended-credentials`,
`remote-signing`, and `kms-vended-credentials`
Review Comment:
why do we need a new delegation mode ? can't this be subsumed within
vended-creds?
- the client would then just check the kms creds in the response ? is this
for backward compatibility pov, older clients doesn't work atm either ways
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
