szlta commented on code in PR #17155:
URL: https://github.com/apache/iceberg/pull/17155#discussion_r4263239860
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2157,9 +2157,19 @@ components:
to supply access via any or none of the requested mechanisms.
- Specific properties and handling for `vended-credentials` and
`remote-signing`
+ Specific properties and handling for `vended-credentials`,
`remote-signing`, and `kms-vended-credentials`
are documented in the `LoadTableResult` schema section of this spec
document.
+ `kms-vended-credentials` does not subsume `vended-credentials`.
Clients that support both storage
+ and KMS credential vending should request both mechanisms for
encrypted table operations.
+
+ For encrypted table operations, delegated credential sourcing should
be consistent across storage
+ and KMS access. If a catalog honors REST access delegation for such an
operation, it should return
+ all delegated credentials required by the operation, including storage
credentials and KMS
+ credentials. If the catalog cannot return the complete delegated
credential set, it should not
+ return partial delegated credentials for that operation; the client
remains responsible for
+ providing all credentials locally.
Review Comment:
Yeah right, so in case the client supports storage+KMS vended credentials
consumption, but the catalog only supports storage credential vending, it makes
more sense to fail the request on the server side already (for
loadTable/credentials calls on encrypted tables).
I'll update the wording.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
