evindj commented on code in PR #3494:
URL: https://github.com/apache/polaris/pull/3494#discussion_r2719548396
##########
runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalog.java:
##########
@@ -1409,6 +1409,22 @@ public void doRefresh() {
Set.of(PolarisStorageActions.READ,
PolarisStorageActions.LIST));
return TableMetadataParser.read(fileIO, metadataLocation);
});
+
+ // After a refresh, re-load the FileIO with the new table metadata
properties to
+ // ensure the right permissions are present for subsequent file system
interactions.
+ if (currentMetadata != null) {
+ tableFileIO =
+ loadFileIOForTableLike(
+ tableIdentifier,
+ StorageUtil.getLocationsUsedByTable(currentMetadata),
+ resolvedEntities,
+ new HashMap<>(currentMetadata.properties()),
+ Set.of(
+ PolarisStorageActions.READ,
+ PolarisStorageActions.WRITE,
+ PolarisStorageActions.LIST));
Review Comment:
STS expiring is interesting as there are many ways to think about it:
- the catalog could take the stance that the client is in charge of making
sure that the STS is refreshed possibly after either some error code or some
client side tracking as to when the STS will expire. This seems reasonable to
me because from the catalog is just a broker for STS.
- When it comes with the interaction with the Catalog, we could raise a
clear error code making it possible for the client to know that their STS has
expire and thus they can trigger an STS refresh flow.
- We could also try to fix the way we are trying to do here, but I do think
it should be part of some internal STS lifecycle tracking either based on
feedback from the storage system. This would not address all the case of STS
expiring as the client writing directly to the storage system will still have
to addressed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
