vigneshio commented on issue #4711: URL: https://github.com/apache/polaris/issues/4711#issuecomment-4751425681
Thanks @XJDKC and @dimas-b Got it on not sharing the same creds between catalog access and storage. Makes sense because of different roles and the subscoping we do for storage. I looked at the code againn. For SigV4 catalog federation (like Glue), every time we ask for creds we create a fresh `DefaultCredentialsProvider`. The service identity provider is request scoped, so it doesn't reuse the base `IRSA` creds. That's why we keep seeing new `AssumeRoleWithWebIdentity `calls. On the storage side we have caching, so the base creds _don't get hit on every request._ You mentioned you have a local branch for making the catalog federation and storage paths behave more the same. Would it be better to look at that or should we first just make the base provider long-lived so the SDK can cache the WebIdentity part.. WDYT ?? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
