szlta opened a new pull request, #5127: URL: https://github.com/apache/polaris/pull/5127
## Summary Adds catalog-level KMS configuration metadata for future Iceberg table encryption support. This introduces a Polaris-managed KMS configuration surface that is separate from storage configuration. Storage configuration continues to describe where table data lives and how Polaris accesses that storage. KMS configuration describes which key-management service a catalog is allowed to use for Iceberg table encryption. See proposal document at: https://docs.google.com/document/d/1Ui5bYVci7BtEkTITxjgW7Pp9SjrTyq8pW2Z7lVt4TQA ## Motivation Iceberg table encryption is a table-format concern, not a storage-layer encryption setting like S3 SSE-KMS. A Polaris catalog may need to work with encrypted Iceberg tables whose table encryption KMS does not necessarily match the storage backend. For example, an Iceberg table stored in S3 could theoretically use a different KMS provider, or a specific AWS KMS configuration independent of the catalog's S3 storage configuration. To support this cleanly, Polaris needs catalog-level KMS metadata before wiring that configuration into encrypted Iceberg table operations. ## Changes - Adds `KmsConfigInfo` and `AwsKmsConfigInfo` to the management API. - Adds optional `kmsConfigInfo` to catalog create/update/read models. - Persists catalog KMS configuration in catalog internal properties. - Adds internal `PolarisKmsConfigurationInfo` and `AwsKmsConfigurationInfo` model classes. - Adds server-local `polaris.kms.*` runtime configuration for default and named AWS KMS credentials. - Adds tests for API serialization, internal KMS config serialization, and catalog round trips. - Adds generated configuration documentation for `polaris.kms.*`. This PR does not wire KMS configuration into `LocalIcebergCatalog` or encrypted Iceberg FileIO behavior yet. That runtime usage is intended as a follow-up once the catalog configuration contract is agreed. ## Testing Added coverage for: - Catalog JSON serialization with `kmsConfigInfo` - Internal KMS configuration serialization/deserialization - AWS KMS configuration endpoint handling - AWS KMS role ARN parsing - Catalog create/update/read round trip with KMS config - Catalog entity round trip from management model to persisted internal properties and back ## Checklist - [x] ๐ก๏ธ Don't disclose security issues! (contact [email protected]) - [x] ๐ Clearly explained why the changes are needed, or linked related issues: Related to the dev list discussion on Iceberg table encryption KMS configuration - [x] ๐งช Added/updated tests with good coverage, or manually tested (and explained how) - [x] ๐ก Added comments for complex logic - [ ] ๐งพ Updated CHANGELOG.md (if needed) - [x] ๐ Updated documentation in site/content/in-dev/unreleased (if needed) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
