Nandor Kollar has posted comments on this change. ( http://gerrit.cloudera.org:8080/24840 )
Change subject: IMPALA-15147: Handle token expiration and credential lifetime extension for vended credentials ...................................................................... Patch Set 5: (1 comment) http://gerrit.cloudera.org:8080/#/c/24840/5/be/src/runtime/query-credentials.cc File be/src/runtime/query-credentials.cc: http://gerrit.cloudera.org:8080/#/c/24840/5/be/src/runtime/query-credentials.cc@124 PS5, Line 124: // RefreshTable()) but never handed out: the lookup falls back to the process-global This sounds like a thinking time bomb to me. If I understood correctly, we silently fall back to a different credential in this case: instead of vended credentials we start to use the credentials of Impala process? I know that cross-cloud is not in scope yet, but what if Impala is running on-prem, or on Azure, and would like to access S3? The process credentials are not valid on S3 in that case is it? -- To view, visit http://gerrit.cloudera.org:8080/24840 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I7fafc33bd78c2cdb19724a7f89536fdd7ad3c6d6 Gerrit-Change-Number: 24840 Gerrit-PatchSet: 5 Gerrit-Owner: Peter Rozsa <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Nandor Kollar <[email protected]> Gerrit-Comment-Date: Wed, 30 Sep 2026 14:28:57 +0000 Gerrit-HasComments: Yes
