You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@polaris.apache.org by yu...@apache.org on 2026/04/28 16:34:13 UTC
(polaris) branch main updated: Narrow SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION scope (#4284)
This is an automated email from the ASF dual-hosted git repository.
flyrain pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/main by this push:
new 19e2bc62e2 Narrow SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION scope (#4284)
19e2bc62e2 is described below
commit 19e2bc62e291704b8e1a5abaf22b5e234e5cfc5e
Author: Yufei Gu <yu...@apache.org>
AuthorDate: Tue Apr 28 09:34:08 2026 -0700
Narrow SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION scope (#4284)
---
.../polaris/core/config/FeatureConfiguration.java | 14 +++++-----
.../service/config/ProductionReadinessChecks.java | 31 ++++++++++++++++++++++
.../config-sections/flags-polaris_features.md | 2 +-
3 files changed, 38 insertions(+), 9 deletions(-)
diff --git a/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java b/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java
index 48eed5b230..3881ffe4ac 100644
--- a/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java
+++ b/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java
@@ -68,14 +68,12 @@ public class FeatureConfiguration<T> extends PolarisConfiguration<T> {
PolarisConfiguration.<Boolean>builder()
.key("SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION")
.description(
- "If set to true, skip credential-subscoping indirection entirely whenever trying\n"
- + " to obtain storage credentials for instantiating a FileIO. If 'true', no attempt is made\n"
- + " to use StorageConfigs to generate table-specific storage credentials, but instead the default\n"
- + " fallthrough of table-level credential properties or else provider-specific APPLICATION_DEFAULT\n"
- + " credential-loading will be used for the FileIO.\n"
- + " Typically this setting is used in single-tenant server deployments that don't rely on\n"
- + " \"credential-vending\" and can use server-default environment variables or credential config\n"
- + " files for all storage access, or in test/dev scenarios.")
+ "Test/dev-only. If true, bypass credential subscoping entirely: FileIO falls back to\n"
+ + " the server's ambient credentials (pod IAM role, env vars, credential files).\n"
+ + " Intended for tests with fake storage paths (no real STS). NOT for production:\n"
+ + " those credentials are handed to every client, breaking defense-in-depth. For\n"
+ + " S3-compatible storage without STS, set stsUnavailable: true on the storage config\n"
+ + " instead.")
.defaultValue(false)
.buildFeatureConfiguration();
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/config/ProductionReadinessChecks.java b/runtime/service/src/main/java/org/apache/polaris/service/config/ProductionReadinessChecks.java
index 3898138c50..e959489683 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/config/ProductionReadinessChecks.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/config/ProductionReadinessChecks.java
@@ -292,6 +292,37 @@ public class ProductionReadinessChecks {
: ProductionReadinessCheck.of(errors.toArray(new Error[0]));
}
+ @Produces
+ public ProductionReadinessCheck checkSkipCredentialSubscopingIndirection(
+ FeaturesConfiguration featureConfiguration) {
+ var flag = FeatureConfiguration.SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION;
+ var message =
+ "SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION is enabled. This flag is test/dev-only and returns "
+ + "the Polaris server's ambient credentials to every client, breaking defense-in-depth. "
+ + "For S3-compatible storage without STS, set stsUnavailable: true on the storage "
+ + "config instead.";
+ var errors = new ArrayList<Error>();
+ if (Boolean.parseBoolean(featureConfiguration.defaults().get(flag.key()))) {
+ errors.add(Error.of(message, format("polaris.features.\"%s\"", flag.key())));
+ }
+ featureConfiguration
+ .realmOverrides()
+ .forEach(
+ (realmId, overrides) -> {
+ if (Boolean.parseBoolean(overrides.overrides().get(flag.key()))) {
+ errors.add(
+ Error.of(
+ message,
+ format(
+ "polaris.features.realm-overrides.\"%s\".overrides.\"%s\"",
+ realmId, flag.key())));
+ }
+ });
+ return errors.isEmpty()
+ ? ProductionReadinessCheck.OK
+ : ProductionReadinessCheck.of(errors.toArray(new Error[0]));
+ }
+
@Produces
public ProductionReadinessCheck checkOverlappingSiblingCheckSettings(
FeaturesConfiguration featureConfiguration) {
diff --git a/site/content/in-dev/unreleased/configuration/config-sections/flags-polaris_features.md b/site/content/in-dev/unreleased/configuration/config-sections/flags-polaris_features.md
index 3a24803023..83ef3d6d16 100644
--- a/site/content/in-dev/unreleased/configuration/config-sections/flags-polaris_features.md
+++ b/site/content/in-dev/unreleased/configuration/config-sections/flags-polaris_features.md
@@ -431,7 +431,7 @@ A comma-separated list of fields to include as session tags in AWS STS AssumeRol
##### `polaris.features."SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION"`
-If set to true, skip credential-subscoping indirection entirely whenever trying to obtain storage credentials for instantiating a FileIO. If 'true', no attempt is made to use StorageConfigs to generate table-specific storage credentials, but instead the default fallthrough of table-level credential properties or else provider-specific APPLICATION_DEFAULT credential-loading will be used for the FileIO. Typically this setting is used in single-tenant server deployments that don't rely on " [...]
+Test/dev-only. If true, bypass credential subscoping entirely: FileIO falls back to the server's ambient credentials (pod IAM role, env vars, credential files). Intended for tests with fake storage paths (no real STS). NOT for production: those credentials are handed to every client, breaking defense-in-depth. For S3-compatible storage without STS, set stsUnavailable: true on the storage config instead.
- **Type:** `Boolean`
- **Default:** `false`