You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@polaris.apache.org by yz...@apache.org on 2026/03/13 22:30:14 UTC
(polaris) branch main updated: Add API Spec for Generic Table credential vending (#3826)
This is an automated email from the ASF dual-hosted git repository.
yzou pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/main by this push:
new ed3c748b15 Add API Spec for Generic Table credential vending (#3826)
ed3c748b15 is described below
commit ed3c748b15004d98a144b272fcc9dd1d4530c7b4
Author: Yun Zou <yu...@gmail.com>
AuthorDate: Fri Mar 13 15:30:10 2026 -0700
Add API Spec for Generic Table credential vending (#3826)
* add change
* add change
* add change
* update change
* update description
* fix name
* udpate PR
* update description
* update description
* update change
* address feedback
---
api/polaris-catalog-service/build.gradle.kts | 1 +
spec/polaris-catalog-apis/generic-tables-api.yaml | 54 +++++++++++++++++++++++
2 files changed, 55 insertions(+)
diff --git a/api/polaris-catalog-service/build.gradle.kts b/api/polaris-catalog-service/build.gradle.kts
index 135f2451dc..c3cfe4b554 100644
--- a/api/polaris-catalog-service/build.gradle.kts
+++ b/api/polaris-catalog-service/build.gradle.kts
@@ -31,6 +31,7 @@ val genericTableModels =
"LoadGenericTableResponse",
"ListGenericTablesResponse",
"GenericTable",
+ "StorageAccessConfig",
)
val policyManagementModels =
diff --git a/spec/polaris-catalog-apis/generic-tables-api.yaml b/spec/polaris-catalog-apis/generic-tables-api.yaml
index 6377c8f99c..5946e7748b 100644
--- a/spec/polaris-catalog-apis/generic-tables-api.yaml
+++ b/spec/polaris-catalog-apis/generic-tables-api.yaml
@@ -244,6 +244,14 @@ components:
properties:
table:
$ref: '#/components/schemas/GenericTable'
+ storage-access-configs:
+ type: array
+ description: |
+ Storage configurations required to access the table, encompassing both credentials and other necessary
+ settings for storage access, such as the client region for S3.
+ items:
+ $ref: '#/components/schemas/StorageAccessConfig'
+
ListGenericTablesResponse:
type: object
@@ -256,6 +264,52 @@ components:
items:
$ref: '../iceberg-rest-catalog-open-api.yaml#/components/schemas/TableIdentifier'
+
+ StorageAccessConfig:
+ type: object
+ required:
+ - prefix
+ - config
+ properties:
+ prefix:
+ type: string
+ description: Indicates a storage location prefix where the configuration is relevant. Clients should choose the most
+ specific prefix (by selecting the longest common prefix) if several configurations of the same type are available.
+ If multiple configurations share the same longest matching prefix, the client may select any of them. However,
+ a server should avoid generating multiple configurations for the same prefix.
+ config:
+ type: object
+ description: |
+ Storage access configurations for S3, GCP GCS, and Azure ADLS are supported. The following outlines
+ the currently supported configuration options:
+
+ ## S3 Configurations
+
+ The following configurations should be respected when working with tables stored on S3, including AWS S3, S3-Compatible systems:
+ - `s3.access-key-id`: id for credentials that provide access to the data in S3
+ - `s3.secret-access-key`: secret for credentials that provide access to data in S3
+ - `s3.session-token`: if present, this value should be used for as the session token
+ - `s3.session-token-expires-at-ms`: the time the aws session token expires, in milliseconds
+ - `s3.client.region`: region to configure client for making requests to S3
+ - `s3.client.refresh-credentials-endpoint`: the endpoint to load vended credentials for a table from the catalog
+
+ ## GCP GCS Configurations
+
+ The following configurations should be respected when working with tables stored in GCP GCS:
+ - `gcs.oauth2.token`: the gcs scoped access token
+ - `gcs.oauth2.token-expires-at`: the time the gcs access token expires, in milliseconds
+ - `gcs.oauth2.refresh-credentials-endpoint`: the endpoint to load vended credentials for a table from the catalog
+
+ ## AZURE ADLS Configuration
+
+ The following configurations should be respected when working with tables stored in AZURE ADLS:
+ - `adls.sas-token.<hostname>`: an azure shared access signature token
+ - `adls.sas-token-expires-at-ms.<hostname>`: the expiration time for the access token, in milliseconds
+ - `adls.refresh-credentials-endpoint`: the endpoint to load vended credentials for a table from the catalog
+
+ additionalProperties:
+ type: string
+
responses:
LoadGenericTableResponse: