You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "ZephyrYWZhou (via GitHub)" <gi...@apache.org> on 2026/09/18 22:46:24 UTC

[I] Reconsider the ALLOW_SETTING_SUB_CATALOG_RBAC_FOR_FEDERATED_CATALOGS realm-wide gate [polaris]

ZephyrYWZhou opened a new issue, #5549:
URL: https://github.com/apache/polaris/issues/5549

   ### Context
   While documenting the federated-catalog RBAC flags (#5548), @flyrain raised a point worth discussing more broadly.
   
   `ENABLE_SUB_CATALOG_RBAC_FOR_FEDERATED_CATALOGS` can be overridden per-catalog via the `polaris.config.enable-sub-catalog-rbac-for-federated-catalogs` catalog property. A separate realm-wide flag, `ALLOW_SETTING_SUB_CATALOG_RBAC_FOR_FEDERATED_CATALOGS` (default `true`), gates whether that per-catalog property may be set at all — when `false`, `PolarisServiceImpl.validateCatalogProperties()` rejects attempts to set it.
   
   ### The question
   Is a server-wide gate over a per-catalog setting the right control? One view (from #5548): a catalog administrator should arguably be able to flip a catalog-level feature themselves, which makes the extra realm-wide guard of limited value.
   
   This is an open question for discussion, **not** a proposal — flagging it for input before any code changes.
   
   ### Relevant facts
   - The guard only blocks **future** writes (`validateCatalogProperties`); it does **not** affect catalogs that already have the property set — a stored catalog property takes precedence over the realm default (`PolarisConfiguration.resolveValue()`).
   - So it doesn't lock existing catalogs to the realm default; existing overrides would have to be removed separately.
   
   Related: #5548.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Reconsider the ALLOW_SETTING_SUB_CATALOG_RBAC_FOR_FEDERATED_CATALOGS realm-wide gate [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on issue #5549:
URL: https://github.com/apache/polaris/issues/5549#issuecomment-5737098965

   The rationale for this setting is explained in #2696. I believe it still holds.
   
   CC: @HonahX @dennishuo 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Reconsider the ALLOW_SETTING_SUB_CATALOG_RBAC_FOR_FEDERATED_CATALOGS realm-wide gate [polaris]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #5549:
URL: https://github.com/apache/polaris/issues/5549#issuecomment-6281359028

   This issue is stale because it has been open 30 days with no activity. Remove stale label or comment if you think it's still relevant.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org