You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "singhpk234 (via GitHub)" <gi...@apache.org> on 2025/12/06 16:07:28 UTC
[PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
singhpk234 opened a new pull request, #14781:
URL: https://github.com/apache/iceberg/pull/14781
### About the change
Post this spec change https://github.com/apache/iceberg/pull/14563 server can now send back vended creds to the client but like other routes `LoadTable` and `CreateTable` there is no way for a client to specify that it needs vended creds ?
since creds are optional return server has option to not return creds if it thinks is not feasible
But IMHO its would be nice to still expect this header from client for the following reasons :
1. what if client wants to use its own storage creds (for lets say audit for server side logs), server sends back vended creds, client can choose not to use it.
2. Consistency with other endpoints which supports cred vending.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
Posted by "singhpk234 (via GitHub)" <gi...@apache.org>.
singhpk234 merged PR #14781:
URL: https://github.com/apache/iceberg/pull/14781
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
Posted by "singhpk234 (via GitHub)" <gi...@apache.org>.
singhpk234 commented on code in PR #14781:
URL: https://github.com/apache/iceberg/pull/14781#discussion_r2603956974
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -615,6 +615,7 @@ paths:
- $ref: '#/components/parameters/prefix'
- $ref: '#/components/parameters/namespace'
- $ref: '#/components/parameters/table'
+ - $ref: '#/components/parameters/data-access'
Review Comment:
IIUC the question, `PlanTableScanResult` ref `CompletedPlanningWithIDResult` which will use `CompletedPlanning` which refs to `/components/schemas/StorageCredential` so we already return this creds as part of Plan response.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
Posted by "singhpk234 (via GitHub)" <gi...@apache.org>.
singhpk234 commented on PR #14781:
URL: https://github.com/apache/iceberg/pull/14781#issuecomment-3873093046
Thank you so much for the review everyone !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #14781:
URL: https://github.com/apache/iceberg/pull/14781#issuecomment-3850403848
This pull request has been marked as stale due to 30 days of inactivity. It will be closed in 1 week if no further activity occurs. If you think that’s incorrect or this pull request requires a review, please simply write any comment. If closed, you can revive the PR at any time and @mention a reviewer or discuss it on the dev@iceberg.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #14781:
URL: https://github.com/apache/iceberg/pull/14781#discussion_r2604083939
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -615,6 +615,7 @@ paths:
- $ref: '#/components/parameters/prefix'
- $ref: '#/components/parameters/namespace'
- $ref: '#/components/parameters/table'
+ - $ref: '#/components/parameters/data-access'
Review Comment:
Found it, I was on an old branch. Thanks for sharing. LGTM.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] SPEC: Add AccessDelegation header to planAPI calls which vend creds [iceberg]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #14781:
URL: https://github.com/apache/iceberg/pull/14781#discussion_r2603807548
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -615,6 +615,7 @@ paths:
- $ref: '#/components/parameters/prefix'
- $ref: '#/components/parameters/namespace'
- $ref: '#/components/parameters/table'
+ - $ref: '#/components/parameters/data-access'
Review Comment:
Makes sense to add it assuming the plan endpoint can send vended storage credentials. Should we also add ` '#/components/schemas/StorageCredential'` to Plan response like `CompletedPlanningResult`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org