Re: [PR] Spec: REST KMS credential vending for table encryption [iceberg]

["singhpk234 (via GitHub)" <gi...@apache.org>]

singhpk234 commented on code in PR #17155:
URL: https://github.com/apache/iceberg/pull/17155#discussion_r4213114249


##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2157,9 +2157,19 @@ components:
         to supply access via any or none of the requested mechanisms.
 
 
-        Specific properties and handling for `vended-credentials` and `remote-signing`
+        Specific properties and handling for `vended-credentials`, `remote-signing`, and `kms-vended-credentials`
         are documented in the `LoadTableResult` schema section of this spec document.
 
+        `kms-vended-credentials` does not subsume `vended-credentials`. Clients that support both storage
+        and KMS credential vending should request both mechanisms for encrypted table operations.
+
+        For encrypted table operations, delegated credential sourcing should be consistent across storage
+        and KMS access. If a catalog honors REST access delegation for such an operation, it should return
+        all delegated credentials required by the operation, including storage credentials and KMS
+        credentials. If the catalog cannot return the complete delegated credential set, it should not
+        return partial delegated credentials for that operation; the client remains responsible for
+        providing all credentials locally.

Review Comment:
   can you please elaborate more ? are we saying here that server when request for both storage and kms creds then server just can't send storage creds ? wouldn't the client just fail ? or can the server just not already fail such request which it can't fulfill ? 



##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2157,9 +2157,19 @@ components:
         to supply access via any or none of the requested mechanisms.
 
 
-        Specific properties and handling for `vended-credentials` and `remote-signing`
+        Specific properties and handling for `vended-credentials`, `remote-signing`, and `kms-vended-credentials`

Review Comment:
   why do we need a new delegation mode ? can't this be subsumed within vended-creds? 
   - the client would then just check the kms creds in the response ? is this for backward compatibility pov, older clients doesn't work atm either ways 



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org