github-actions[bot] commented on code in PR #68540:
URL: https://github.com/apache/doris/pull/68540#discussion_r4358312794
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergCatalogFactory.java:
##########
@@ -450,6 +453,40 @@ public static Map<String, String>
buildCatalogProperties(IcebergCatalogPropertie
// s3tables: bespoke instantiation. Preserve the skeleton's
base+impl routing.
break;
}
+ chosenS3.ifPresent(storage ->
storage.toBackendProperties().ifPresent(backend -> {
+ Optional<GcsAuth> auth = GcsAuthResolver.resolve(backend.toMap());
+ if (auth.filter(GcsAuth::isAnonymous).isPresent()) {
+ // Glue and REST metadata can require AWS authentication even
when GCS objects are public.
+ opts.put(S3FileIOProperties.CLIENT_FACTORY,
AnonymousS3FileIOAwsClientFactory.class.getName());
Review Comment:
[P2] Keep HMAC GCS FileIO separate from the Glue role
For a Glue catalog with `provider=GCP`, valid
`gs.access_key`/`gs.secret_key`, `glue.role_arn` and a Glue endpoint/region,
the new `credentialProperties()` filter permits the configuration, but HMAC
enters neither factory override here. `appendGlueProperties` leaves
`client.factory=AssumeRoleAwsClientFactory`, and [Iceberg 1.12's FileIO factory
selection](https://github.com/apache/iceberg/blob/apache-iceberg-1.12.0/aws/src/main/java/org/apache/iceberg/aws/S3FileIOAwsClientFactories.java#L38-L44)
falls back to it. That factory's synchronous S3 client uses the AWS assumed
role instead of the configured GCS HMAC pair, so reading a private GCS table
with an `s3://` metadata location fails although Glue authentication succeeds.
Give HMAC GCS its own FileIO credential path and cover an object read with
role-authenticated Glue. This is distinct from the repaired native/anonymous
branches.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
