tuantran0910 commented on PR #62988: URL: https://github.com/apache/doris/pull/62988#issuecomment-6849346295
Thanks for the review. 8c8306ac4a addresses the HMS regression and a few follow-ups: - **HMS + GCS HMAC + `s3a://` (your P2):** the `NativeGcsResolvingFileIO` default now applies to HMAC/anonymous bindings only on REST, the one flavor whose SDK default is `ResolvingFileIO`. HMS, hadoop and jdbc keep `HadoopFileIO`, and glue keeps `S3FileIO`, as before this PR. Native ADC / `COMPUTE_ENGINE` bindings keep the pin on every flavor. New tests: `gcsNonNativeNonRestCatalogsKeepTheirSdkDefaultFileIo`, and `gcsHmacHmsCatalogReadsS3aThroughHadoopFileIo`, which runs the real FileIO dispatch for HMS + HMAC + `s3a://`. - **Removed `iceberg.gcs.oauth2.token`:** it was a static access token with no refresh (expires after about an hour), it overrode FE ADC under `GCSFileIO`, and `SHOW CREATE CATALOG` printed it unmasked. The PR description now points to ADC on BE hosts for BE-executed metadata tables. - **Smaller fixes:** `AuthProperties` constants instead of hard-coded strings; corrected which metadata tables carry a FileIO (`$files`, `$entries`, `$all_manifests` and variants; `$manifests` does not); a BE `$files` test through `NativeGcsResolvingFileIO`; a per-flavor `io-impl` table and an SSRF note in the PR description. **Future feature (out of scope for this PR):** - Add refresh support: declare iceberg.gcs.oauth2.refresh-credentials-endpoint and its enabled flag, mask the token, register the endpoint as an SSRF surface, and add tests. That grows the PR's scope. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
