sunyuhan1998 commented on code in PR #10895:
URL: https://github.com/apache/gravitino/pull/10895#discussion_r3216048153
##########
lance/lance-common/src/main/java/org/apache/gravitino/lance/common/ops/gravitino/GravitinoLanceTableOperations.java:
##########
@@ -131,10 +148,61 @@ public DescribeTableResponse describeTable(
Optional.ofNullable(table.properties().get(LANCE_TABLE_VERSION))
.map(Long::valueOf)
.orElse(null));
-
response.setStorageOptions(LancePropertiesUtils.getLanceStorageOptions(table.properties()));
+
+ if (credentialPrivilege != null) {
+ response.setStorageOptions(
+ buildVendedStorageOptions(catalogName, catalog, table,
credentialPrivilege));
+ } else {
+
response.setStorageOptions(LancePropertiesUtils.getLanceStorageOptions(table.properties()));
+ }
+
return response;
}
+ private Map<String, String> buildVendedStorageOptions(
+ String catalogName, Catalog catalog, Table table, CredentialPrivilege
credentialPrivilege) {
+ String tableLocation = table.properties().get(LANCE_LOCATION);
+ Preconditions.checkArgument(
+ tableLocation != null && !tableLocation.isEmpty(),
+ "Table location is required for credential vending");
+
+ ImmutableSet<String> paths = ImmutableSet.of(tableLocation);
+ String userName = PrincipalUtils.getCurrentUserName();
+
+ PathBasedCredentialContext context =
+ credentialPrivilege == CredentialPrivilege.WRITE
+ ? new PathBasedCredentialContext(userName, paths,
ImmutableSet.of())
+ : new PathBasedCredentialContext(userName, ImmutableSet.of(),
paths);
+
+ CatalogCredentialManager credManager =
+ credentialManagers.computeIfAbsent(
+ catalogName, name -> new CatalogCredentialManager(name,
catalog.properties()));
+
Review Comment:
We've addressed this in the latest revision: `GravitinoLanceTableOperations`
now has a `close()` method that properly closes all cached
`CatalogCredentialManager` instances, and
`GravitinoLanceNamespaceWrapper.close()` calls it during service shutdown. This
follows the same pattern as Iceberg REST's `CatalogWrapperForREST`. For catalog
property changes, the current behavior (requires server restart) is consistent
with the Iceberg REST implementation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
