fzhsbc opened a new pull request, #11182: URL: https://github.com/apache/gravitino/pull/11182
## What is changed This PR adds a `bearer-token-file` authentication mode to the Spark connector. New configuration: ```properties spark.sql.gravitino.authType=bearer-token-file spark.sql.gravitino.bearer.tokenFile=/path/to/token ``` The connector reads an existing Bearer token from the configured local file and sends it to Gravitino using the existing custom token provider path: ```text Authorization: Bearer <token> ``` The token file may contain either the raw token or a `Bearer ` prefixed value. ## Why Some runtime environments refresh short-lived user or workload tokens outside the Spark connector, for example with a trusted sidecar or workload identity component. The existing OAuth2 mode requires the connector to request a token from an OAuth2 endpoint with configured credentials, which is not appropriate for those deployments. This change keeps token acquisition outside the Spark connector and only adds a generic way for the connector to reuse an existing local Bearer token. ## Notes - The Gravitino server does not read the token file. - The token file is local to the Spark driver runtime. - The feature is not tied to JupyterHub, Kubernetes, or any specific identity provider. - The implementation uses the existing `CustomTokenProvider` extension point. ## Tests Added unit tests for: - Reading a raw token from a file. - Reading a `Bearer ` prefixed token from a file. - Rejecting an empty token file. - Verifying the Spark config key. Closes #11181. Related to #10978, but this PR does not attempt to close it because that issue appears to involve Iceberg REST / authorization cache behavior beyond Spark connector token-file authentication. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
