fzhsbc opened a new pull request, #11182:
URL: https://github.com/apache/gravitino/pull/11182

   ## What is changed
   
   This PR adds a `bearer-token-file` authentication mode to the Spark 
connector.
   
   New configuration:
   
   ```properties
   spark.sql.gravitino.authType=bearer-token-file
   spark.sql.gravitino.bearer.tokenFile=/path/to/token
   ```
   
   The connector reads an existing Bearer token from the configured local file 
and sends it to Gravitino using the existing custom token provider path:
   
   ```text
   Authorization: Bearer <token>
   ```
   
   The token file may contain either the raw token or a `Bearer ` prefixed 
value.
   
   ## Why
   
   Some runtime environments refresh short-lived user or workload tokens 
outside the Spark connector, for example with a trusted sidecar or workload 
identity component. The existing OAuth2 mode requires the connector to request 
a token from an OAuth2 endpoint with configured credentials, which is not 
appropriate for those deployments.
   
   This change keeps token acquisition outside the Spark connector and only 
adds a generic way for the connector to reuse an existing local Bearer token.
   
   ## Notes
   
   - The Gravitino server does not read the token file.
   - The token file is local to the Spark driver runtime.
   - The feature is not tied to JupyterHub, Kubernetes, or any specific 
identity provider.
   - The implementation uses the existing `CustomTokenProvider` extension point.
   
   ## Tests
   
   Added unit tests for:
   
   - Reading a raw token from a file.
   - Reading a `Bearer ` prefixed token from a file.
   - Rejecting an empty token file.
   - Verifying the Spark config key.
   
   
   Closes #11181.
   
   Related to #10978, but this PR does not attempt to close it because that 
issue appears to involve Iceberg REST / authorization cache behavior beyond 
Spark connector token-file authentication.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to