lasdf1234 opened a new pull request, #12962:
URL: https://github.com/apache/gravitino/pull/12962
### What changes were proposed in this pull request?
Iceberg's `GCSFileIO` does not understand Gravitino's
`gcs-service-account-file`.
When that property is set, load the service account at catalog
initialization and
inject Iceberg `gcs.oauth2.token` / `gcs.oauth2.token-expires-at` so
server-side
FileIO can authenticate (same property-injection style as S3/OSS/ADLS key
mapping).
Also update GCS docs that previously required
`GOOGLE_APPLICATION_CREDENTIALS`
even when the catalog property was set.
### Why are the changes needed?
`gcs-service-account-file` reached the credential provider (vending worked)
but not
FileIO. Table create wrote metadata with Application Default Credentials and
failed
with 401 unless `GOOGLE_APPLICATION_CREDENTIALS` was set on the process.
Fix: #9418
### Does this PR introduce _any_ user-facing change?
- Configuring `gcs-service-account-file` is sufficient for Iceberg GCS
FileIO;
`GOOGLE_APPLICATION_CREDENTIALS` is only a fallback when the property is
unset.
- No new public API or property keys.
### How was this patch tested?
```
./gradlew :iceberg:iceberg-common:test --tests
org.apache.gravitino.iceberg.common.utils.TestIcebergCatalogUtil -PskipITs
```
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
