roryqi commented on code in PR #12962:
URL: https://github.com/apache/gravitino/pull/12962#discussion_r3949346423
##########
iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java:
##########
@@ -269,6 +283,66 @@ private static Catalog loadCustomCatalog(IcebergConfig
icebergConfig) {
@VisibleForTesting
public static void applyDefaultResolvingFileIO(Map<String, String>
properties) {
properties.putIfAbsent(IcebergConstants.IO_IMPL,
ResolvingFileIO.class.getName());
+ applyGcsServiceAccountCredentials(properties);
+ }
+
+ /**
+ * When {@code gcs-service-account-file} is set, mint an OAuth2 access token
and inject Iceberg
+ * {@code gcs.oauth2.token} / {@code gcs.oauth2.token-expires-at} so the
built-in {@code
+ * GCSFileIO} can authenticate. Iceberg's FileIO does not understand
Gravitino's
+ * service-account-file property; S3/OSS/ADLS instead map static keys
directly via {@link
+ * org.apache.gravitino.catalog.lakehouse.iceberg.IcebergPropertiesUtils}.
+ *
+ * <p>Skips injection when {@code gcs.oauth2.token} is already present.
Disables Iceberg's
+ * credentials-endpoint refresh because that path is for vended table
credentials, not catalog
+ * bootstrap from a service account file.
+ *
+ * @param properties Iceberg catalog properties, mutated in place
+ */
+ @VisibleForTesting
+ static void applyGcsServiceAccountCredentials(Map<String, String>
properties) {
+ String serviceAccountFile =
properties.get(GCSProperties.GRAVITINO_GCS_SERVICE_ACCOUNT_FILE);
Review Comment:
How to refresh the GCP access token? I will recommend that we add a expire
hook for the catalog cache.
You can recreate the catalog before the access token expiration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
