markhoerth opened a new pull request, #14452: URL: https://github.com/apache/gravitino/pull/14452
Backport to branch-1.3 of the fix for #14450 (same change as the PR to main; branch-1.3 does not vend credentials in scan planning, so that part does not apply). ### What changes were proposed in this pull request? - `IcebergTableOperations.isCredentialVending`: split the header on commas; vended credentials are used when `vended-credentials` is listed. Other mechanisms, such as `remote-signing` or an unknown value, are ignored instead of refused. - New `CatalogCredentialManager.supportsPath`. `CatalogWrapperForREST` vends credentials (load, create, register, scan planning) only when a configured provider supports the location's scheme, and otherwise serves the request without credentials. The check uses each provider's own `supportsScheme`, so it holds for every storage provider (S3, GCS, ADLS, OSS) and for providers added outside this repository. The explicit `/credentials` endpoint is unchanged. - `S3TokenGenerator`: with neither static key set, call STS with the AWS default credential chain (instance profile, EKS service account, environment). With both keys set, behavior is unchanged. Setting only one key is refused with a message naming the missing one. ### Why are the changes needed? Clients that announce more than one mechanism, or only remote-signing, could not load or create tables. Catalogs without a credential provider were unusable from pyiceberg, and creates were reported as failed after committing. Servers running with instance roles could not use s3-token vending. Fixes #14450 ### Does this PR introduce _any_ user-facing change? Yes. Requests with other or multiple delegation mechanisms are served. Requests for vended credentials on a location no provider covers are served without credentials instead of failing. `s3-token` works without static keys when the server has AWS credentials from its environment. ### How was this patch tested? - `TestIcebergTableOperations`: create and load with `remote-signing`, both list orders and an unknown mechanism (200); `isCredentialVending` parsing; scan planning with other mechanisms (200). The old tests asserting 406/400 for these headers are replaced. - `TestIcebergNamespaceOperations`: register with other mechanisms is handled as without the header. - `TestCatalogWrapperForREST#testVendsOnlyWhereACredentialProviderCoversTheLocation`. - `TestCatalogCredentialManager#testSupportsPathOnlyWhenAProviderCoversTheScheme`. - `TestS3TokenGeneratorCredentials`: static keys, default chain without keys, one key refused. `./gradlew :core:test :bundles:aws:test :iceberg:iceberg-rest-server:test -PskipITs` 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Eu6fb9pLfmrSJzGQDVLi1g -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
