GitHub user melin closed a discussion: not authorized for op
CREATE_TABLE_DIRECT_WITH_WRITE_DELEGATION
2026-07-31 09:02:59,027 INFO [org.apa.pol.ser.exc.IcebergExceptionMapper]
[f9fcc048-190f-4a7d-b0b1-a59440b17655_0000000000000000070,default-realm] [,,,]
(executor-thread-2) Handling runtimeException Principal 'root' with activated
PrincipalRoles '[service_admin]' and activated grants via '[service_admin,
catalog_admin]' is not authorized for op
CREATE_TABLE_DIRECT_WITH_WRITE_DELEGATION
```scala
object SparkPolarisSqlTest {
//
https://github.com/aliyun/datalake-catalog-metastore-client/blob/master/README-CN.md
def main(args: Array[String]): Unit = {
val spark = SparkSession.builder()
.master("local")
.config("spark.serializer", "org.apache.spark.serializer.KryoSerializer")
.config("spark.sql.catalog.polaris",
"org.apache.polaris.spark.SparkCatalog")
.config("spark.sql.catalog.polaris.uri",
"http://172.88.0.153:32122/api/catalog";)
.config("spark.sql.catalog.polaris.token-refresh-enabled", "true")
.config("spark.sql.catalog.polaris.credential", "polaris:polaris2026")
.config("spark.sql.catalog.polaris.warehouse", "minio_catalog")
.config("spark.sql.catalog.polaris.scope", "PRINCIPAL_ROLE:ALL")
.config("spark.sql.catalog.polaris.header.X-Iceberg-Access-Delegation",
"vended-credentials")
.config("spark.sql.catalog.polaris.rest.auth.type", "oauth2")
.config("spark.sql.catalog.polaris.oauth2-server-uri",
"http://172.88.0.153:32122/api/catalog/v1/oauth/tokens";)
.getOrCreate()
spark.sql("USE polaris")
spark.sql("CREATE NAMESPACE IF NOT EXISTS iceberg_demos")
spark.sql("USE NAMESPACE iceberg_demos")
spark.sql("""CREATE TABLE IF NOT EXISTS PEOPLE (
id int, name string)
USING iceberg;
""")
}
}
```
```shell
TOKEN=$(curl -s -v -o /tmp/token.json -w "%{http_code}" \
-X POST http://172.88.0.153:32122/api/catalog/v1/oauth/tokens \
-H "Content-Type: application/x-www-form-urlencoded" \
-d
"grant_type=client_credentials&client_id=polaris&client_secret=polaris2026&scope=PRINCIPAL_ROLE:ALL")
echo "HTTP $TOKEN"
TOKEN=$(jq -r '.access_token' /tmp/token.json)
echo "Token: $TOKEN"
CREDS=$(curl -s -v -X POST
http://172.88.0.153:32122/api/management/v1/principals \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-o /tmp/principal.json -w "%{http_code}" \
-d '{
"name": "superior-principal",
"type": "SERVICE"
}')
echo "HTTP $CREDS"
SUPERIOR_CLIENT_ID=$(jq -r '.credentials.clientId' /tmp/principal.json)
SUPERIOR_CLIENT_SECRET=$(jq -r '.credentials.clientSecret' /tmp/principal.json)
echo "Superior Client ID: $SUPERIOR_CLIENT_ID"
echo "Superior Client Secret: $SUPERIOR_CLIENT_SECRET"
```
### create catalog
```shell
curl -X POST http://172.88.0.153:32122/api/management/v1/catalogs \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{
"name": "minio_catalog",
"type": "INTERNAL",
"properties": {
"default-base-location": "s3://cyberengine/polaris-iceberg"
},
"storageConfigInfo": {
"storageType": "S3",
"allowedLocations": ["s3://cyberengine"],
"endpoint": "http://172.18.6.181:9330";,
"endpointInternal": "http://172.18.6.181:9330";,
"pathStyleAccess": true,
"stsUnavailable": true,
"region": "us-east-1"
}
}'
```
### Create a principal role
```shell
# 4a. Create a principal role
curl -X POST "http://172.88.0.153:32122/api/management/v1/principal-roles"; \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"principalRole": {"name": "superior-role"}}'
# 4b. Create a catalog role inside minio_catalog
curl -X POST
"http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"catalogRole": {"name": "superior-catalog-role"}}'
# 4c. Grant CATALOG_MANAGE_CONTENT privilege to the catalog role
curl -X PUT
"http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles/superior-catalog-role/grants";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"grant": {"type": "catalog", "privilege": "CATALOG_MANAGE_CONTENT"}}'
curl -v -X PUT
"http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles/superior-catalog-role/grants";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"grant": {"type": "catalog", "privilege": "TABLE_CREATE"}}'
# 4d. Assign the catalog role to the principal role
curl -X PUT
"http://172.88.0.153:32122/api/management/v1/principal-roles/superior-role/catalog-roles/minio_catalog";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"catalogRole": {"name": "superior-catalog-role"}}'
# 4e. Assign the principal role to the superior principal
curl -X PUT
"http://172.88.0.153:32122/api/management/v1/principals/superior-principal/principal-roles";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"principalRole": {"name": "superior-role"}}'
```
### Create a namespace
```shell
curl -X POST
"http://172.88.0.153:32122/api/catalog/v1/minio_catalog/namespaces"; \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{
"namespace": ["demo"],
"properties": {
"location": "s3://cyberengine/polaris-iceberg/demo"
}
}'
```
```yaml
---
apiVersion: v1
kind: Secret
metadata:
name: polaris-postgresql-secret
namespace: polaris
labels:
app.kubernetes.io/name: polaris
type: Opaque
data:
username: cG9zdGdyZXM=
password: MTIzNDU2
jdbcUrl: amRiYzpwb3N0Z3Jlc3FsOi8vMTcyLjE4LjEuMTkyOjU1MzIvcG9zdGdyZXM=
---
kind: Secret
apiVersion: v1
metadata:
name: polaris-minio-secret
namespace: polaris
labels:
app.kubernetes.io/name: polaris
type: Opaque
data:
awsAccessKeyId: TWN2Vm5wT3ppVnNXdjdRbHl1dDc=
awsSecretAccessKey: UGJJQ2JRDkg3aXlxMFB1ZWZIYTM4M1lvcUpuM0pDamVkUUhTWW1icA==
---
kind: ConfigMap
apiVersion: v1
metadata:
name: polaris
namespace: polaris
labels:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
app.kubernetes.io/version: 1.6.0
data:
application.properties: >-
polaris.authentication.authenticator.type=default
polaris.authentication.token-broker.max-token-generation=PT1H
polaris.authentication.token-broker.type=rsa-key-pair
polaris.authentication.token-service.type=default
polaris.authentication.type=internal
polaris.features."SUPPORTED_CATALOG_STORAGE_TYPES"=["S3","GCS","AZURE"]
polaris.file-io.type=default
polaris.log.request-id-header-name=X-Request-ID
polaris.persistence.auto-bootstrap-types=relational-jdbc
polaris.persistence.type=relational-jdbc
polaris.rate-limiter.filter.type=no-op
polaris.realm-context.realms=default-realm
polaris.realm-context.type=default
quarkus.http.access-log.enabled=true
quarkus.http.port=8181
quarkus.log.category."org.apache.iceberg.rest".level=INFO
quarkus.log.category."org.apache.polaris".level=INFO
quarkus.log.console.enabled=true
quarkus.log.console.format=%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}]
[%X{requestId},%X{realmId}] [%X{traceId},%X{parentId},%X{spanId},%X{sampled}]
(%t) %s%e%n
quarkus.log.console.level=ALL
quarkus.log.file.enabled=false
quarkus.log.level=INFO
quarkus.management.port=8182
quarkus.otel.sdk.disabled=true
quarkus.http.cors.enabled=true
quarkus.http.cors.origins=http://172.18.5.44:31358
quarkus.http.cors.methods=GET,POST,PUT,DELETE,PATCH,OPTIONS
quarkus.http.cors.headers=*
quarkus.http.cors.exposed-headers=*
quarkus.http.cors.access-control-allow-credentials=true
quarkus.http.cors.access-control-max-age=PT10M
---
kind: Deployment
apiVersion: apps/v1
metadata:
name: polaris
namespace: polaris
labels:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
app.kubernetes.io/version: 1.6.0
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
template:
metadata:
labels:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
spec:
volumes:
- name: config-volume
projected:
sources:
- configMap:
name: polaris
items:
- key: application.properties
path: application.properties
defaultMode: 420
- name: temp-dir
emptyDir: {}
containers:
- name: polaris
image: docker.1ms.run/apache/polaris:1.6.0
ports:
- name: polaris-http
containerPort: 8181
protocol: TCP
- name: polaris-mgmt
containerPort: 8182
protocol: TCP
env:
#
https://polaris.apache.org/blog/2026/04/04/build-a-local-open-data-lakehouse-with-k3d-apache-ozone-apache-polaris-and-trino/
- name: POLARIS_BOOTSTRAP_CREDENTIALS
value: "default-realm,polaris,polaris2026"
- name: QUARKUS_DATASOURCE_DB_KIND
value: "postgresql"
- name: AWS_REGION
value: us-east-1
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: polaris-minio-secret
key: awsAccessKeyId
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: polaris-minio-secret
key: awsSecretAccessKey
- name: quarkus.datasource.username
valueFrom:
secretKeyRef:
name: polaris-postgresql-secret
key: username
- name: quarkus.datasource.password
valueFrom:
secretKeyRef:
name: polaris-postgresql-secret
key: password
- name: quarkus.datasource.jdbc.url
valueFrom:
secretKeyRef:
name: polaris-postgresql-secret
key: jdbcUrl
volumeMounts:
- name: config-volume
readOnly: true
mountPath: /deployments/config
- name: temp-dir
mountPath: /tmp
livenessProbe:
httpGet:
path: /q/health/live
port: polaris-mgmt
scheme: HTTP
initialDelaySeconds: 5
timeoutSeconds: 10
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
terminationGracePeriodSeconds: 30
readinessProbe:
httpGet:
path: /q/health/ready
port: polaris-mgmt
scheme: HTTP
initialDelaySeconds: 5
timeoutSeconds: 10
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
imagePullPolicy: Always
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 25%
maxSurge: 25%
---
kind: Service
apiVersion: v1
metadata:
name: polaris
namespace: polaris
labels:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
app.kubernetes.io/version: 1.6.0
spec:
ports:
- name: polaris-http
protocol: TCP
port: 8181
targetPort: 8181
nodePort: 32122
selector:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
type: NodePort
---
kind: Service
apiVersion: v1
metadata:
name: polaris-mgmt
namespace: polaris
labels:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
app.kubernetes.io/version: 1.6.0
spec:
ports:
- name: polaris-mgmt
protocol: TCP
port: 8182
targetPort: 8182
nodePort: 30895
selector:
app.kubernetes.io/instance: polaris
app.kubernetes.io/name: polaris
type: NodePort
```
GitHub link: https://github.com/apache/polaris/discussions/5207
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
