iremcaginyurtturk opened a new pull request, #1502: URL: https://github.com/apache/iceberg-go/pull/1502
## Problem `createGCSBucket` (`io/gocloud/gcs.go`) always builds the authenticated HTTP client from **Application Default Credentials** — or an **anonymous** client when ADC is absent — and ignores the credentials parsed from the `gcs.jsonkey` (`GCSJSONKey`) and `gcs.keypath` (`GCSKeyPath`) properties: ```go gcscfg := ParseGCSConfig(props) // parses gcs.jsonkey / gcs.keypath into ClientOptions creds, _ := gcp.DefaultCredentials(ctx) // ← auth client comes from ADC only ... bucket, err := gcsblob.OpenBucket(ctx, client, parsed.Host, gcscfg) ``` `ParseGCSConfig` does turn those properties into `WithAuthCredentialsJSON`/`WithAuthCredentialsFile` client options, but they are passed to `gcsblob.OpenBucket` alongside a pre-built `client` whose transport takes precedence — so the explicit credentials never authenticate the requests. **Effect:** with a catalog configured with explicit GCS service-account credentials but **no** `GOOGLE_APPLICATION_CREDENTIALS` in the environment, GCS reads/writes go out **anonymously** and fail with `HTTP 403 AccessDenied: Anonymous caller does not have storage.objects.* access`. The credentials only take effect if the same account is *also* exported via the ADC env var. ## Fix Resolve credentials from `gcs.jsonkey` / `gcs.keypath` first and build the client's token source from them; fall back to ADC (which may be nil → anonymous client) only when neither property is set. A new `gcsCredentials` helper does this resolution. ## Testing Added `io/gocloud/gcs_test.go` unit tests (`authorized_user` credentials keep them hermetic — no RSA key or network needed): - `TestGCSCredentialsFromInlineJSONKey` — `gcs.jsonkey` yields explicit credentials (not ADC). - `TestGCSCredentialsFromKeyPath` — `gcs.keypath` yields explicit credentials. - `TestGCSCredentialsMissingKeyPath` — a missing key file is a hard error, not a silent ADC fallback. `go test ./io/gocloud/` passes (including the pre-existing `TestParseGCSConfigUseJSONAPI`). Discovered while wiring GCS-backed Iceberg tables through a downstream tool: `gs://` warehouses route to the native GCS FileIO correctly, but the FileIO ignored the connection's service-account credentials, forcing use of `GOOGLE_APPLICATION_CREDENTIALS`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
