Aleksandr Efimov has posted comments on this change. ( http://gerrit.cloudera.org:8080/24755 )
Change subject: IMPALA-15144: Fetch and store credentials from REST catalog ...................................................................... Patch Set 3: (2 comments) Went through PS3: the FileIO, the translate layer, the metaprovider wiring and the new tests. Checked the Iceberg side against iceberg-core 1.10.2 rather than from memory. The first thing I'd look at is the DESCRIPTOR_ONLY condition that came out of getTIcebergTable(), since the FULL form is what COPY TESTCASE serializes into a file and the vended keys now travel with it - details in the thread on FeIcebergTable. Beyond that: the write half of the FileIO still resolves through getConf(), which meets the REST INSERT path landing in 24682; the prefix match still has no path boundary; and nothing closes the cached FileSystems now that the removal listener is gone. The rest are nits. http://gerrit.cloudera.org:8080/#/c/24755/3/fe/src/main/java/org/apache/impala/catalog/iceberg/translate/TranslationRule.java File fe/src/main/java/org/apache/impala/catalog/iceberg/translate/TranslationRule.java: http://gerrit.cloudera.org:8080/#/c/24755/3/fe/src/main/java/org/apache/impala/catalog/iceberg/translate/TranslationRule.java@196 PS3, Line 196: class PrefixRewriteRule implements TranslationRule { With the GCS and ADLS schemes gone, PrefixRewriteRule is only reached from ConfigTranslatorTest. Keep it with a line saying it's the hook for the ADLS per-account keys, or drop it until that scheme returns? http://gerrit.cloudera.org:8080/#/c/24755/3/fe/src/main/java/org/apache/impala/common/Credential.java File fe/src/main/java/org/apache/impala/common/Credential.java: http://gerrit.cloudera.org:8080/#/c/24755/3/fe/src/main/java/org/apache/impala/common/Credential.java@126 PS3, Line 126: identity_ = Integer.toHexString(toHadoopConfig().hashCode()); identity() is a 32-bit map hashCode, and it's what separates two credentials for the same bucket in FS_CACHE - a collision hands back a FileSystem authenticated as someone else, without a trace. Hashing.sha256() over the sorted key=value pairs costs the same at these sizes. -- To view, visit http://gerrit.cloudera.org:8080/24755 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I1d9c6e97e17fe8ad6304b49b07fd047cc2a3ffbe Gerrit-Change-Number: 24755 Gerrit-PatchSet: 3 Gerrit-Owner: Peter Rozsa <[email protected]> Gerrit-Reviewer: Aleksandr Efimov <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Nandor Kollar <[email protected]> Gerrit-Reviewer: Peter Rozsa <[email protected]> Gerrit-Reviewer: Zoltan Borok-Nagy <[email protected]> Gerrit-Comment-Date: Thu, 27 Aug 2026 20:37:05 +0000 Gerrit-HasComments: Yes
