roryqi opened a new issue, #13927: URL: https://github.com/apache/gravitino/issues/13927
### Version main branch ### Describe what's wrong Cloud credential vending has two initialization and path-handling issues: 1. AWS IRSA `AwsIrsaCredentialGenerator` supports falling back to the pod's `AWS_ROLE_ARN` when `s3-role-arn` is not configured. However, `initialize()` reads `S3CredentialConfig.s3RoleArn()` before the fallback is evaluated. The configuration validator rejects the missing value, so `aws-irsa` cannot initialize unless `s3-role-arn` is explicitly configured. 2. ADLS `CatalogWrapperForREST` includes the table location, `write.data.path`, and `write.metadata.path` in the credential context. `ADLSTokenGenerator` currently requires exactly one unique path. An ADLS Iceberg table therefore cannot receive vended credentials when either custom write path is configured, even when all paths belong to the same table directory. ### Error message and/or stacktrace AWS IRSA: ``` IllegalArgumentException: null in s3-role-arn is invalid ``` ADLS: ``` IllegalArgumentException: ADLS should contain exactly one unique path ``` ### How to reproduce AWS IRSA: 1. Run Gravitino in an EKS pod with `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE` set. 2. Configure `credential-providers=aws-irsa`. 3. Do not configure `s3-role-arn`. 4. Initialize the catalog or request vended credentials. Expected: `aws-irsa` uses `AWS_ROLE_ARN`. Actual: initialization fails before the environment fallback is evaluated. ADLS: 1. Configure an Iceberg REST catalog with `credential-providers=adls-token`. 2. Create a table with a location such as `abfss://[email protected]/warehouse/table`. 3. Configure `write.data.path` or `write.metadata.path` below that location. 4. Request vended credentials. Expected: generate a directory-scoped SAS covering all paths in the common directory. Incompatible paths should produce an error identifying them. Actual: the request fails whenever more than one unique path is present. ### Additional context The AWS fix should keep `s3-role-arn` required for credential providers that do not support an environment fallback. The ADLS fix should reject paths that cannot be represented by one directory-scoped SAS, such as paths in different storage accounts or containers. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
