vinhhap commented on PR #7741: URL: https://github.com/apache/kyuubi/pull/7741#issuecomment-6162689632
Evaluation data point for this change (Spark **4.2.0** / Scala 2.13, Iceberg **1.13.0** through an Iceberg REST catalog; merged in a scratch tree with #7594's head — the two PRs rewrite `TableTableExtractor.apply`, we resolved the union as your `getIcebergDataTableName` first, then `metadataTableBaseName`, then legacy `name()`): - `t.history`, `t.files`, `t.partitions` and `t.changes` **deny** for an unprivileged principal, and the deny names the **base table's** columns — i.e. your stated safe outcome holds on 4.2 in our runs. - A **column-restricted** grant on the base table denies its metadata tables, as you noted it should. This closes the pre-#5248 behavior for these relations in our environment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
