Skip to content

add refresh credentials property to loadTableResult #2341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

jasonf20
Copy link

@jasonf20 jasonf20 commented Aug 13, 2025

Rebased version of #1164

@jasonf20 jasonf20 force-pushed the loadTableResponse-refresh-credential-properties branch from bb55a80 to eb3e360 Compare August 13, 2025 08:54
LoadTableResponse.builder().withTableMetadata(originalResponse.tableMetadata());
loadResponseBuilder.addAllConfig(originalResponse.config());
loadResponseBuilder.addAllCredentials(originalResponse.credentials());
loadResponseBuilder.addConfig(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about azure ? do we want to do it in follow-up ? also should we only inject this when creds are for aws ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, I think enabling the Azure refresh properties currently causes Azure credential vending to immediately fail due to apache/iceberg#13733, so could maybe wait for that fix to release?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also should we only inject this when creds are for aws?

Could maybe lift the AWS refresh check below to loadTable itself, to avoid e.g. reconstructing the LoadTableResponse if not needed?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's better to provide the URL even if it's not AWS that way the user can override AwsClientProperties.REFRESH_CREDENTIALS_ENABLED if he is working with a system that he knows supports it despite the server not being updated to reflect this yet. For example, an updated Azure iceberg SDK like mentioned above.

private LoadTableResponse injectRefreshVendedCredentialProperties(
LoadTableResponse originalResponse, String credentialsEndpoint) {
LoadTableResponse.Builder loadResponseBuilder =
LoadTableResponse.builder().withTableMetadata(originalResponse.tableMetadata());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we need to update metadata-location too ?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update it to what value?

Do you mean is it redundant with the copyConfigs below? Seems like the metadata location is stored in a dedicated field and is not part of the config.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants