Add GCP external catalog authentication support to the CLI - #5178
Conversation
d2bd58f to
bc47e33
Compare
|
Hi Polaris maintainers, The PR is ready for review, but CI checks have not started yet. Could someone please approve the workflow run when available? Thanks. |
| - Added support for `register table` overwrite semantics in the Iceberg REST catalog flow (`overwrite=true`) for internal Polaris catalogs. With overwrite enabled, existing table pointers can be updated to a new metadata location while preserving default behavior for `overwrite=false`. | ||
| - Added `REGISTER_TABLE_OVERWRITE` authorization operation mapped to `TABLE_FULL_METADATA` for deterministic overwrite authorization. | ||
| - Added Polaris Spark 4.0 client. | ||
| - Added `maintenance` support in Helm chart. |
There was a problem hiding this comment.
Thank you for catching this. No, this entry is not part of this PR. I have rebased the branch onto the current main branch, and this entry now comes from main rather than from this change. The only changelog entry added by this PR is the one for GCP external-catalog authentication support in the CLI.
| f"Missing required argument for authentication type 'BEARER':" | ||
| f" {Argument.to_flag_name(Arguments.CATALOG_BEARER_TOKEN)}" | ||
| ) | ||
| elif self.catalog_authentication_type == AuthenticationType.GCP.value: |
There was a problem hiding this comment.
Minor: this elif ... GCP: pass is a no-op. validate() has no branch for IMPLICIT either and it validates fine by just falling through, so this branch can be deleted, keeping validate() to the types that actually need checks.
There was a problem hiding this comment.
Thank you for the suggestion. Addressed in the updated commit: I removed the no-op GCP validation branch. GCP now falls through, consistent with IMPLICIT, while validation remains only for authentication types that require additional arguments.
| - Python CLI: added `--catalog-url` to specify a custom base URL for the Iceberg REST Catalog (IRC) API. Allows use with deployments that map a path (e.g. `/server1`) directly to the catalog root instead of the standard `/api/catalog`. See #4927. | ||
| - Python CLI: added `gcp` as an external catalog authentication type for Iceberg REST federation, enabling CLI creation of GCP-authenticated catalogs such as BigLake without passing Google credential secrets through command-line flags. | ||
|
|
||
| - Added an OpenTelemetry event listener for emitting Polaris audit events as OpenTelemetry log records. |
There was a problem hiding this comment.
Thank you. No, this entry is not part of this PR either. After rebasing onto the current main branch, it comes from main and is no longer included in this PR's diff. The only changelog entry introduced by this PR is the GCP CLI authentication entry.
Hello @davidchaava , Please rebase as your current PR has changes that are not related to this PR. Thanks, |
cbaf761 to
a7bcca2
Compare
a7bcca2 to
0ecde3d
Compare
github-project-automation
Bot
moved this from PRs In Progress
to Ready to merge
in Basic Kanban Board
|
LGTM. Thanks @davidchaava . |
github-project-automation
Bot
moved this from Ready to merge
to Done
in Basic Kanban Board
3 participants
Summary
Adds GCP authentication support when creating external catalogs through the Polaris CLI.
Polaris supports GCP authentication parameters for external catalogs, but the CLI did not expose a way to select this authentication type. This is needed for BigLake Iceberg REST catalog federation, where Polaris uses server-side Google credentials and the created catalog should be configured with
authenticationType: GCP.Changes
gcpas a supported external catalog authentication type in the CLI.Validation
./gradlew format compileAll./gradlew checkFixes #5177