[Cherry-pick to branch-1.3] Resolve #13051 #13052 #13054 #13034 - #13060
Merged
jerryshao merged 4 commits intoSep 10, 2026
Merged
Conversation
Code Coverage Report
Files |
lasdf1234
force-pushed
the
cherry-pick-13034-13051-13052-13054-branch-1.3
branch
3 times, most recently
from
September 10, 2026 09:15
b49128a to
0a057df
Compare
…account-file (apache#12962) Iceberg's `GCSFileIO` does not understand Gravitino's `gcs-service-account-file`. When that property is set, load the service account at catalog initialization and inject Iceberg `gcs.oauth2.token` / `gcs.oauth2.token-expires-at` so server-side FileIO can authenticate (same property-injection style as S3/OSS/ADLS key mapping). Also update GCS docs that previously required `GOOGLE_APPLICATION_CREDENTIALS` even when the catalog property was set. `gcs-service-account-file` reached the credential provider (vending worked) but not FileIO. Table create wrote metadata with Application Default Credentials and failed with 401 unless `GOOGLE_APPLICATION_CREDENTIALS` was set on the process. Fix: apache#9418 - Configuring `gcs-service-account-file` is sufficient for Iceberg GCS FileIO; `GOOGLE_APPLICATION_CREDENTIALS` is only a fallback when the property is unset. - No new public API or property keys. ``` ./gradlew :iceberg:iceberg-common:test --tests org.apache.gravitino.iceberg.common.utils.TestIcebergCatalogUtil -PskipITs ``` Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com>
…rapping exceptions (apache#12999) - Add `ExceptionMessages` helper to append the underlying cause message when wrapping exceptions. - Update catalog catch-all wraps (Kafka, Glue, Hive/HMS, Fileset, Model, Lance, Doris, Paimon, Hadoop FS) to use it. - Kafka: map invalid configuration on create/alter to `IllegalArgumentException` (4xx). - Glue: keep upstream text in default errors; map `AccessDeniedException` to `ForbiddenException`. - Add unit tests for `ExceptionMessages` and `GlueExceptionConverter`. Connectors were replacing actionable upstream errors with generic messages. Operators only saw the stack trace. Client-caused failures were also returned as 500. Fix: apache#12998 Yes. Failed catalog operations may return richer `message` text (upstream reason included). Some Kafka invalid-config and Glue access-denied failures map to 400/403 instead of 500. - Unit tests: `TestExceptionMessages`, `TestGlueExceptionConverter` - Suggested local run: `./gradlew spotlessApply :common:test --tests org.apache.gravitino.utils.TestExceptionMessages :catalogs:catalog-glue:test --tests org.apache.gravitino.catalog.glue.TestGlueExceptionConverter -PskipITs` Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com>
… federated loadTable (apache#12950) Forward `X-Iceberg-Access-Delegation: vended-credentials` when a federated Iceberg REST catalog (`catalog-backend: rest`) loads a table, and rewrite remote credential refresh endpoints to this IRC catalog. `FederatedCatalogWrapper.loadTable` previously ignored `requestCredential` and used Iceberg's `RESTCatalog.loadTable`, which does not send the access-delegation header. Scan-plan federation already forwarded the header; load table now uses the same authenticated REST GET path. Fix: apache#12949 A REST-backend Iceberg catalog dropped the client's credential-vending request. The near-end IRC logged `credential vending: true`, but the forwarded load arrived at the remote catalog with `access delegation: null`. Direct loads against the remote returned `storage-credentials`; federated loads returned only metadata, so engines failed on the first data read. Yes. Clients that send `X-Iceberg-Access-Delegation: vended-credentials` through a federated Iceberg REST catalog now receive remote `storage-credentials` on `loadTable`, matching a direct load against the remote catalog. No new APIs or property keys. - `./gradlew :iceberg:iceberg-rest-server:test --tests org.apache.gravitino.iceberg.service.TestCatalogWrapperForREST --tests org.apache.gravitino.iceberg.service.TestIcebergRESTUtils -PskipITs` - New unit tests cover header forwarding on vended federated load, omitting the header when vending is not requested, and rewriting upstream refresh endpoints. Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com>
…nectionFailedException (apache#13034) Classify Iceberg JDBC catalog authorization failures via SQLState class `28` (plus MySQL/PostgreSQL message fallbacks), so PostgreSQL bad-credential errors become `ConnectionFailedException` like MySQL `Access denied`. Previously only the literal `Access denied` was matched. PostgreSQL reports `password authentication failed` / `role ... does not exist` (`28P01` / `28000`), so failures escaped as raw `UncheckedSQLException`. Fix: apache#13033 - PostgreSQL Iceberg JDBC catalogs with bad credentials now surface `ConnectionFailedException` instead of a generic internal error. - No new APIs or property keys. ``` ./gradlew :iceberg:iceberg-common:test --tests org.apache.gravitino.iceberg.common.utils.TestIcebergCatalogUtil -PskipITs ``` --------- Co-authored-by: Cursor <cursoragent@cursor.com>
lasdf1234
force-pushed
the
cherry-pick-13034-13051-13052-13054-branch-1.3
branch
from
September 10, 2026 11:08
0a057df to
6658748
Compare
lasdf1234
deleted the
cherry-pick-13034-13051-13052-13054-branch-1.3
branch
September 11, 2026 00:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Manual conflict resolution of four cherry-picks onto
branch-1.3(supersedes conflicted bot PRs where applicable):gcs-service-account-fileExceptionMessagesX-Iceberg-Access-Delegationon federatedloadTable/ create / register (adapted for 1.3 without main-only scan-plan federation APIs)28000/28P01toConnectionFailedExceptionPlus a minor test import fix for
TableMetadataParser.Why are the changes needed?
Auto cherry-pick PRs
#13051,#13052,#13054were blocked bycherry-pick-conflict.#13034carries thebranch-1.3label and needs the same backport.Does this PR introduce any user-facing change?
Same as the original PRs on
main(credential vending / richer catalog errors / federated loadTable credentials / PG JDBC auth classification). No new APIs or property keys beyond those originals.How was this patch tested?
(Compile of
TestCatalogWrapperForRESTfixed by adding the missingTableMetadataParserimport; please re-run the suite in CI.)