apache / apache/iceberg-python

Allow disabling remote signing in REST Catalog

未关闭
#3,888 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
1.1k
派生
581
平均合并
1 天 17 小时
30 天内合并 PR
78

描述

### Feature Request / Improvement

When using a REST Catalog (e.g. Lakekeeper), pyiceberg gets remote signing details from the catalog.

However, sometimes it would be useful to _not_ use remote signing, in the case where the process performing the operations has access to the S3 endpoint through secret access keys. This is because remote signing requires a network round trip (plus any authorisation on server side).

It would be great if we could disable remote signing by respecting the `s3.signer` catalog property if it is empty.

The FileIO object gets created in `pyiceberg/catalog/rest/__init__.py`:

```python
return Table(
identifier=identifier_tuple,
metadata_location=table_response.metadata_location, # type: ignore
metadata=table_response.metadata,
io=self._load_file_io(
{**table_response.metadata.properties, **table_response.config}, table_response.metadata_location
),
catalog=self,
config=table_response.config,
)
```

This doesn't use the catalog properties that have been passed to the REST catalog init as far as I can tell.

I might be wrong, but I don't think [Support storage-credentials in REST catalog LoadTableResult- #3042
](https://github.com/apache/iceberg-python/pull/3042) fixes this, because it still uses the response from the catalog.

Thanks!

贡献指南

这个仓库没有索引到贡献指南

调研方向

从 pyiceberg/catalog/rest/__init__.py 中 Table 的构造处开始,检查 REST catalog 属性如何传递到 FileIO 配置。跟踪 s3.signer 的处理,然后验证空的 catalog 属性会禁用远程签名,同时不会破坏现有的 response 配置行为。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
api, backend
Issue 类型
功能
难度
3/5
预计耗时
1-2 天
活跃度
活跃
描述清晰度
基本清楚
新手友好度
68/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。