[#11968] test(iceberg): cover role narrowing in Iceberg credential vending - #12461
Merged
Conversation
bharos
force-pushed
the
active-roles-vending-11968
branch
from
August 13, 2026 19:15
765ced3 to
6120aae
Compare
Code Coverage Report
|
…ial vending The Iceberg REST credential vending path had no coverage for X-Gravitino-Active-Roles. Register a second Spark catalog that sends the header so the same caller can be exercised with and without narrowing, and assert the WRITE to READ downgrade: the write succeeds through the default catalog and is refused by the storage layer through the narrowed one, while the read still succeeds. The narrowed role carries USE_CATALOG and USE_SCHEMA itself, because narrowing deactivates the USE_SCHEMA role granted per test.
bharos
force-pushed
the
active-roles-vending-11968
branch
from
August 13, 2026 20:37
6120aae to
31f868e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Covers role narrowing in the Iceberg REST credential vending path, which had no integration test.
IcebergAuthorizationITcan now register a second Spark catalog that sendsX-Gravitino-Active-Roles, so the same caller can be exercised with and without narrowing. The per-catalog configuration moved into a helper; the new catalog is opt-in throughnarrowedCatalogActiveRoles(), mirroring the existingsupportsCredentialVending()hook, so the other subclasses are unaffected.The test asserts the WRITE to READ downgrade: the write succeeds through the default catalog and is refused by the storage layer through the narrowed one, while the read still succeeds. It lives on
IcebergRESTCloudTokenAuthorizationBaseIT, so every cloud subclass inherits it; MinIO runs it in CI.The narrowed role carries
USE_CATALOGandUSE_SCHEMAitself, because narrowing deactivates theUSE_SCHEMArole that@BeforeEachgrants under a random name.Why are the changes needed?
RoleAssumptionAuthorizationITcovers the header grammar andlistCatalogsfiltering, but nothing covered credential vending, so the privilege-to-credential mapping under narrowing had no protection against regressions.Fix: #11968
Does this PR introduce any user-facing change?
No. Test only.
How was this patch tested?
MinIO, in both modes:
The sibling run checks that the shared base class change did not regress the other Iceberg authorization ITs.
The test is self-controlling: the same user, table and Spark session write successfully through the default catalog and fail through the narrowed one, and the narrowed catalog still reads, so the only difference is the header.