This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch gh-pages
in repository https://gitbox.apache.org/repos/asf/iceberg-go.git
The following commit(s) were added to refs/heads/gh-pages by this push:
new ea855107e deploy: f5e2d7496f27c70c25481080724d3b586b0a94ab
ea855107e is described below
commit ea855107e52a55757547f4edcefe1f6682891462
Author: laskoviymishka <[email protected]>
AuthorDate: Sun Oct 11 13:53:48 2026 +0000
deploy: f5e2d7496f27c70c25481080724d3b586b0a94ab
---
configuration.html | 11 ++++++++---
print.html | 11 ++++++++---
searchindex.js | 2 +-
searchindex.json | 2 +-
4 files changed, 18 insertions(+), 8 deletions(-)
diff --git a/configuration.html b/configuration.html
index 14ece33f0..a4ebd4429 100644
--- a/configuration.html
+++ b/configuration.html
@@ -409,16 +409,20 @@ import _
"github.com/apache/iceberg-go/io/gocloud/azure" // abfs, abfs
</tbody></table>
</div>
<h3 id="azure-data-lake-storage--blob"><a class="header"
href="#azure-data-lake-storage--blob">Azure Data Lake Storage / Blob</a></h3>
-<p>Authentication is selected in the following order
(<code>io/gocloud/azure/azure.go</code>); the first applicable option wins, and
if none of 1-4 apply the default credential chain (5) is used:</p>
+<p>Authentication is selected in the following order
(<code>io/gocloud/azure/azure.go</code>); the first applicable option wins, and
if none of 1-5 apply the default credential chain (6) is used:</p>
<ol>
<li>Shared key: a nonempty <code>adls.auth.shared-key.account.name</code>
selects this path and requires a nonempty
<code>adls.auth.shared-key.account.key</code>.</li>
<li>Per-host SAS token: <code>adls.sas-token.<hostname></code>, where
<code><hostname></code> exactly matches the storage account hostname (for
example, <code>myaccount.dfs.core.windows.net</code>).</li>
<li>Per-account connection string:
<code>adls.connection-string.<account-name></code> (for example,
<code>adls.connection-string.myaccount</code>).</li>
+<li>Static access token: a nonempty <code>adls.token</code>, supplied without
the <code>Bearer </code> prefix.</li>
<li>Managed identity: <code>adls.auth.managed-identity.enabled</code> set to
exactly <code>"true"</code> selects this path and uses
<code>ManagedIdentityCredential</code> directly. Set
<code>adls.client-id</code> to select a user-assigned managed identity;
otherwise, the system-assigned managed identity is used.</li>
<li>Default credential chain: <code>DefaultAzureCredential</code>, which
includes managed identity among its credential sources.</li>
</ol>
+<p><code>adls.token</code> accepts an OAuth2 access token for Azure Storage,
including a token supplied by a catalog. An empty value is ignored. A rejected
or expired token does not fall back to managed identity or the default
credential chain.</p>
+<p>The token is static and is not refreshed. As in <a
href="https://github.com/apache/iceberg/blob/main/azure/src/main/java/org/apache/iceberg/azure/AzureProperties.java";>Java</a>
and <a
href="https://github.com/apache/iceberg-python/blob/main/pyiceberg/io/fsspec.py";>PyIceberg</a>,
the credential reports a one-hour cache window to the Azure SDK each time the
SDK requests the token. This does not extend the token's actual validity: Azure
enforces its expiration. Callers must obtain a new [...]
+<p>A REST catalog can also vend <code>adls.token</code> as a storage
credential. The token carries no expiry of its own, so a vended token's expiry
comes from <code>expiration-time</code> in the same credential when the catalog
supplies one. Without it, a table FileIO that can fetch new credentials assumes
a 60-minute lifetime and renews them shortly before it ends, and one that
cannot, such as a FileIO for a scan plan's credentials, treats them as never
expiring. A token whose actual li [...]
<blockquote>
-<p><strong>Note on cross-client parity.</strong> The two properties in step 4
diverge from the
+<p><strong>Note on cross-client parity.</strong> The two properties in step 5
diverge from the
other clients. <code>adls.auth.managed-identity.enabled</code> is Go-specific:
neither
Iceberg Java nor PyIceberg defines a property that forces
<code>ManagedIdentityCredential</code>, so catalog properties that set it do
not carry
@@ -427,7 +431,7 @@ principal client ID used together with
<code>adls.client-secret</code> and
<code>adls.tenant-id</code>, neither of which iceberg-go defines (see the
<a
href="https://py.iceberg.apache.org/configuration/#azure-data-lake";>PyIceberg
ADLS configuration</a>),
while Java's <code>AzureProperties</code> defines no
<code>adls.client-id</code> at all. Here it is
-only ever read as a user-assigned managed identity ID, and only when step 4 is
+only ever read as a user-assigned managed identity ID, and only when step 5 is
selected.</p>
</blockquote>
<p>Tuning properties:</p>
@@ -436,6 +440,7 @@ selected.</p>
<tr><td><code>adls.auth.shared-key.account.key</code>
(<code>io.ADLSSharedKeyAccountKey</code>)</td><td>Account key.</td></tr>
<tr><td><code>adls.sas-token.<host></code> (prefix
<code>io.ADLSSasTokenPrefix</code>)</td><td>Per-host SAS token.</td></tr>
<tr><td><code>adls.connection-string.<account-name></code> (prefix
<code>io.ADLSConnectionStringPrefix</code>)</td><td>Per-account connection
string.</td></tr>
+<tr><td><code>adls.token</code> (<code>io.ADLSToken</code>)</td><td>Static
Azure Storage access token, without the <code>Bearer </code> prefix. Subject to
the precedence above; not refreshed.</td></tr>
<tr><td><code>adls.client-id</code>
(<code>io.ADLSClientID</code>)</td><td>Client ID of a user-assigned managed
identity. Used only when the explicit managed-identity authentication path is
selected.</td></tr>
<tr><td><code>adls.endpoint</code>
(<code>io.ADLSEndpoint</code>)</td><td>Storage domain (e.g.
<code>blob.core.windows.net</code>).</td></tr>
<tr><td><code>adls.protocol</code>
(<code>io.ADLSProtocol</code>)</td><td><code>http</code> or
<code>https</code>.</td></tr>
diff --git a/print.html b/print.html
index f1bced974..bcc88ae71 100644
--- a/print.html
+++ b/print.html
@@ -696,16 +696,20 @@ import _
"github.com/apache/iceberg-go/io/gocloud/azure" // abfs, abfs
</tbody></table>
</div>
<h3 id="azure-data-lake-storage--blob"><a class="header"
href="#azure-data-lake-storage--blob">Azure Data Lake Storage / Blob</a></h3>
-<p>Authentication is selected in the following order
(<code>io/gocloud/azure/azure.go</code>); the first applicable option wins, and
if none of 1-4 apply the default credential chain (5) is used:</p>
+<p>Authentication is selected in the following order
(<code>io/gocloud/azure/azure.go</code>); the first applicable option wins, and
if none of 1-5 apply the default credential chain (6) is used:</p>
<ol>
<li>Shared key: a nonempty <code>adls.auth.shared-key.account.name</code>
selects this path and requires a nonempty
<code>adls.auth.shared-key.account.key</code>.</li>
<li>Per-host SAS token: <code>adls.sas-token.<hostname></code>, where
<code><hostname></code> exactly matches the storage account hostname (for
example, <code>myaccount.dfs.core.windows.net</code>).</li>
<li>Per-account connection string:
<code>adls.connection-string.<account-name></code> (for example,
<code>adls.connection-string.myaccount</code>).</li>
+<li>Static access token: a nonempty <code>adls.token</code>, supplied without
the <code>Bearer </code> prefix.</li>
<li>Managed identity: <code>adls.auth.managed-identity.enabled</code> set to
exactly <code>"true"</code> selects this path and uses
<code>ManagedIdentityCredential</code> directly. Set
<code>adls.client-id</code> to select a user-assigned managed identity;
otherwise, the system-assigned managed identity is used.</li>
<li>Default credential chain: <code>DefaultAzureCredential</code>, which
includes managed identity among its credential sources.</li>
</ol>
+<p><code>adls.token</code> accepts an OAuth2 access token for Azure Storage,
including a token supplied by a catalog. An empty value is ignored. A rejected
or expired token does not fall back to managed identity or the default
credential chain.</p>
+<p>The token is static and is not refreshed. As in <a
href="https://github.com/apache/iceberg/blob/main/azure/src/main/java/org/apache/iceberg/azure/AzureProperties.java";>Java</a>
and <a
href="https://github.com/apache/iceberg-python/blob/main/pyiceberg/io/fsspec.py";>PyIceberg</a>,
the credential reports a one-hour cache window to the Azure SDK each time the
SDK requests the token. This does not extend the token's actual validity: Azure
enforces its expiration. Callers must obtain a new [...]
+<p>A REST catalog can also vend <code>adls.token</code> as a storage
credential. The token carries no expiry of its own, so a vended token's expiry
comes from <code>expiration-time</code> in the same credential when the catalog
supplies one. Without it, a table FileIO that can fetch new credentials assumes
a 60-minute lifetime and renews them shortly before it ends, and one that
cannot, such as a FileIO for a scan plan's credentials, treats them as never
expiring. A token whose actual li [...]
<blockquote>
-<p><strong>Note on cross-client parity.</strong> The two properties in step 4
diverge from the
+<p><strong>Note on cross-client parity.</strong> The two properties in step 5
diverge from the
other clients. <code>adls.auth.managed-identity.enabled</code> is Go-specific:
neither
Iceberg Java nor PyIceberg defines a property that forces
<code>ManagedIdentityCredential</code>, so catalog properties that set it do
not carry
@@ -714,7 +718,7 @@ principal client ID used together with
<code>adls.client-secret</code> and
<code>adls.tenant-id</code>, neither of which iceberg-go defines (see the
<a
href="https://py.iceberg.apache.org/configuration/#azure-data-lake";>PyIceberg
ADLS configuration</a>),
while Java's <code>AzureProperties</code> defines no
<code>adls.client-id</code> at all. Here it is
-only ever read as a user-assigned managed identity ID, and only when step 4 is
+only ever read as a user-assigned managed identity ID, and only when step 5 is
selected.</p>
</blockquote>
<p>Tuning properties:</p>
@@ -723,6 +727,7 @@ selected.</p>
<tr><td><code>adls.auth.shared-key.account.key</code>
(<code>io.ADLSSharedKeyAccountKey</code>)</td><td>Account key.</td></tr>
<tr><td><code>adls.sas-token.<host></code> (prefix
<code>io.ADLSSasTokenPrefix</code>)</td><td>Per-host SAS token.</td></tr>
<tr><td><code>adls.connection-string.<account-name></code> (prefix
<code>io.ADLSConnectionStringPrefix</code>)</td><td>Per-account connection
string.</td></tr>
+<tr><td><code>adls.token</code> (<code>io.ADLSToken</code>)</td><td>Static
Azure Storage access token, without the <code>Bearer </code> prefix. Subject to
the precedence above; not refreshed.</td></tr>
<tr><td><code>adls.client-id</code>
(<code>io.ADLSClientID</code>)</td><td>Client ID of a user-assigned managed
identity. Used only when the explicit managed-identity authentication path is
selected.</td></tr>
<tr><td><code>adls.endpoint</code>
(<code>io.ADLSEndpoint</code>)</td><td>Storage domain (e.g.
<code>blob.core.windows.net</code>).</td></tr>
<tr><td><code>adls.protocol</code>
(<code>io.ADLSProtocol</code>)</td><td><code>http</code> or
<code>https</code>.</td></tr>
diff --git a/searchindex.js b/searchindex.js
index f4d081aaf..ecf3525cd 100644
--- a/searchindex.js
+++ b/searchindex.js
@@ -1 +1 @@
-Object.assign(window.search,
{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#
[...]
\ No newline at end of file
+Object.assign(window.search,
{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#
[...]
\ No newline at end of file
diff --git a/searchindex.json b/searchindex.json
index 385c7ce34..8688bfbe3 100644
--- a/searchindex.json
+++ b/searchindex.json
@@ -1 +1 @@
-{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#4-write-some-arrow-data","get
[...]
\ No newline at end of file
+{"doc_urls":["introduction.html#iceberg-go","introduction.html#where-to-start","introduction.html#what-works-today","introduction.html#beyond-go","introduction.html#help-and-contribution","install.html#install","install.html#requirements","install.html#installation","getting-started.html#getting-started","getting-started.html#1-install","getting-started.html#2-open-a-local-catalog","getting-started.html#3-create-a-namespace-and-a-table","getting-started.html#4-write-some-arrow-data","get
[...]
\ No newline at end of file
