shantanu-dahiya commented on issue #11836: URL: https://github.com/apache/iceberg/issues/11836#issuecomment-2578591980
I believe the root cause of this issue is the envoy proxy on Istio sidecars not supporting the `Upgrade: TLS/1.2` header, causing client requests with this header to be [returned with a 403 error](https://github.com/istio/istio/issues/53239). Iceberg in the 1.7.0 release [upgraded httpclient5 from `5.3.1` to `5.4`](https://github.com/apache/iceberg/releases/tag/apache-iceberg-1.7.0). HttpClient5 5.4 sends this header to the Iceberg REST server, but the server's envoy proxy rejects the request with a 403. Modifying the Iceberg HTTPClient config to not include this header should fix the issue. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@iceberg.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@iceberg.apache.org For additional commands, e-mail: issues-h...@iceberg.apache.org
