dramaticlly commented on issue #18240: URL: https://github.com/apache/iceberg/issues/18240#issuecomment-6091218098
thanks @ggershinsky, I started 1st PR #18440 to define the public interface in action, once we get consensus for community we can move towards implementations. ### Questions Assuming the master key version is already rotated in the KMS before the action runs: since rotation doesn't rewrite the existing KEK ciphertext in encryption-keys, and https://github.com/apache/iceberg/blob/79bc69a51da6d95ccd6da6d46ef156c74e30b8cf/core/src/main/java/org/apache/iceberg/encryption/StandardEncryptionManager.java#L135-L146 reuses any KEK under the 730-day lifespan, the manifest-list key would be re-encrypted under the pre-rotation KEK and the old version would stay pinned. Should the action mint a fresh KEK (and should keyEncryptionKeyID() then prefer the newest unexpired KEK rather than the first), or did you intend the KEK itself to be re-wrapped in place? ### Plan 1. API: the interface above, on its own. 2. Core + Spark 4.2: the action, including the selection change. 3. Spark 4.2: the procedure and docs. 4. Backports to older Spark versions after that, if there's appetite. I'll also follow up on statistics files and the other file types you mentioned once this lands. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
