szlta commented on code in PR #17155:
URL: https://github.com/apache/iceberg/pull/17155#discussion_r4262940224
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2157,9 +2157,19 @@ components:
to supply access via any or none of the requested mechanisms.
- Specific properties and handling for `vended-credentials` and
`remote-signing`
+ Specific properties and handling for `vended-credentials`,
`remote-signing`, and `kms-vended-credentials`
Review Comment:
There are a couple of scenarios where this matters:
- client has capability for vended storage credentials consumption, but no
capability for KMS vended credentials, then the catalog side would have to:
- keep vending storage creds only for unencrypted tables
- decline vending storage creds for encrypted tables, as hybrid mode is
not supported
- client supports remote signing for storage and credential vending for KMS.
It can advertise **remote-signing,kms-vended-credentials** without requesting
storage credential vending.
The separate mode lets the catalog distinguish these capabilities and
determine whether it can fully delegate access for an encrypted operation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
