Skip to content

[feat](iceberg) Support Google Authentication for Iceberg REST catalog#62988

Open
tuantran0910 wants to merge 1 commit intoapache:masterfrom
tuantran0910:feat/iceberg-rest-google-auth
Open

[feat](iceberg) Support Google Authentication for Iceberg REST catalog#62988
tuantran0910 wants to merge 1 commit intoapache:masterfrom
tuantran0910:feat/iceberg-rest-google-auth

Conversation

@tuantran0910
Copy link
Copy Markdown

What problem does this PR solve?

Issue Number: close #62987

Currently, Doris's Iceberg REST catalog only supports none and oauth2 security types. Users running Google Cloud Lakehouse with Iceberg REST catalogs need a way to authenticate using Google's native GoogleAuthManager via Application Default Credentials (ADC).

Solution

This PR adds a new google security type to IcebergRestProperties that configures the Iceberg REST client to use org.apache.iceberg.gcp.auth.GoogleAuthManager for authentication, following the official Google Cloud Lakehouse documentation.

Main changes:

  • Added GOOGLE to the Security enum in IcebergRestProperties
  • Added addGoogleProperties() method that sets rest.auth.type to the fully qualified GoogleAuthManager class name
  • Added new connector properties: iceberg.rest.io-impl, iceberg.rest.google.user-project, iceberg.gcs.oauth2.token
  • Added explicit iceberg-gcp and google-cloud-storage dependencies to fe-core/pom.xml
  • Added 5 new test cases covering Google auth configuration

How to use

CREATE CATALOG lakehouse PROPERTIES (
    "type" = "iceberg",
    "iceberg.catalog.type" = "rest",
    "iceberg.rest.uri" = "https://biglake.googleapis.com/iceberg/v1/restcatalog",
    "iceberg.rest.security.type" = "google",
    "iceberg.rest.io-impl" = "org.apache.iceberg.gcp.gcs.GCSFileIO",
    "iceberg.rest.google.user-project" = "my-billing-project",
    "warehouse" = "gs://my-bucket/warehouse/"
);

Release note

Features

  • [Iceberg] Support Google Authentication (GoogleAuthManager) for Iceberg REST catalog

…alog

Add support for Google Cloud Lakehouse Iceberg REST catalog by
introducing a new `google` security type that leverages Iceberg's
built-in GoogleAuthManager for authentication via Application Default
Credentials.

New properties:
- iceberg.rest.security.type = google
- iceberg.rest.io-impl for FileIO implementation
- iceberg.rest.google.user-project for billing project
- iceberg.gcs.oauth2.token for GCS storage access

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@hello-stephen
Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@tuantran0910
Copy link
Copy Markdown
Author

run buildall

@tuantran0910
Copy link
Copy Markdown
Author

/review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature] Support Google Authentication for Iceberg REST Catalog

2 participants