Skip to content

Iceberg other creds - #30284

Merged
wdberkeley merged 2 commits into
devfrom
iceberg-other-creds
May 12, 2026
Merged

Iceberg other creds#30284
wdberkeley merged 2 commits into
devfrom
iceberg-other-creds

Conversation

@wdberkeley

@wdberkeley wdberkeley commented Apr 24, 2026

Copy link
Copy Markdown
Contributor

The Iceberg REST catalog credential refresh background operation was incorrectly using cloud storage configuration in two ways: it ignored iceberg_rest_catalog_credentials_source in favour of cloud_storage_credentials_source when selecting the credentials provider, and it unconditionally applied cloud_storage_credentials_host as a host override regardless of which subsystem was refreshing credentials. This caused failures when the two subsystems use different credential sources — for example, cloud storage using STS with a custom host override while the REST catalog uses EC2 instance metadata, resulting in IMDS requests being sent to the STS endpoint and timing out.

Backports Required

  • none - not a bug fix
  • none - this is a backport
  • none - issue does not exist in previous branches
  • none - papercut/not impactful enough to backport
  • v26.1.x
  • v25.3.x
  • v25.2.x

Release Notes

Bug Fixes

  • Iceberg REST catalog credential refresh requests were sent to the wrong host when cloud_storage_credentials_host was set. The host override intended for cloud storage was applied globally, causing catalog credential fetches to fail if the catalog used a different credentials source with a different expected endpoint.

Features

  • New configuration: iceberg_rest_catalog_credentials_host: The hostname to connect to for retrieving role-based credentials for the Iceberg REST catalog. May be required when the REST catalog uses a different credentials source than cloud storage — for example, if cloud storage is configured to use STS with a custom credentials host, but the REST catalog uses aws_instance_metadata, this should be set to 169.254.169.254 to prevent the cloud storage host override from applying to catalog credential requests.

@wdberkeley
wdberkeley requested a review from andrwng April 24, 2026 00:10
@wdberkeley
wdberkeley requested a review from a team as a code owner April 24, 2026 00:10
Copilot AI review requested due to automatic review settings April 24, 2026 00:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes Iceberg REST catalog credential refresh to use the correct credential source and avoid incorrectly applying the cloud storage credentials host override to non–cloud-storage credential refreshes.

Changes:

  • Route Iceberg REST catalog background credential refresh to use iceberg_rest_catalog_credentials_source (with fallback) rather than cloud_storage_credentials_source.
  • Add and wire iceberg_rest_catalog_credentials_host so the REST catalog can use a distinct credentials host override.
  • Plumb host override through the auth refresh configuration pipeline (cloud storage + cloud roles), removing the previous implicit global override behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
src/v/datalake/credential_manager.cc Passes Iceberg-specific credentials source + host override into the refresh credentials source builder.
src/v/config/configuration.h Declares new iceberg_rest_catalog_credentials_host config property.
src/v/config/configuration.cc Defines and documents iceberg_rest_catalog_credentials_host.
src/v/cloud_storage_clients/credential_manager.cc Ensures cloud storage refresh uses cloud_storage_credentials_host via the new builder signature.
src/v/cloud_storage_clients/configuration.h Extends build_refresh_credentials_source API to accept an optional host override.
src/v/cloud_storage_clients/configuration.cc Threads host override into auth_refresh_bg_op::s3_compat_config.
src/v/cloud_roles/refresh_credentials.h Adds host override parameter to the refresh-credentials factory template and removes implicit global host override.
src/v/cloud_roles/refresh_credentials.cc Propagates host override through make_refresh_credentials dispatch.
src/v/cloud_roles/auth_refresh_bg_op.h Extends s3_compat_config with an optional host override field.
src/v/cloud_roles/auth_refresh_bg_op.cc Plumbs host override into make_refresh_credentials invocation.

Comment thread src/v/cloud_storage_clients/credential_manager.cc Outdated
Comment thread src/v/cloud_roles/refresh_credentials.h Outdated
Comment thread src/v/config/configuration.cc Outdated
@vbotbuildovich

vbotbuildovich commented Apr 24, 2026

Copy link
Copy Markdown
Collaborator

CI test results

test results on build#83612
test_status test_class test_method test_arguments test_kind job_url passed reason test_history
FLAKY(PASS) ShadowLinkingReplicationTests test_with_restart {"storage_mode": "tiered_cloud"} integration https://buildkite.com/redpanda/redpanda/builds/83612#019dbcef-cf7f-4d05-8fc4-9d5561fcac34 10/11 Test PASSES after retries.No significant increase in flaky rate(baseline=0.0199, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000) https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ShadowLinkingReplicationTests&test_method=test_with_restart
test results on build#84304
test_status test_class test_method test_arguments test_kind job_url passed reason test_history
FLAKY(PASS) ShadowLinkBasicTests test_link_creation_checks {"source_cluster_spec": {"cluster_type": "redpanda"}} integration https://buildkite.com/redpanda/redpanda/builds/84304#019e194a-6e1c-492d-b3b4-a7912f7ebecc 10/11 Test PASSES after retries.No significant increase in flaky rate(baseline=0.0136, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000) https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ShadowLinkBasicTests&test_method=test_link_creation_checks
FLAKY(FAIL) ShadowLinkingReplicationTests test_with_restart {"storage_mode": "cloud"} integration https://buildkite.com/redpanda/redpanda/builds/84304#019e194a-6e1b-4518-a1db-7d761191c6c4 25/31 Test FAILS after retries.Significant increase in flaky rate(baseline=0.0259, p0=0.0010, reject_threshold=0.0100) https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ShadowLinkingReplicationTests&test_method=test_with_restart

start_auth_refresh_if_needed was passing cloud_storage_credentials_source
to build_refresh_credentials_source, ignoring iceberg_rest_catalog_aws_credentials_source.
Use get_credentials_source() which already prefers the iceberg-specific
config with fallback to cloud storage.
@wdberkeley
wdberkeley force-pushed the iceberg-other-creds branch from cc6fab6 to 7ff48de Compare April 28, 2026 17:10
@wdberkeley
wdberkeley requested a review from nvartolomei April 29, 2026 16:40
Comment thread src/v/config/configuration.cc Outdated
Comment on lines +4325 to +4326
"cloud_storage_credentials_source is set to sts with a custom "
"credentials "

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This kind of alludes to this property being connected with cloud_storage_credentials_source in some way. Does it make sense in the many cases for them to be the same? Wondering if the user of this should be doing some fallback onto cloud_storage_credentials_source if this is null?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clarified in the description. It's only relevant when specifically setting up cloud storage and the rest catalog credentials differently, using different sources, so we wouldn't want fallback in that case.

{.needs_restart = needs_restart::yes, .visibility = visibility::user},
std::nullopt,
&validate_non_empty_string_opt)
, iceberg_rest_catalog_credentials_host(

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a bit worried this will be confused with iceberg_rest_catalog_oauth2_server_uri. consider copying the help text from the cloud storage config

Only required when using IAM role based access

and maybe also specifying that this does not apply to oauth schemes / applies only to aws

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

nvartolomei
nvartolomei previously approved these changes May 11, 2026

@nvartolomei nvartolomei left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems ok; one nit

When cloud_storage_credentials_host is set (e.g. to an STS endpoint),
it was being applied to Iceberg REST catalog credential requests too,
regardless of the catalog's credentials source. This caused failures
when the catalog uses aws_instance_metadata (which expects
169.254.169.254) but the cloud storage host override points elsewhere.

Add iceberg_rest_catalog_credentials_host to allow the catalog
credentials host to be set independently. Thread host_override through
build_refresh_credentials_source and s3_compat_config down to
make_refresh_credentials, replacing the direct config read in the
template with an explicit parameter.
@vbotbuildovich

Copy link
Copy Markdown
Collaborator

Retry command for Build#84304

please wait until all jobs are finished before running the slash command

/ci-repeat 1
skip-redpanda-build
skip-units
skip-rebase
tests/rptest/tests/cluster_linking_e2e_test.py::ShadowLinkingReplicationTests.test_with_restart@{"storage_mode":"cloud"}

@wdberkeley

Copy link
Copy Markdown
Contributor Author

/ci-repeat 1
skip-redpanda-build
skip-units
skip-rebase
tests/rptest/tests/cluster_linking_e2e_test.py::ShadowLinkingReplicationTests.test_with_restart@{"storage_mode":"cloud"}

@wdberkeley
wdberkeley merged commit 707d489 into dev May 12, 2026
19 checks passed
@wdberkeley
wdberkeley deleted the iceberg-other-creds branch May 12, 2026 16:47
@vbotbuildovich

Copy link
Copy Markdown
Collaborator

/backport v26.1.x

@vbotbuildovich

Copy link
Copy Markdown
Collaborator

/backport v25.3.x

@vbotbuildovich

Copy link
Copy Markdown
Collaborator

/backport v25.2.x

@vbotbuildovich

Copy link
Copy Markdown
Collaborator

Failed to create a backport PR to v25.2.x branch. I tried:

git remote add upstream https://github.com/redpanda-data/redpanda.git
git fetch --all
git checkout -b backport-pr-30284-v25.2.x-590 remotes/upstream/v25.2.x
git cherry-pick -x 429145d33e b49b35a4e3

Workflow run logs.

@vbotbuildovich

Copy link
Copy Markdown
Collaborator

Failed to create a backport PR to v25.3.x branch. I tried:

git remote add upstream https://github.com/redpanda-data/redpanda.git
git fetch --all
git checkout -b backport-pr-30284-v25.3.x-760 remotes/upstream/v25.3.x
git cherry-pick -x 429145d33e b49b35a4e3

Workflow run logs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants