Antalya 26.3: Cache vended catalog credentials

[zvonand]

Changelog category (leave one):

• Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Add caching for REST catalog vended credentials. Added a new setting vended_credentials_cache_ttl: maximum cache entry lifetime (in seconds) for vended credentials (REST catalogs only). Default 300; 0 disables caching.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [aaac3d2]

[mkmkme]

LGTM!

[DimensionWieldr]

CI Failures Analysis

Unrelated to this PR (outdated CI / base-branch drift)

• Iceberg export partition — TTL expiry permits re-export of the same partition (no catalog / glue / ice catalog): fails with EXPORT_PARTITION_ALREADY_EXPORTED. Export TTL behavior was changed in Turn system.replicated_partition_exports table into a history table by removing the TTL #1917; regression tests are already fixed, but this CI run predates that update. Safe to ignore.
• S3 export — mismatched columns (export part / export partition): expected exit code 122, got 20. Same class of issue — test expectations updated on the branch, CI not yet reflecting the fix. Safe to ignore.
• Settings (/settings/default values/*): SnapshotNotFoundError for default values>=26.3_antalya.snapshot — missing/out-of-sync snapshot in CI checkout, not related to credential caching.
• Stress test (amd_release): Cannot start clickhouse-server after leftover Hybrid-table metadata from stress iterations — flaky stress infra.
• RegressionTestsAarch64 (43 jobs): CH_ARM_BIN_GH artifact missing because this PR excluded arm builds (ci_exclude_aarch64); regression aarch64 jobs still ran. Not a functional failure of this change.

Bottom line: With the Iceberg TTL and S3 export failures explained as stale CI vs. fixes from #1917, there are no actionable PR-caused regressions left — only infra/noise (settings snapshots, stress, aarch64 artifact).

[Korg95]

Hi there! Is it possible to know when a new release will get cut with this, we are in the midst of planning an upgrade to 26.3 and just wondering if we should hold for this or go for it and do a minor update later?

[alsugiliazova]

Hi @Korg95, the release with this pr should be out by the end of this week.

[Korg95]

Thanks @alsugiliazova for the update.