|
| 1 | +// Licensed to the Apache Software Foundation (ASF) under one |
| 2 | +// or more contributor license agreements. See the NOTICE file |
| 3 | +// distributed with this work for additional information |
| 4 | +// regarding copyright ownership. The ASF licenses this file |
| 5 | +// to you under the Apache License, Version 2.0 (the |
| 6 | +// "License"); you may not use this file except in compliance |
| 7 | +// with the License. You may obtain a copy of the License at |
| 8 | +// |
| 9 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +// |
| 11 | +// Unless required by applicable law or agreed to in writing, |
| 12 | +// software distributed under the License is distributed on an |
| 13 | +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +// KIND, either express or implied. See the License for the |
| 15 | +// specific language governing permissions and limitations |
| 16 | +// under the License. |
| 17 | + |
| 18 | +//! Helpers shared between the Iceberg scan and Iceberg write operators. |
| 19 | +
|
| 20 | +use std::collections::HashMap; |
| 21 | +use std::sync::Arc; |
| 22 | + |
| 23 | +use datafusion::common::DataFusionError; |
| 24 | +use iceberg::io::{FileIO, FileIOBuilder, StorageFactory}; |
| 25 | +use iceberg_storage_opendal::{CustomAwsCredentialLoader, OpenDalStorageFactory}; |
| 26 | + |
| 27 | +use crate::cloud::s3::credential_bridge::{AccessMode, CometS3CredentialBridge}; |
| 28 | + |
| 29 | +/// Activation key for the `CometS3CredentialProvider` SPI, read from a catalog's `s3.*` property |
| 30 | +/// bag. |
| 31 | +const ICEBERG_PROVIDER_CLASS_PROPERTY: &str = "s3.comet.credential.provider.class"; |
| 32 | + |
| 33 | +/// Key prefixes forwarded to iceberg-rust's `FileIO`. The full unfiltered catalog bag (catalog |
| 34 | +/// URI, OAuth tokens, credentials.uri, tenant-id, etc.) is kept upstream so |
| 35 | +/// `CometS3CredentialBridge` can read whatever the vendor needs. |
| 36 | +const STORAGE_PROPERTY_PREFIXES: &[&str] = &["s3.", "gcs.", "adls.", "client."]; |
| 37 | + |
| 38 | +/// Pick an OpenDAL storage backend from a URI's scheme. `file` (or no scheme) falls through to |
| 39 | +/// the local file system. `memory` is used by the write path to assemble manifest bytes that |
| 40 | +/// stay entirely in-process. For S3, the Comet credential bridge is wired in when a provider |
| 41 | +/// class is configured; `access_mode` is forwarded to the JVM SPI so the read and write paths can |
| 42 | +/// be granted different (e.g. read-only vs read-write) credentials. |
| 43 | +pub(crate) fn storage_factory_for( |
| 44 | + path: &str, |
| 45 | + catalog_properties: &HashMap<String, String>, |
| 46 | + catalog_name: &str, |
| 47 | + access_mode: AccessMode, |
| 48 | +) -> Result<Arc<dyn StorageFactory>, DataFusionError> { |
| 49 | + let scheme = if path.contains("://") { |
| 50 | + path.split("://").next().unwrap_or("file") |
| 51 | + } else { |
| 52 | + "file" |
| 53 | + }; |
| 54 | + match scheme { |
| 55 | + "file" => Ok(Arc::new(OpenDalStorageFactory::Fs)), |
| 56 | + "memory" => Ok(Arc::new(OpenDalStorageFactory::Memory)), |
| 57 | + "s3" | "s3a" => { |
| 58 | + let customized_credential_load = |
| 59 | + build_s3_credential_loader(path, catalog_properties, catalog_name, access_mode); |
| 60 | + Ok(Arc::new(OpenDalStorageFactory::S3 { |
| 61 | + customized_credential_load, |
| 62 | + })) |
| 63 | + } |
| 64 | + "gs" => Ok(Arc::new(OpenDalStorageFactory::Gcs)), |
| 65 | + "oss" => Ok(Arc::new(OpenDalStorageFactory::Oss)), |
| 66 | + _ => Err(DataFusionError::Execution(format!( |
| 67 | + "Unsupported storage scheme: {scheme}" |
| 68 | + ))), |
| 69 | + } |
| 70 | +} |
| 71 | + |
| 72 | +/// Build a `FileIO` whose storage scheme is inferred from `reference_path` and whose properties |
| 73 | +/// come from the catalog. The reference path is the metadata location for reads or the data |
| 74 | +/// location for writes — anything that carries the right URI scheme. `catalog_name` is the |
| 75 | +/// credential dispatch key and `access_mode` is the access intent forwarded to the S3 credential |
| 76 | +/// bridge, so the write path can request write-capable credentials. |
| 77 | +pub(crate) fn load_file_io( |
| 78 | + catalog_properties: &HashMap<String, String>, |
| 79 | + reference_path: &str, |
| 80 | + catalog_name: &str, |
| 81 | + access_mode: AccessMode, |
| 82 | +) -> Result<FileIO, DataFusionError> { |
| 83 | + let factory = storage_factory_for( |
| 84 | + reference_path, |
| 85 | + catalog_properties, |
| 86 | + catalog_name, |
| 87 | + access_mode, |
| 88 | + )?; |
| 89 | + let mut file_io_builder = FileIOBuilder::new(factory); |
| 90 | + |
| 91 | + // Narrow to storage-prefix keys before forwarding to iceberg-rust's FileIO. The full |
| 92 | + // unfiltered bag (catalog URI, OAuth tokens, credentials.uri, tenant-id, etc.) is kept |
| 93 | + // upstream so CometS3CredentialBridge can read whatever the vendor needs. |
| 94 | + for (key, value) in catalog_properties { |
| 95 | + if STORAGE_PROPERTY_PREFIXES.iter().any(|p| key.starts_with(p)) { |
| 96 | + file_io_builder = file_io_builder.with_prop(key, value); |
| 97 | + } |
| 98 | + } |
| 99 | + |
| 100 | + Ok(file_io_builder.build()) |
| 101 | +} |
| 102 | + |
| 103 | +/// Wires the configured Comet credential provider into opendal's S3 service, or returns `None` |
| 104 | +/// so opendal falls back to its default credential chain. |
| 105 | +fn build_s3_credential_loader( |
| 106 | + reference_path: &str, |
| 107 | + catalog_properties: &HashMap<String, String>, |
| 108 | + catalog_name: &str, |
| 109 | + access_mode: AccessMode, |
| 110 | +) -> Option<CustomAwsCredentialLoader> { |
| 111 | + let url = url::Url::parse(reference_path).ok()?; |
| 112 | + let bucket = url.host_str()?; |
| 113 | + let provider_class = catalog_properties |
| 114 | + .get(ICEBERG_PROVIDER_CLASS_PROPERTY) |
| 115 | + .map(|s| s.trim()) |
| 116 | + .filter(|s| !s.is_empty())?; |
| 117 | + // Fall back to the bucket when the table has no catalog identity (e.g. HadoopTables loaded by |
| 118 | + // raw path). |
| 119 | + let dispatch_key: &str = if catalog_name.is_empty() { |
| 120 | + bucket |
| 121 | + } else { |
| 122 | + catalog_name |
| 123 | + }; |
| 124 | + let bridge = CometS3CredentialBridge::new( |
| 125 | + provider_class, |
| 126 | + dispatch_key, |
| 127 | + bucket, |
| 128 | + url.path(), |
| 129 | + access_mode, |
| 130 | + catalog_properties, |
| 131 | + ); |
| 132 | + match bridge { |
| 133 | + Ok(b) => Some(CustomAwsCredentialLoader::new(b)), |
| 134 | + Err(e) => { |
| 135 | + log::warn!( |
| 136 | + "Failed to initialize CometS3CredentialBridge for {provider_class}: {e}; \ |
| 137 | + falling back to default opendal credential chain" |
| 138 | + ); |
| 139 | + None |
| 140 | + } |
| 141 | + } |
| 142 | +} |
0 commit comments