Fixed issues in Iceberg REST Catalog

Fixed issues for Cloudera Iceberg REST Catalog are addressed in Cloudera Runtime 7.3.2, its service packs and cumulative hotfixes.

Cloudera Runtime 7.3.2.10000 SP1

CDPD-92469: Iceberg REST Catalog supports credential vending for Azure storage in Data Sharing: 7.3.2.10000; When Data Sharing was configured on Azure, external clients calling the Cloudera Iceberg REST Catalog credentials API could not obtain vended Azure credentials needed to read shared tables from ADLS Gen2. The REST Catalog now supports vended credentials for Azure storage in Data Sharing scenarios, allowing compliant external engines to retrieve the credentials required for shared table access.
CDPD-105060: External Spark engines failed to read shared Azure tables using REST Catalog credentials: 7.3.2.10000; On Azure Data Sharing environments, an external Spark client could receive a user-delegation Shared Access Signature (SAS) from the Cloudera Iceberg REST Catalog /credentials API, but Iceberg Azure libraries did not consume the returned token automatically. Table reads failed with authentication errors unless the SAS was passed manually in Spark configuration. REST Catalog credential handling now propagates Azure user-delegation SAS tokens to Iceberg Azure file IO so external Spark jobs can read shared ADLS tables using credentials from the REST Catalog API without manual SAS configuration.
CDPD-106288: Azure REST Catalog credentials API failed with unable to obtain IdBroker delegation token: 7.3.2.10000; On Azure Data Sharing clusters, after namespace and table load succeeded, the REST Catalog /credentials API returned HTTP 401 with Unable to obtain IdBroker delegation token for current user when obtaining storage credentials through Knox IDBroker. REST Catalog Data Sharing now uses a client-side SSL context for outbound Knox IDBroker calls, allowing delegation-token retrieval to succeed for Azure credentials requests in secured topologies.
CDPD-104013: Azure REST Catalog credentials API returned NotAuthorizedException: 7.3.2.10000; On Azure environments, the REST Catalog credentials API could fail with NotAuthorizedException and log entries showing null token_type and expires_on when Azure credential vending was requested. Cloud environment variable handling in REST Catalog Data Sharing was corrected so Azure credential requests are authorized and return valid credential metadata.
CDPD-103075: Users could load shared tables after Data Share validity expired: 7.3.2.10000; After a Data Share validity period ended, REST Catalog clients could still load tables that should no longer be accessible under the expired share policy. Ranger and REST Catalog integration now evaluates allowed privileges against share validity through a new getAllowedPrivileges() path, blocking table load when the share is no longer valid.; Apache JIRA: RANGER-5598
CDPD-80021: Data Sharing was available when Metering service was not running: 7.3.2.10000; Cloudera Iceberg REST Catalog / Data Sharing could be used in environments where the Metering V2 service was not running, contrary to metering enforcement requirements. Data Sharing is now blocked when the Metering service is unavailable, preventing unmetered share access.
CDPD-76490: Ranger bulk delete of resources failed when executed through Knox proxy: 7.3.2.10000; Bulk delete of Ranger resources initiated through the Knox proxy failed, impacting administrative cleanup workflows used in Data Sharing operations. Ranger bulk resource delete now succeeds when the request is routed through Knox proxy.; Apache JIRA: RANGER-5577
CDPD-89962: Knox IDBroker did not return path-scoped Azure user delegation SAS for Data Sharing: 7.3.2.10000; On Azure, Knox IDBroker returned broad storage access tokens instead of path- and policy-scoped user delegation Shared Access Signature (SAS) tokens when Data Sharing requested reduced-scope credentials for a specific ADLS resource. Knox IDBroker now generates Azure user delegation SAS tokens when path and policy are supplied, enabling least-privilege access aligned with Data Sharing session policies. Configure Knox aliases azure.storage.account and optionally azure.sas.token.lifetime.
CDPD-100082: Knox REST Catalog dispatch did not include configurable outbound token metadata headers: 7.3.2.10000; When Knox dispatched REST Catalog share-access requests, required configurable token metadata was not included as outbound HTTP headers, preventing downstream services from applying share-context policies correctly. Knox REST Catalog dispatch now supports including configurable metadata as outbound request headers for Data Sharing token flows.; Apache JIRA: KNOX-3279

Cloudera Runtime 7.3.2.100 CHF 1

There are no new fixed issues in this release.

Cloudera Runtime 7.3.2

Cloudera Runtime 7.3.2 resolves Cloudera Iceberg REST Catalog issues and incorporates fixes from the service packs and cumulative hotfixes from 7.3.1.100 through 7.3.1.400. For a comprehensive record of all fixes in Cloudera Runtime 7.3.1.x, see Fixed Issues.

CDPD-76180: Ranger DataShare created shows status as ACTIVE instead of the default REQUESTED: 7.3.2; When a new Ranger Data Share is created, its status was incorrectly set to ACTIVE by default. This issue has been resolved. The system now correctly sets the default status to REQUESTED upon creation, matching the expected behavior and avoiding user confusion about the Data Share state.; Apache JIRA: RANGER-4997
CDPD-77975: Load table REST API showing details of unauthorized table: 7.3.1.400, 7.3.2; The Iceberg REST Catalog load table API incorrectly returned metadata details for tables that were excluded from the Ranger policy, resulting in a 200 response instead of the expected 404 NoSuchTableException. This issue has been resolved by adding filtering support to get_table_metas. Unauthorized tables are now properly hidden and return the appropriate error response.
CDPD-80657: Filter Ranger access audit by DataSet: 7.3.2; The Ranger user interface filter by datasets was non-functional. This issue is resolved and you can now filter Ranger access audits by Dataset.; Apache JIRA: RANGER-5156
CDPD-94396: IDBroker includes preceding / in prefix when substituting session policy contents: 7.3.1.507, 7.3.1.800, 7.3.2.0; IDBroker assumed that prefix values in policy condition statements could include a preceding / character, which caused policies not to work properly. This issue has been resolved. IDBroker now removes the leading / character from prefix values when performing substitutions in session policies.
CDPD-85416: Add client configuration to HiveAuthzContext for REST catalog audit differentiation: 7.3.2; When calls are made to Ranger HiveAuthorizer from the REST Catalog, Ranger was unable to differentiate the plugins between the Hive Metastore and the REST Catalog. This caused audits to be incorrectly logged for the calls made from the REST Catalog service. This issue is resolved. The authorization context has been enriched to include the client_type, allowing Ranger to properly differentiate and audit the calls.
CDPD-85261: Rest Catalog service should use only HMS RangerHiveAuthorizer for its command authorization: 7.3.2; The REST Catalog service incorrectly created a new instance of the Ranger Hive plugin for authorization. This caused the main Hive plugin reference to be overwritten because the REST Catalog is embedded in the Hive Metastore (HMS). This issue has been resolved. The REST Catalog service now correctly uses only the HMS RangerHiveAuthorizer for its command authorization.
CDPD-96185: REST Catalog APIs failing with error code 500 at the time of rolling upgrade: 7.3.2.0; During rolling upgrades, Iceberg REST Catalog API requests routed through Knox failed with a 500 error code. This happened because High Availability (HA) failover was not supported for the iceberg-rest service in Knox. This issue has been resolved. Knox now supports HA for the iceberg-rest service, ensuring that API requests properly fail over to available instances during upgrades.; Apache JIRA: KNOX-3154
CDPD-85058: REST Catalog APIs failing with error code 401 during rolling upgrade: 7.3.2; During rolling upgrades, REST Catalog APIs could fail with an HTTP 401 error code due to an access token fetch failure when the connection to IDBroker encountered an UnknownHostException. This issue has been resolved.
CDPD-81420: Add ownership information in tablecontext when doing filteringTableNames and filterTableMetas: 7.3.2; The Iceberg REST Catalog was missing table ownership information when fetching and filtering metadata using filterTable. This caused mapping issues in IDBroker. This issue has been resolved. The REST Catalog now correctly uses filterTableMetas to include ownership information when invoking client.get_all_tables.
CDPD-83430: STS token generated incorrectly when fetchDelegationToken fails: 7.3.2; An issue in the REST Catalog allowed Security Token Service (STS) tokens to be incorrectly generated for queries even when the fetchDelegationToken operation to IDBroker failed. This issue has been resolved. Now, queries will correctly fail to generate STS tokens and execute if IDBroker cannot be reached to fetch the required delegation token.
CDPD-80334: REST Catalog plugin is not sending the audit with "rest catalog" as app Id for audit segregation: 7.3.1.400, 7.3.2.0; The Iceberg REST Catalog plugin incorrectly failed to send audit logs with the "rest catalog" Application ID, which prevented proper audit segregation. This issue has been resolved. The REST Catalog plugin configuration has been overridden to correctly send the audit with the "rest catalog" Application ID for audit segregation.
CDPD-82812: HA feature not working for Rest Catalog: 7.3.2.0; Previously, the Knox topology file cdp-share-access.xml created during Cloudera Data Sharing setup could not handle multiple Hive Metastore (HMS) nodes. In the event of a node failure, healthy nodes could not reliably take over the workload. This issue has been resolved. The Knox topology now correctly supports High Availability (HA) for the REST Catalog, ensuring proper failover between HMS nodes.