Changes

Author: rambleraptor

Makefile

@@ -129,7 +129,7 @@ test-polaris-setup: install ## Start Docker services for Polaris integration tes
 	docker compose -f dev/docker-compose-polaris.yml kill
 	docker compose -f dev/docker-compose-polaris.yml rm -f
 	docker compose -f dev/docker-compose-polaris.yml up -d --build --wait
-	uv run $(PYTHON_ARG) python dev/provision_polaris.py > dev/polaris_creds.env
+	./dev/provision_polaris.sh > dev/polaris_creds.env
 
 test-polaris-exec: ## Run Polaris integration tests
 	@eval $$(cat dev/polaris_creds.env) && \

dev/polaris-bootstrap.yaml

@@ -0,0 +1,49 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+principals:
+  pyiceberg_principal:
+    roles:
+      - service_admin
+      - pyiceberg_role
+
+principal_roles:
+  - pyiceberg_role
+
+catalogs:
+  - name: "polaris"
+    storage_type: "s3"
+    default_base_location: "s3://warehouse/polaris/"
+    allowed_locations:
+      - "s3://warehouse/polaris/"
+    properties:
+      polaris.config.drop-with-purge.enabled: "true"
+      region: "us-east-1"
+      endpoint: "http://minio:9000"
+    roles:
+      catalog_admin:
+        assign_to:
+          - pyiceberg_role
+        privileges:
+          catalog:
+            - CATALOG_MANAGE_CONTENT
+            - CATALOG_MANAGE_METADATA
+            - TABLE_CREATE
+            - TABLE_WRITE_DATA
+            - TABLE_LIST
+            - NAMESPACE_CREATE
+            - NAMESPACE_LIST

dev/provision_polaris.py

@@ -0,0 +1,54 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+set -e
+
+CONTAINER_NAME="pyiceberg-polaris"
+BOOTSTRAP_FILE="dev/polaris-bootstrap.yaml"
+# Map local bootstrap file into the container
+# Actually, it's easier to just pipe it or use docker cp if needed,
+# but we can also just run the command from outside if the CLI is available locally.
+# The user said "don't need to uv pip install polaris... that's what the docker stuff is for"
+# This implies we should run the polaris command INSIDE the docker container.
+
+echo "Applying Polaris bootstrap configuration..."
+# We need to get the file into the container or use a command that can read from stdin if supported.
+# Assuming we can cat it to the container.
+docker cp $BOOTSTRAP_FILE $CONTAINER_NAME:/tmp/polaris-bootstrap.yaml
+
+docker exec $CONTAINER_NAME polaris \
+    --host localhost \
+    --port 8181 \
+    --client-id root \
+    --client-secret s3cr3t \
+    setup apply /tmp/polaris-bootstrap.yaml
+
+echo "Rotating credentials for pyiceberg_principal..."
+CREDS_JSON=$(docker exec $CONTAINER_NAME polaris \
+    --host localhost \
+    --port 8181 \
+    --client-id root \
+    --client-secret s3cr3t \
+    principals rotate-credentials pyiceberg_principal)
+
+# Extract CLIENT_ID and CLIENT_SECRET using python (since it's already a dependency)
+CLIENT_ID=$(echo $CREDS_JSON | python3 -c "import sys, json; print(json.load(sys.stdin)['clientId'])")
+CLIENT_SECRET=$(echo $CREDS_JSON | python3 -c "import sys, json; print(json.load(sys.stdin)['clientSecret'])")
+
+echo "CLIENT_ID=$CLIENT_ID"
+echo "CLIENT_SECRET=$CLIENT_SECRET"