Iceberg: use sts for Iceberg credentials source with Glue + Cloud#1714
Conversation
Update the Cloud variant of the Iceberg + AWS Glue page to use `sts` instead of `aws_instance_metadata` for `iceberg_rest_catalog_credentials_source` when reusing the cluster's IAM role. On Redpanda Cloud, the cluster IAM role is reached via IRSA (STS AssumeRoleWithWebIdentity), and cloudv2#26411 re-points the Glue IAM policy attachment to fire on `sts`. The previous value is accepted at the API but no longer attaches Glue permissions on Cloud. Requires Redpanda v26.1.9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for redpanda-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis PR updates the AWS Glue IAM credential source documentation for Iceberg REST catalog authentication. The Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc`:
- Line 138: The docs add guidance to set iceberg_rest_catalog_credentials_source
to `sts` but don't state the minimum Redpanda version required; update the
iceberg-topics-aws-glue.adoc text near the
iceberg_rest_catalog_credentials_source description and the example around the
`sts` usage to include an explicit caveat that `sts` requires Redpanda v26.1.9+
(mention the exact version string v26.1.9+), and add a short note preventing
users on earlier versions from following the `sts` flow without upgrading.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 725e2eec-332a-47a7-be88-13e2a0a793ee
📒 Files selected for processing (1)
modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc
| + | ||
| -- | ||
| ** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `aws_instance_metadata`. To use static credentials, set to `config_file`. | ||
| ** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `sts`. To use static credentials, set to `config_file`. |
There was a problem hiding this comment.
Add an explicit minimum-version caveat for sts guidance.
The new recommendation at Line 138 and example at Line 220 introduce sts, but this page does not state that this behavior requires Redpanda v26.1.9+ (per PR objective/commit context). Without that guardrail, users on earlier versions can follow these steps and hit Glue auth/policy mismatch.
Suggested doc patch
-** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `sts`. To use static credentials, set to `config_file`.
+** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `sts` (Redpanda v26.1.9 or later). To use static credentials, set to `config_file`. rpk cluster config set \
@@
- iceberg_rest_catalog_credentials_source=sts \
+ iceberg_rest_catalog_credentials_source=sts \ # Redpanda v26.1.9+Also applies to: 220-220
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc` at line 138, The
docs add guidance to set iceberg_rest_catalog_credentials_source to `sts` but
don't state the minimum Redpanda version required; update the
iceberg-topics-aws-glue.adoc text near the
iceberg_rest_catalog_credentials_source description and the example around the
`sts` usage to include an explicit caveat that `sts` requires Redpanda v26.1.9+
(mention the exact version string v26.1.9+), and add a short note preventing
users on earlier versions from following the `sts` flow without upgrading.
|
@kbatuigas lgtm but I think it will be worth adding that |
micheleRP
left a comment
micheleRP
left a comment
There was a problem hiding this comment.
Claude PR review: no critical issues or required updates. The PR fulfills DOC-2209 — it replaces aws_instance_metadata with sts in both the Configure authentication and credentials description and the Use cluster's IAM credentials rpk example, matching the cloudv2#26411 Glue IAM policy attachment. Bonus fix: corrects four broken cloud_storage_* xrefs from properties/cluster-properties to properties/object-storage-properties in the self-managed section.
CodeRabbit's suggestion to add a Redpanda v26.1.9+ version callout was intentionally skipped — the change is inside ifdef::env-cloud[] and renders only on the cloud-docs site, where Cloud is always on the latest broker.
LGTM from a docs-team-standards perspective.
kbatuigas
deleted the
DOC-2209-update-iceberg-aws-glue-cloud-doc-to-recommend
branch
3 participants
Update the Cloud variant of the Iceberg + AWS Glue page to use
stsinstead ofaws_instance_metadataforiceberg_rest_catalog_credentials_sourcewhen reusing the cluster's IAM role. On Redpanda Cloud, the cluster IAM role is reached via IRSA (STS AssumeRoleWithWebIdentity), and cloudv2#26411 re-points the Glue IAM policy attachment to fire onsts. The previous value is accepted at the API but no longer attaches Glue permissions on Cloud.Description
Resolves https://redpandadata.atlassian.net/browse/
Review deadline:
Page previews
Checks