How to Provide credentials for Nessie Iceberg Rest Catalog ?

[saikiran2603]

Hi All ,

I am trying to connect to Minio with Iceberg Rest , and below are my configurations , When i try to connect via pyiceberg i get error saying access key secret key not found , i am not able to get the proper configuration required to set it up ,

In the helm chart i have following Configurations

        advancedConfig:
          nessie.catalog.default-warehouse: nessie_iceberg
          nessie.catalog.warehouses.nessie_iceberg.location: s3://dip/nessie_iceberg
          nessie.catalog.service.s3.buckets.nessie_iceberg.region: us-east-1
          nessie.catalog.service.s3.buckets.nessie_iceberg.endpoint: http://minio.{{ .Values.minio.namespace }}:9000
          nessie.catalog.service.s3.buckets.nessie_iceberg.path-style-access: true
          nessie.catalog.service.s3.buckets.nessie_iceberg.access-key: urn:nessie-secret:quarkus:minio-creds
          minio-creds.name: access_key_id
          minio-creds.secret: secret_access_key
          nessie.catalog.service.s3.default-options.region: us-east-1
          nessie.catalog.service.s3.default-options.endpoint: http://minio.{{ .Values.minio.namespace }}:9000
          nessie.catalog.service.s3.default-options.path-style-access: true
          nessie.catalog.service.s3.default-options.access-key: urn:nessie-secret:quarkus:minio-creds
        extraEnv:
          - name: NESSIE_CATALOG_SERVICE_S3_ACCESS_KEY_NAME
            valueFrom:
              secretKeyRef:
                name: minio-creds
                key: access_key_id
          - name: NESSIE_CATALOG_SERVICE_S3_ACCESS_KEY_SECRET
            valueFrom:
              secretKeyRef:
                name: minio-creds
                key: secret_access_key

I tried providing secret via env var as well but its still getting stuck

      - apiVersion: v1
        kind: Secret
        metadata:
          name: minio-creds
        type: Opaque
        stringData:
          access_key_id: {{ .Values.minio.service_account.accessKey }}
          secret_access_key: {{ .Values.minio.service_account.secretKey }}

This is how i am creating the secret.

[dimas-b]

I guess there are several factors in play in this discussion. Let's focus on using k8s secrets as the ultimate source of secret bits.

The NESSIE_CATALOG_SERVICE_S3_ACCESS_KEY_NAME and NESSIE_CATALOG_SERVICE_S3_ACCESS_KEY_SECRET seem to be defined correctly. However, I'd recommend using lower case names with dots (for simply mapping to Quarkus config). That would lead to using env. var names of minio-creds.name and minio-creds.secret instead of those upper case names.

Next, remove minio-creds.name and minio-creds.secret from advancedConfig to avoid collision.

Then it should work, I hope :)

[saikiran2603]

Thanks @dimas-b for getting back ,

I tried as you suggested , below is my modified config ,

        advancedConfig:
          nessie.catalog.default-warehouse: nessie_iceberg
          nessie.catalog.warehouses.nessie_iceberg.location: s3://dip/nessie_iceberg
          nessie.catalog.service.s3.buckets.nessie_iceberg.region: us-east-1
          nessie.catalog.service.s3.buckets.nessie_iceberg.endpoint: http://minio.{{ .Values.minio.namespace }}:9000
          nessie.catalog.service.s3.buckets.nessie_iceberg.path-style-access: true
#          nessie.catalog.service.s3.buckets.nessie_iceberg.access-key: urn:nessie-secret:quarkus:minio-creds
#          minio-creds.name: access_key_id
#          minio-creds.secret: secret_access_key
          nessie.catalog.service.s3.default-options.region: us-east-1
          nessie.catalog.service.s3.default-options.endpoint: http://minio.{{ .Values.minio.namespace }}:9000
          nessie.catalog.service.s3.default-options.path-style-access: true
          nessie.catalog.service.s3.default-options.access-key: urn:nessie-secret:quarkus:minio-creds
        extraEnv:
          - name: nessie.catalog.service.s3.buckets.nessie_iceberg.access-key.name
            valueFrom:
              secretKeyRef:
                name: minio-creds
                key: access_key_id
          - name: nessie.catalog.service.s3.buckets.nessie_iceberg.access-key.secret
            valueFrom:
              secretKeyRef:
                name: minio-creds
                key: secret_access_key

My chart gets deployed , but when i try to create Iceberg Table i get error

pyiceberg.exceptions.BadRequestError: IllegalArgumentException: Location for ICEBERG_TABLE 'nessie_iceberg.taxi_dataset' cannot be associated with any configured object storage location: Missing access key and secret for STATIC authentication mode

which is suggesting to me that somehow my access key and secret are not getting set for the warehouse bucket .

Below is the python code i am using to connect and create table

from pyiceberg.catalog import load_catalog
from pyiceberg.catalog.rest import RestCatalog
import pyarrow.parquet as pq


catalog = load_catalog("rest",
                       **{"uri": "http://10.152.183.167:19120/iceberg",
                           "ref": "main",
                           # "s3.path-style-access": "true",
                           # "s3.endpoint": "http://10.152.183.114:9000",
                           # "s3.access-key-id": "service_acct",
                           # "s3.secret-access-key": "console123",
                           "warehouse": "s3://dip/nessie_iceberg",
                          },
                       )

print(catalog.list_tables(namespace="pipeline"))


df = pq.read_table("yellow_tripdata_2023-01.parquet")

print(df)
# catalog.create_namespace("nessie_iceberg")

table = catalog.create_table(
    "nessie_iceberg.taxi_dataset",
    schema=df.schema,
    # location="s3://dip/nessie_iceberg"
)

table.append(df)
len(table.scan().to_arrow())

could you suggest if i am missing something ?

[dimas-b]

The Missing access key and secret for STATIC ... seems to be a different problem.

Do you intend for the python client to have local S3 credentials or use credential vending?

Cf. https://projectnessie.org/nessie-latest/configuration/#s3-default-bucket-settings

[saikiran2603]

I was thinking the python client can use the S3 credentials from Nessie , the same way i could configure Trino via Iceberg Rest i think i can get around specifying credentials in both the cases am i correct ?

[dimas-b]

Nessie can do "credential vending" and "request signing". IDK whether the python client is able to use them, though.