Iceberg REST clients
Iceberg REST clients connect directly to the Iceberg REST catalog service (IRC) on port 9001, not to the Gravitino server API. Each one uses the Iceberg REST catalog support it already has, so nothing from Datastrato is installed into the engine. The engine sees the Iceberg catalogs of the one metalake the IRC serves, and no other catalog types; Hive, JDBC and Paimon catalogs need a Gravitino connector instead.
Gravitino authorizes every IRC request as the identity in the engine's catalog configuration, with the same privileges as the rest of the product, and vends short-lived storage credentials per table when the catalog has credential vending configured.
Quick start
- Get the IRC address. Engines outside the cluster use the published address,
https://{iceberg_host}/iceberg; the engine's Iceberg client adds/v1itself. See Client access. - Choose the identity the engine signs in with, either a service user shared by everyone on the engine or each person's own sign-in. The engine's page covers both where the engine supports them.
- Configure the engine's Iceberg REST catalog with the address, the identity, and the Gravitino catalog name as the warehouse, following the engine's page.
- Grant access. Reading a table takes
USE_CATALOG,USE_SCHEMAandSELECT_TABLE; writing takesMODIFY_TABLEin place ofSELECT_TABLE. See Roles.
Engine pages cover Trino and Starburst, Spark, Flink, Snowflake, DuckDB, Doris, StarRocks, PyIceberg and Ray. Trino, Spark and Flink can also connect through their Gravitino connectors; the choice between the two paths is covered in How engines connect.