Connect Doris to Iceberg REST

Apache Gravitino exposes an Iceberg REST catalog (IRC) endpoint that any Iceberg-compatible engine can connect to directly. Apache Doris connects to it with an Iceberg catalog of type rest. No Gravitino engine connector is needed; the engine connectors are only for the Gravitino REST interface.

Quick start

The example signs in with OAuth client credentials, connects to the Gravitino catalog sales_lake as the Doris catalog sales, and reads storage through vended credentials, which needs Doris 3.1.0 or later.

Create the catalog and query a table
CREATE CATALOG sales PROPERTIES (
    "type"                                    = "iceberg",
    "iceberg.catalog.type"                    = "rest",
    "iceberg.rest.uri"                        = "https://{iceberg_host}/iceberg",
    "warehouse"                               = "sales_lake",
    "iceberg.rest.security.type"              = "oauth2",
    "iceberg.rest.oauth2.credential"          = "{client_id}:{client_secret}",
    "iceberg.rest.oauth2.server-uri"          = "{token_endpoint_uri}",
    "iceberg.rest.oauth2.scope"               = "{scope}",
    "iceberg.rest.vended-credentials-enabled" = "true"
);

SWITCH sales;
SHOW DATABASES;
SELECT * FROM q4.leads LIMIT 10;

The catalog must vend credentials for the read to reach storage; see Credential vending.

Prerequisites

Apache Gravitino running with the Iceberg REST service enabled. See Iceberg REST catalog service for setup instructions.
The Iceberg REST service published and reachable from your Doris environment. See Client access.

Configuration

The catalog in the Quick start connects with OAuth client credentials and reads storage through vended credentials, both of which need Doris 3.1.0 or later. Every request to the IRC needs an identity; a request with none is rejected with 401.

warehouse is the name of the Gravitino catalog to connect to, not a storage path. Without it, the service serves its default catalog, if one is set; see Select a catalog. To use a token you already hold, set iceberg.rest.oauth2.token in place of the credential, server URI and scope.

Without iceberg.rest.vended-credentials-enabled, Doris reads storage with its own keys, set as s3.endpoint, s3.region, s3.access_key and s3.secret_key.

Gravitino catalogs with nested namespaces need iceberg.rest.nested-namespace-enabled set to true and SET GLOBAL enable_nested_namespace=true; in Doris, on Doris 3.1.2 or later.

Examples

Create and query a table
SWITCH sales;
CREATE DATABASE db;
USE db;
CREATE TABLE t(a int);
INSERT INTO t VALUES (1);
SELECT * FROM t;

Gravitino connector vs. Iceberg REST

Feature	Gravitino engine connector	Iceberg REST
Engine plugin required	Yes	No
Gravitino access control	Yes	Yes
Supported engines	Trino, Spark, Flink, Daft	Any Iceberg-compatible engine
Credential vending	Varies	Yes (S3, GCS, OSS, ADLS)

Quick start​

Prerequisites​

Configuration​

Examples​

Gravitino connector vs. Iceberg REST​

Related​

Quick start

Prerequisites

Configuration

Examples

Gravitino connector vs. Iceberg REST

Related