not authorized for op CREATE_TABLE_DIRECT_WITH_WRITE_DELEGATION

[melin]

2026-07-31 09:02:59,027 INFO [org.apa.pol.ser.exc.IcebergExceptionMapper] [f9fcc048-190f-4a7d-b0b1-a59440b17655_0000000000000000070,default-realm] [,,,] (executor-thread-2) Handling runtimeException Principal 'root' with activated PrincipalRoles '[service_admin]' and activated grants via '[service_admin, catalog_admin]' is not authorized for op CREATE_TABLE_DIRECT_WITH_WRITE_DELEGATION

object SparkPolarisSqlTest {

  // https://github.com/aliyun/datalake-catalog-metastore-client/blob/master/README-CN.md
  def main(args: Array[String]): Unit = {
    val spark = SparkSession.builder()
      .master("local")
      .config("spark.serializer", "org.apache.spark.serializer.KryoSerializer")

      .config("spark.sql.catalog.polaris", "org.apache.polaris.spark.SparkCatalog")
      .config("spark.sql.catalog.polaris.uri", "http://172.88.0.153:32122/api/catalog")
      .config("spark.sql.catalog.polaris.token-refresh-enabled", "true")
      .config("spark.sql.catalog.polaris.credential", "polaris:polaris2026")
      .config("spark.sql.catalog.polaris.warehouse", "minio_catalog")
      .config("spark.sql.catalog.polaris.scope", "PRINCIPAL_ROLE:ALL")
      .config("spark.sql.catalog.polaris.header.X-Iceberg-Access-Delegation", "vended-credentials")
      .config("spark.sql.catalog.polaris.rest.auth.type", "oauth2")
      .config("spark.sql.catalog.polaris.oauth2-server-uri", "http://172.88.0.153:32122/api/catalog/v1/oauth/tokens")
      .getOrCreate()

    spark.sql("USE polaris")
    spark.sql("CREATE NAMESPACE IF NOT EXISTS iceberg_demos")
    spark.sql("USE NAMESPACE iceberg_demos")
    spark.sql("""CREATE TABLE IF NOT EXISTS PEOPLE (
                   id int, name string)
                  USING iceberg;
                """)
  }

}

TOKEN=$(curl -s -v -o /tmp/token.json -w "%{http_code}" \
  -X POST http://172.88.0.153:32122/api/catalog/v1/oauth/tokens \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=polaris&client_secret=polaris2026&scope=PRINCIPAL_ROLE:ALL")

echo "HTTP $TOKEN"
TOKEN=$(jq -r '.access_token' /tmp/token.json)
echo "Token: $TOKEN"


CREDS=$(curl -s -v -X POST http://172.88.0.153:32122/api/management/v1/principals \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -o /tmp/principal.json -w "%{http_code}" \
  -d '{
    "name": "superior-principal",
    "type": "SERVICE"
  }')

echo "HTTP $CREDS"

SUPERIOR_CLIENT_ID=$(jq -r '.credentials.clientId' /tmp/principal.json)
SUPERIOR_CLIENT_SECRET=$(jq -r '.credentials.clientSecret' /tmp/principal.json)

echo "Superior Client ID:     $SUPERIOR_CLIENT_ID"
echo "Superior Client Secret: $SUPERIOR_CLIENT_SECRET"

create catalog

curl -X POST http://172.88.0.153:32122/api/management/v1/catalogs \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{
    "name": "minio_catalog",
    "type": "INTERNAL",
    "properties": {
      "default-base-location": "s3://cyberengine/polaris-iceberg"
    },
    "storageConfigInfo": {
      "storageType": "S3",
      "allowedLocations": ["s3://cyberengine"],
      "endpoint": "http://172.18.6.181:9330",
      "endpointInternal": "http://172.18.6.181:9330",
      "pathStyleAccess": true,
      "stsUnavailable": true,
      "region": "us-east-1"
    }
  }'

Create a principal role

# 4a. Create a principal role
curl -X POST "http://172.88.0.153:32122/api/management/v1/principal-roles" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{"principalRole": {"name": "superior-role"}}'

# 4b. Create a catalog role inside minio_catalog
curl -X POST "http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{"catalogRole": {"name": "superior-catalog-role"}}'

# 4c. Grant CATALOG_MANAGE_CONTENT privilege to the catalog role
curl -X PUT "http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles/superior-catalog-role/grants" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{"grant": {"type": "catalog", "privilege": "CATALOG_MANAGE_CONTENT"}}'
 
curl -v -X PUT "http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles/superior-catalog-role/grants" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{"grant": {"type": "catalog", "privilege": "TABLE_CREATE"}}' 

# 4d. Assign the catalog role to the principal role
curl -X PUT "http://172.88.0.153:32122/api/management/v1/principal-roles/superior-role/catalog-roles/minio_catalog" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{"catalogRole": {"name": "superior-catalog-role"}}'

# 4e. Assign the principal role to the superior principal
curl -X PUT "http://172.88.0.153:32122/api/management/v1/principals/superior-principal/principal-roles" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{"principalRole": {"name": "superior-role"}}'
  

Create a namespace

curl -X POST "http://172.88.0.153:32122/api/catalog/v1/minio_catalog/namespaces" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -w "\nHTTP %{http_code}" \
  -d '{
    "namespace": ["demo"],
    "properties": {
      "location": "s3://cyberengine/polaris-iceberg/demo"
    }
  }'

---
apiVersion: v1
kind: Secret
metadata:
  name: polaris-postgresql-secret
  namespace: polaris
  labels:
    app.kubernetes.io/name: polaris
type: Opaque
data:
  username: cG9zdGdyZXM=
  password: MTIzNDU2
  jdbcUrl: amRiYzpwb3N0Z3Jlc3FsOi8vMTcyLjE4LjEuMTkyOjU1MzIvcG9zdGdyZXM=

---
kind: Secret
apiVersion: v1
metadata:
  name: polaris-minio-secret
  namespace: polaris
  labels:
    app.kubernetes.io/name: polaris
type: Opaque
data:
  awsAccessKeyId: TWN2Vm5wT3ppVnNXdjdRbHl1dDc=
  awsSecretAccessKey: UGJJQ2JRDkg3aXlxMFB1ZWZIYTM4M1lvcUpuM0pDamVkUUhTWW1icA==

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: polaris
  namespace: polaris
  labels:
    app.kubernetes.io/instance: polaris
    app.kubernetes.io/name: polaris
    app.kubernetes.io/version: 1.6.0
data:
  application.properties: >-
    polaris.authentication.authenticator.type=default
    
    polaris.authentication.token-broker.max-token-generation=PT1H
    
    polaris.authentication.token-broker.type=rsa-key-pair
    
    polaris.authentication.token-service.type=default
    
    polaris.authentication.type=internal
    
    polaris.features."SUPPORTED_CATALOG_STORAGE_TYPES"=["S3","GCS","AZURE"]
    
    polaris.file-io.type=default
    
    polaris.log.request-id-header-name=X-Request-ID
    
    polaris.persistence.auto-bootstrap-types=relational-jdbc
    
    polaris.persistence.type=relational-jdbc
    
    polaris.rate-limiter.filter.type=no-op
    
    polaris.realm-context.realms=default-realm
    
    polaris.realm-context.type=default
    
    quarkus.http.access-log.enabled=true
    
    quarkus.http.port=8181
    
    quarkus.log.category."org.apache.iceberg.rest".level=INFO
    
    quarkus.log.category."org.apache.polaris".level=INFO
    
    quarkus.log.console.enabled=true
    
    quarkus.log.console.format=%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] [%X{requestId},%X{realmId}] [%X{traceId},%X{parentId},%X{spanId},%X{sampled}] (%t) %s%e%n
    
    quarkus.log.console.level=ALL
    
    quarkus.log.file.enabled=false
    
    quarkus.log.level=INFO
    
    quarkus.management.port=8182
    
    quarkus.otel.sdk.disabled=true
    
    quarkus.http.cors.enabled=true
    
    quarkus.http.cors.origins=http://172.18.5.44:31358
    
    quarkus.http.cors.methods=GET,POST,PUT,DELETE,PATCH,OPTIONS
    
    quarkus.http.cors.headers=*
    
    quarkus.http.cors.exposed-headers=*
    
    quarkus.http.cors.access-control-allow-credentials=true
    
    quarkus.http.cors.access-control-max-age=PT10M

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: polaris
  namespace: polaris
  labels:
    app.kubernetes.io/instance: polaris
    app.kubernetes.io/name: polaris
    app.kubernetes.io/version: 1.6.0
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: polaris
      app.kubernetes.io/name: polaris
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: polaris
        app.kubernetes.io/name: polaris
    spec:
      volumes:
        - name: config-volume
          projected:
            sources:
              - configMap:
                  name: polaris
                  items:
                    - key: application.properties
                      path: application.properties
            defaultMode: 420
        - name: temp-dir
          emptyDir: {}
      containers:
        - name: polaris
          image: docker.1ms.run/apache/polaris:1.6.0
          ports:
            - name: polaris-http
              containerPort: 8181
              protocol: TCP
            - name: polaris-mgmt
              containerPort: 8182
              protocol: TCP
          env:
            # https://polaris.apache.org/blog/2026/04/04/build-a-local-open-data-lakehouse-with-k3d-apache-ozone-apache-polaris-and-trino/
            - name: POLARIS_BOOTSTRAP_CREDENTIALS
              value: "default-realm,polaris,polaris2026"
            - name: QUARKUS_DATASOURCE_DB_KIND
              value: "postgresql"
            - name: AWS_REGION
              value: us-east-1
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: polaris-minio-secret
                  key: awsAccessKeyId
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: polaris-minio-secret
                  key: awsSecretAccessKey
            - name: quarkus.datasource.username
              valueFrom:
                secretKeyRef:
                  name: polaris-postgresql-secret
                  key: username
            - name: quarkus.datasource.password
              valueFrom:
                secretKeyRef:
                  name: polaris-postgresql-secret
                  key: password
            - name: quarkus.datasource.jdbc.url
              valueFrom:
                secretKeyRef:
                  name: polaris-postgresql-secret
                  key: jdbcUrl
          volumeMounts:
            - name: config-volume
              readOnly: true
              mountPath: /deployments/config
            - name: temp-dir
              mountPath: /tmp
          livenessProbe:
            httpGet:
              path: /q/health/live
              port: polaris-mgmt
              scheme: HTTP
            initialDelaySeconds: 5
            timeoutSeconds: 10
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
            terminationGracePeriodSeconds: 30
          readinessProbe:
            httpGet:
              path: /q/health/ready
              port: polaris-mgmt
              scheme: HTTP
            initialDelaySeconds: 5
            timeoutSeconds: 10
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          imagePullPolicy: Always
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%

---
kind: Service
apiVersion: v1
metadata:
  name: polaris
  namespace: polaris
  labels:
    app.kubernetes.io/instance: polaris
    app.kubernetes.io/name: polaris
    app.kubernetes.io/version: 1.6.0
spec:
  ports:
    - name: polaris-http
      protocol: TCP
      port: 8181
      targetPort: 8181
      nodePort: 32122
  selector:
    app.kubernetes.io/instance: polaris
    app.kubernetes.io/name: polaris
  type: NodePort

---
kind: Service
apiVersion: v1
metadata:
  name: polaris-mgmt
  namespace: polaris
  labels:
    app.kubernetes.io/instance: polaris
    app.kubernetes.io/name: polaris
    app.kubernetes.io/version: 1.6.0
spec:
  ports:
    - name: polaris-mgmt
      protocol: TCP
      port: 8182
      targetPort: 8182
      nodePort: 30895
  selector:
    app.kubernetes.io/instance: polaris
    app.kubernetes.io/name: polaris
  type: NodePort