Creating a catalog user
A Iceberg REST Catalog catalog user is an account with OAuth2 access. Create a user in a project with an existing catalog.
-
Create the
RestCatalogPrincipalresource file, e.g., using thetouch restcatalogprincipal.yamlcommand. -
Open the file and paste the configuration below into it. Along with the user, create an OAuth2 credentials secret:
apiVersion: restcatalog.stackland.yandex.cloud/v1alpha1 kind: RestCatalogPrincipal metadata: name: analytics-service-account # Catalog user name; unique within the cluster spec: catalog: analytics # Catalog (RestCatalog.metadata.name) name in the same project principalRoles: # Names of user groups from the catalog's declaredPrincipalRoles - analytics-admin credentialsSecretRef: name: analytics-principal-credentials # Link to secret with OAuth2 credentials --- apiVersion: v1 kind: Secret metadata: name: analytics-principal-credentials type: Opaque stringData: clientId: analytics-service-account # Matches the catalog user name clientSecret: <client_secret> # Set by administratorFollow these requirements:
spec.catalogmust refer to an existing catalog namedRestCatalogin the same project.- The names in
spec.principalRolesmust be on thespec.declaredPrincipalRoleslist of user groups of that catalog.
-
Apply the manifest:
kubectl apply -f restcatalogprincipal.yaml -n <project_name>. Optionally, you can specify the project name in themetadata.namespaceresource property and skip it in the command.
-
If you have not opened a project yet, select one.
-
In the left-hand menu, select Iceberg REST Catalog.
-
In the Catalogs tab, select the catalog.
-
Go to the Users tab.
-
Click Create user.
-
Fill out the fields as follows:
- Name: Catalog user name. Once created, the name never changes.
- Client ID: Matches the user name and cannot be changed.
- Client secret: Specify the OAuth2 secret.
- List of roles: Select one or more catalog user groups.
-
Click Create.