Assigning permissions for a catalog

To grant access to Iceberg REST Catalog, assign a role to an existing user, group, or service account. There is no need to create a separate catalog account.

If the user or group has not yet been created, follow the Create user or Create group instructions. You can create a Kubernetes service account using the kubectl create service account <service_account_name> -n <namespace> command.

Using the CLIUsing the CLI

1. Create a file named stacklandrestcatalogaccessbinding.yaml with the StacklandRestCatalogAccessBinding resource configuration. Select one manifest option based on required access scope:

   Folder

   Namespace

   Table

   Visualization

   apiVersion: stacklandrestcatalog.stackland.yandex.cloud/v1alpha1
   kind: StacklandRestCatalogAccessBinding
   metadata:
     name: analytics-reader
   spec:
     catalogRef: analytics
     subject:
       kind: User
       name: analytics-user
     catalog:
       role: reader
   

   apiVersion: stacklandrestcatalog.stackland.yandex.cloud/v1alpha1
   kind: StacklandRestCatalogAccessBinding
   metadata:
     name: analytics-reader
   spec:
     catalogRef: analytics
     subject:
       kind: User
       name: analytics-user
     namespace:
       namespacePath: [sales, reports]
       role: reader
   

   apiVersion: stacklandrestcatalog.stackland.yandex.cloud/v1alpha1
   kind: StacklandRestCatalogAccessBinding
   metadata:
     name: analytics-reader
   spec:
     catalogRef: analytics
     subject:
       kind: User
       name: analytics-user
     table:
       namespacePath: [sales, reports]
       name: orders
       role: reader
   

   apiVersion: stacklandrestcatalog.stackland.yandex.cloud/v1alpha1
   kind: StacklandRestCatalogAccessBinding
   metadata:
     name: analytics-reader
   spec:
     catalogRef: analytics
     subject:
       kind: User
       name: analytics-user
     view:
       namespacePath: [sales, reports]
       name: recent_orders
       role: reader
   

   In all examples, the user named analytics-user gets the reader role for the selected analytics catalog object. Replace the username and object details with the right ones. The Iceberg namespace in the examples consists of two segments: sales and reports.

   Parameters:

   • spec.catalogRef: StacklandRestCatalog resource name in the same namespace where the permission assignment is being created.
   • spec.subject.kind: Role recipient type: User, Group, or ServiceAccount.
   • spec.subject.name: User, group, or service account name. For User, you can specify an ID in spec.subject.id instead of a name.
   • spec.subject.namespace: Service account namespace. Required if kind: ServiceAccount.
   • role under spec.catalog, spec.namespace, spec.table, or spec.view: Role for the selected object, auditor, viewer, reader, writer, editor, or admin.

   To assign a role for a specific Iceberg namespace, table, or view, specify the appropriate scope instead of spec.catalog. You can specify only one area and one role in a single resource.

2. Apply the manifest:

   kubectl apply -f stacklandrestcatalogaccessbinding.yaml -n <namespace>
   

3. Check the permission assignment status:

   kubectl get stacklandrestcatalogaccessbinding analytics-reader -n <namespace>
   

   Wait for the ready status in the Phase column. If the required Iceberg namespace, table, or view has not yet been created, the assignment remains in the pendingResources status. If unable to determine the role recipient, the assignment remains in the pending status.

To assign another role or grant access to another recipient, create a separate StacklandRestCatalogAccessBinding resource.

Using the management consoleUsing the management console

You can assign a role to a user or group via the management console. For a service account, use the CLI.

1. Open the project and select the catalog’s namespace.

2. In the left-hand menu, select REST Catalog → Catalogs.

3. Open the catalog and go to the Access tab.

4. Click Grant access.

5. Fill out the fields as follows:

   • Name: Name of the permission assignment, unique within the namespace.
   • Subject: User or group you need to grant access to.
   • Target: Catalog, Namespace, Table, or View.
   • Catalog namespace: Path to the Iceberg namespace. Mandatory for all targets except a catalog. Enter non-empty segments separated by /, e.g., sales/reports. No points are permitted inside segments.
   • Table name or View name: Name of the object for the relevant target.
   • Access level: auditor, viewer, reader, writer, editor, or admin role.

6. Click Grant access. The new assignment will appear on the Access tab.

One assignment grants one role for one object. Create a separate assignment for a different role or object.

Editing a permission assignmentEditing a permission assignment

You can change the role or scope of access for an existing assignment. To select a different catalog, user, or group, revoke the assignment and create a new one.

Using the CLIUsing the CLI

1. Open the resource for editing:

   kubectl edit stacklandrestcatalogaccessbinding <assignment_name> -n <namespace>
   

2. Change the role or access scope section. Exactly one section must remain in spec: catalog, namespace, table, or view.

3. Save the changes and wait for the ready status.

Using the management consoleUsing the management console

1. On the catalog's Access tab, open the assignment and click Edit.
2. Change the Target, Iceberg namespace path, object name, or Access level. The Name and Subject fields are read-only.
3. Click Save and wait for the changes to be applied.