Requires Docker to be available (Testcontainers starts Keycloak in a container). + * + *
Verifies:
+ * - Accepts valid JWT tokens from Keycloak
+ * - Rejects invalid/malformed tokens
+ * - Rejects requests without a Bearer token
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(
+ classes = BaseStandaloneRESTCatalogServerTest.TestRestCatalogApplication.class,
+ webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+ properties = {
+ "spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration"
+ }
+)
+@ContextConfiguration(initializers = TestStandaloneRESTCatalogServerJwtAuth.RestCatalogJwtTestContextInitializer.class)
+@TestExecutionListeners(
+ listeners = {
+ BaseStandaloneRESTCatalogServerTest.HmsStartupListener.class,
+ TestStandaloneRESTCatalogServerJwtAuth.KeycloakStartupListener.class
+ },
+ mergeMode = TestExecutionListeners.MergeMode.MERGE_WITH_DEFAULTS
+)
+public class TestStandaloneRESTCatalogServerJwtAuth extends BaseStandaloneRESTCatalogServerTest {
+ @LocalServerPort
+ private int port;
+
+ @Autowired
+ private StandaloneRESTCatalogServer server;
+
+ private static OAuth2AuthorizationServer authorizationServer;
+
+ @Override
+ protected int getPort() {
+ return port;
+ }
+
+ @Order(Ordered.HIGHEST_PRECEDENCE - 1)
+ public static class KeycloakStartupListener implements TestExecutionListener {
+ @Override
+ public void beforeTestClass(TestContext testContext) throws Exception {
+ if (authorizationServer != null) {
+ return;
+ }
+ // Use accessTokenHeaderTypeRfc9068=false so Keycloak emits "JWT" (not "at+jwt") in the token
+ // header - SimpleJWTAuthenticator accepts null and JWT but not "at+jwt" by default.
+ authorizationServer = new OAuth2AuthorizationServer(
+ org.testcontainers.containers.Network.newNetwork(), false);
+ authorizationServer.start();
+ LOG.info("Started Keycloak authorization server at {}", authorizationServer.getIssuer());
+ }
+ }
+
+ public static class RestCatalogJwtTestContextInitializer
+ implements ApplicationContextInitializer
This server runs independently of HMS and provides a REST API for Iceberg catalog operations. * It connects to an external HMS instance via Thrift. @@ -46,85 +42,50 @@ * *
Multiple instances can run behind a Kubernetes Service for load balancing.
*/
+@SpringBootApplication(exclude = DataSourceAutoConfiguration.class)
public class StandaloneRESTCatalogServer {
private static final Logger LOG = LoggerFactory.getLogger(StandaloneRESTCatalogServer.class);
private final Configuration conf;
- private Server server;
+ private String restEndpoint;
private int port;
- public StandaloneRESTCatalogServer(Configuration conf) {
- this.conf = conf;
- }
-
/**
- * Starts the standalone REST Catalog server.
+ * Constructor that accepts Configuration.
+ * Standard Hive approach - caller controls Configuration creation.
*/
- public void start() {
+ public StandaloneRESTCatalogServer(Configuration conf) {
+ this.conf = conf;
+
// Validate required configuration
String thriftUris = MetastoreConf.getVar(conf, ConfVars.THRIFT_URIS);
if (thriftUris == null || thriftUris.isEmpty()) {
throw new IllegalArgumentException("metastore.thrift.uris must be configured to connect to HMS");
}
- int servletPort = MetastoreConf.getIntVar(conf, ConfVars.CATALOG_SERVLET_PORT);
- String servletPath = MetastoreConf.getVar(conf, ConfVars.ICEBERG_CATALOG_SERVLET_PATH);
-
- if (servletPath == null || servletPath.isEmpty()) {
- servletPath = "iceberg"; // Default path
- MetastoreConf.setVar(conf, ConfVars.ICEBERG_CATALOG_SERVLET_PATH, servletPath);
- }
-
- LOG.info("Starting Standalone REST Catalog Server");
+ LOG.info("Hadoop Configuration initialized");
LOG.info(" HMS Thrift URIs: {}", thriftUris);
- LOG.info(" Servlet Port: {}", servletPort);
- LOG.info(" Servlet Path: /{}", servletPath);
-
- // Create servlet using factory
- ServletServerBuilder.Descriptor catalogDescriptor = HMSCatalogFactory.createServlet(conf);
- if (catalogDescriptor == null) {
- throw new IllegalStateException("Failed to create REST Catalog servlet. " +
- "Check that metastore.catalog.servlet.port and metastore.iceberg.catalog.servlet.path are configured.");
- }
-
- // Create health check servlet
- HealthCheckServlet healthServlet = new HealthCheckServlet();
-
- // Build and start server
- ServletServerBuilder builder = new ServletServerBuilder(conf);
- builder.addServlet(catalogDescriptor);
- builder.addServlet(servletPort, "health", healthServlet);
-
- server = builder.start(LOG);
- if (server == null || !server.isStarted()) {
- // Server failed to start - likely a port conflict
- throw new IllegalStateException(String.format(
- "Failed to start REST Catalog server on port %d. Port may already be in use. ", servletPort));
+
+ if (LOG.isInfoEnabled()) {
+ LOG.info(" Warehouse: {}", MetastoreConf.getVar(conf, ConfVars.WAREHOUSE));
}
-
- // Get actual port (may be auto-assigned)
- port = catalogDescriptor.getPort();
- LOG.info("Standalone REST Catalog Server started successfully on port {}", port);
- LOG.info(" REST Catalog endpoint: http://localhost:{}/{}", port, servletPath);
- LOG.info(" Health check endpoint: http://localhost:{}/health", port);
}
/**
- * Stops the server.
+ * Updates port and restEndpoint with the actual server port once the web server has started.
+ * Handles RANDOM_PORT (tests) and server.port=0 where the real port differs from config.
*/
- public void stop() {
- if (server != null && server.isStarted()) {
- try {
- LOG.info("Stopping Standalone REST Catalog Server");
- server.stop();
- server.join();
- LOG.info("Standalone REST Catalog Server stopped");
- } catch (InterruptedException e) {
- Thread.currentThread().interrupt();
- LOG.warn("Server stop interrupted", e);
- } catch (Exception e) {
- LOG.error("Error stopping server", e);
+ @EventListener
+ public void onWebServerInitialized(WebServerInitializedEvent event) {
+ int actualPort = event.getWebServer().getPort();
+ if (actualPort > 0) {
+ this.port = actualPort;
+ String servletPath = MetastoreConf.getVar(conf, ConfVars.ICEBERG_CATALOG_SERVLET_PATH);
+ if (servletPath == null || servletPath.isEmpty()) {
+ servletPath = "iceberg";
}
+ this.restEndpoint = "http://localhost:" + actualPort + "/" + servletPath;
+ LOG.info("REST endpoint set to actual server port: {}", restEndpoint);
}
}
@@ -142,27 +103,7 @@ public int getPort() {
* @return the endpoint URL
*/
public String getRestEndpoint() {
- String servletPath = MetastoreConf.getVar(conf, ConfVars.ICEBERG_CATALOG_SERVLET_PATH);
- if (servletPath == null || servletPath.isEmpty()) {
- servletPath = "iceberg";
- }
- return "http://localhost:" + port + "/" + servletPath;
- }
-
- /**
- * Simple health check servlet for Kubernetes readiness/liveness probes.
- */
- private static final class HealthCheckServlet extends HttpServlet {
- @Override
- protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
- try {
- resp.setContentType("application/json");
- resp.setStatus(HttpServletResponse.SC_OK);
- resp.getWriter().println("{\"status\":\"healthy\"}");
- } catch (IOException e) {
- LOG.warn("Failed to write health check response", e);
- }
- }
+ return restEndpoint;
}
/**
@@ -183,26 +124,26 @@ public static void main(String[] args) {
}
}
+ // Sync port from MetastoreConf to Spring's Environment so server.port uses it
+ int port = MetastoreConf.getIntVar(conf, ConfVars.CATALOG_SERVLET_PORT);
+ if (port > 0) {
+ System.setProperty(ConfVars.CATALOG_SERVLET_PORT.getVarname(), String.valueOf(port));
+ }
+
StandaloneRESTCatalogServer server = new StandaloneRESTCatalogServer(conf);
+
+ // Start Spring Boot with pre-configured beans
+ SpringApplication app = new SpringApplication(StandaloneRESTCatalogServer.class, IcebergCatalogConfiguration.class);
+ app.addInitializers(ctx -> {
+ ctx.getBeanFactory().registerSingleton("hadoopConfiguration", conf);
+ ctx.getBeanFactory().registerSingleton("standaloneRESTCatalogServer", server);
+ });
- // Add shutdown hook
- Runtime.getRuntime().addShutdownHook(new Thread(() -> {
- LOG.info("Shutdown hook triggered");
- server.stop();
- }));
+ app.run(args);
- try {
- server.start();
- LOG.info("Server running. Press Ctrl+C to stop.");
-
- // Keep server running
- server.server.join();
- } catch (InterruptedException e) {
- Thread.currentThread().interrupt();
- LOG.warn("Server stop interrupted", e);
- } catch (Exception e) {
- LOG.error("Failed to start server", e);
- System.exit(1);
- }
+ LOG.info("Standalone REST Catalog Server started successfully");
+ LOG.info("Server running. Press Ctrl+C to stop.");
+
+ // Spring Boot's graceful shutdown will handle cleanup automatically
}
}
diff --git a/standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/standalone/health/HMSReadinessHealthIndicator.java b/standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/standalone/health/HMSReadinessHealthIndicator.java
new file mode 100644
index 000000000000..252a3d298b2b
--- /dev/null
+++ b/standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/standalone/health/HMSReadinessHealthIndicator.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.iceberg.rest.standalone.health;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.hive.metastore.HiveMetaStoreClient;
+import org.apache.hadoop.hive.metastore.conf.MetastoreConf;
+import org.apache.hadoop.hive.metastore.conf.MetastoreConf.ConfVars;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.actuate.health.Health;
+import org.springframework.boot.actuate.health.HealthIndicator;
+import org.springframework.stereotype.Component;
+
+/**
+ * Custom health indicator for HMS connectivity.
+ * Verifies that HMS is reachable via Thrift, not just that configuration is present.
+ * Used by Kubernetes readiness probes to determine if the server is ready to accept traffic.
+ */
+@Component
+public class HMSReadinessHealthIndicator implements HealthIndicator {
+ private static final Logger LOG = LoggerFactory.getLogger(HMSReadinessHealthIndicator.class);
+
+ private final Configuration conf;
+
+ public HMSReadinessHealthIndicator(Configuration conf) {
+ this.conf = conf;
+ }
+
+ @Override
+ public Health health() {
+ String hmsThriftUris = MetastoreConf.getVar(conf, ConfVars.THRIFT_URIS);
+ if (hmsThriftUris == null || hmsThriftUris.isEmpty()) {
+ return Health.down()
+ .withDetail("reason", "HMS Thrift URIs not configured")
+ .build();
+ }
+
+ try (HiveMetaStoreClient client = new HiveMetaStoreClient(conf)) {
+ // Lightweight call to verify HMS is reachable
+ client.getAllDatabases();
+ return Health.up()
+ .withDetail("hmsThriftUris", hmsThriftUris)
+ .withDetail("warehouse", MetastoreConf.getVar(conf, ConfVars.WAREHOUSE))
+ .build();
+ } catch (Exception e) {
+ LOG.warn("HMS connectivity check failed: {}", e.getMessage());
+ return Health.down()
+ .withDetail("hmsThriftUris", hmsThriftUris)
+ .withDetail("error", e.getMessage())
+ .build();
+ }
+ }
+}
diff --git a/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml b/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml
new file mode 100644
index 000000000000..99aec2c763f8
--- /dev/null
+++ b/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml
@@ -0,0 +1,61 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Spring Boot Configuration for Standalone HMS REST Catalog Server
+
+# Server configuration
+# Port is set via MetastoreConf.CATALOG_SERVLET_PORT
+server:
+ port: ${metastore.catalog.servlet.port:8080}
+ shutdown: graceful
+spring:
+ lifecycle:
+ timeout-per-shutdown-phase: 30s
+
+# Actuator endpoints for Kubernetes
+management:
+ endpoints:
+ web:
+ exposure:
+ include: health,prometheus,info
+ endpoint:
+ health:
+ show-details: always
+ probes:
+ enabled: true
+ health:
+ livenessState:
+ enabled: true
+ readinessState:
+ enabled: true
+ metrics:
+ export:
+ prometheus:
+ enabled: true
+
+# Logging
+logging:
+ level:
+ org.apache.iceberg.rest.standalone: INFO
+ org.apache.hadoop.hive.metastore: INFO
+ org.springframework.boot: WARN
+
+# Application info
+info:
+ app:
+ name: Standalone HMS REST Catalog Server
+ description: Standalone REST Catalog Server for Apache Hive Metastore
+ version: "@project.version@"
diff --git a/standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/auth/jwt/SimpleJWTAuthenticator.java b/standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/auth/jwt/SimpleJWTAuthenticator.java
index a6e85def82c3..45fc4d337a76 100644
--- a/standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/auth/jwt/SimpleJWTAuthenticator.java
+++ b/standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/auth/jwt/SimpleJWTAuthenticator.java
@@ -38,7 +38,10 @@
public class SimpleJWTAuthenticator {
private static final Logger LOG = LoggerFactory.getLogger(SimpleJWTAuthenticator.class.getName());
- private static final Set