Skip to content

fix: Preserve table privileges on Iceberg HMS/file metastore commit#29166

Open
laserninja wants to merge 1 commit intotrinodb:masterfrom
laserninja:fix/29160-preserve-table-privileges-on-alter
Open

fix: Preserve table privileges on Iceberg HMS/file metastore commit#29166
laserninja wants to merge 1 commit intotrinodb:masterfrom
laserninja:fix/29160-preserve-table-privileges-on-alter

Conversation

@laserninja
Copy link
Copy Markdown
Contributor

Previously, every ALTER or DML commit on an Iceberg table backed by HMS (or file metastore) rebuilt PrincipalPrivileges from scratch using only the table owner, silently wiping any grants made via GRANT ... TO USER.

Read the existing privileges from the metastore via listTablePrivileges and pass them through to replaceTable so that object-level grants survive table metadata updates.

Fixes #29160

@cla-bot cla-bot Bot added the cla-signed label Apr 19, 2026
@github-actions github-actions Bot added the iceberg Iceberg connector label Apr 19, 2026
Copy link
Copy Markdown
Member

@ebyhr ebyhr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a test?

Please follow the commit message guideline and the PR template.

Previously, every ALTER or DML commit on an Iceberg table backed by HMS
or file metastore rebuilt PrincipalPrivileges from scratch using only the
table owner, silently wiping any grants made via GRANT ... TO USER.

Read the existing privileges from the metastore via listTablePrivileges
and pass them through to replaceTable so that object-level grants survive
table metadata updates.
@laserninja laserninja force-pushed the fix/29160-preserve-table-privileges-on-alter branch from d874250 to 1ca8651 Compare April 21, 2026 04:37
@laserninja
Copy link
Copy Markdown
Contributor Author

Done, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-signed iceberg Iceberg connector

Development

Successfully merging this pull request may close these issues.

Iceberg HMS/Glue commit replaces table privileges on every ALTER

2 participants