Skip to content

Hive encryption nits #14659

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
huaxingao merged 6 commits into from
Apr 15, 2026
Merged

Hive encryption nits #14659

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8e980d5
Hive encryption clean-ups
Nov 22, 2025
a835b40
Fix tests
Nov 22, 2025
be2a7e5
Address review comments
Nov 23, 2025
a10b264
Merge
smaheshwar-pltr Dec 5, 2025
69c127a
Nit improvements
smaheshwar-pltr Dec 5, 2025
b989d51
Merge origin/main into hive-encryption-clean-ups
smaheshwar-pltr Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions hive-metastore/src/main/java/org/apache/iceberg/hive/HiveTableOperations.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,8 @@
import org.apache.iceberg.io.FileIO;
import org.apache.iceberg.io.LocationProvider;
import org.apache.iceberg.relocated.com.google.common.annotations.VisibleForTesting;
import org.apache.iceberg.relocated.com.google.common.collect.ImmutableMap;
import org.apache.iceberg.relocated.com.google.common.collect.Lists;
import org.apache.iceberg.relocated.com.google.common.collect.Maps;
import org.apache.iceberg.util.PropertyUtil;
import org.apache.thrift.TException;
import org.slf4j.Logger;
Expand Down Expand Up @@ -148,13 +148,15 @@ public EncryptionManager encryption() {
if (tableKeyId != null) {
if (keyManagementClient == null) {
throw new RuntimeException(
"Cant create encryption manager, because key management client is not set");
"Cannot create encryption manager without a key management client");

@smaheshwar-pltr smaheshwar-pltr Nov 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a nit, matching the "Cannot" language used elsewhere. (Not strongly opinionated though)

@smaheshwar-pltr smaheshwar-pltr Nov 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could take this further with maybe:

throw new RuntimeException(
    "Cannot create encryption manager without a key management client. Consider setting the '"
        + CatalogProperties.ENCRYPTION_KMS_IMPL + "' catalog property.");

However, this might be a bit premature

@smaheshwar-pltr smaheshwar-pltr Nov 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could also throw a different exception class here

@singhpk234 singhpk234 Nov 23, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IllegalArgs or a Precondition prompting the key to be set sounds reasonable to me

@huaxingao huaxingao Nov 23, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 to use IllegalArgumentException or Preconditions check.

@smaheshwar-pltr smaheshwar-pltr Nov 23, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks all, have made the change. You now get:

java.lang.IllegalArgumentException: Cannot create encryption manager without a key management client. Consider setting the 'encryption.kms-impl' catalog property
	at org.apache.iceberg.relocated.com.google.common.base.Preconditions.checkArgument(Preconditions.java:217)

}

Map<String, String> encryptionProperties = Maps.newHashMap();
encryptionProperties.put(TableProperties.ENCRYPTION_TABLE_KEY, tableKeyId);
encryptionProperties.put(
TableProperties.ENCRYPTION_DEK_LENGTH, String.valueOf(encryptionDekLength));
Map<String, String> encryptionProperties =
ImmutableMap.of(

@smaheshwar-pltr smaheshwar-pltr Nov 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In #13225, I felt like ImmutableMap.of would be more natural here

TableProperties.ENCRYPTION_TABLE_KEY,
tableKeyId,
TableProperties.ENCRYPTION_DEK_LENGTH,
String.valueOf(encryptionDekLength));

List<EncryptedKey> keys = Lists.newLinkedList();
encryptedKeysFromMetadata.ifPresent(keys::addAll);
Expand Down Expand Up @@ -321,7 +323,8 @@ protected void doCommit(TableMetadata base, TableMetadata metadata) {
}

if (removedProps.contains(TableProperties.ENCRYPTION_TABLE_KEY)) {
throw new RuntimeException("Cannot remove key in encrypted table");
throw new IllegalArgumentException(

@smaheshwar-pltr smaheshwar-pltr Nov 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This follows the discussion #13225 (comment). To me, IllegalArgumentException makes sense

"Cannot remove encryption key ID from an encrypted table");
}

HMSTablePropertyHelper.updateHmsTableForIcebergTable(
Expand Down
Loading