Skip to content

feat(iceberg): add Apache Iceberg provider#740

Merged
fhussonnois merged 7 commits intomainfrom
feat/iceberg-provider
Apr 4, 2026
Merged

feat(iceberg): add Apache Iceberg provider#740
fhussonnois merged 7 commits intomainfrom
feat/iceberg-provider

Conversation

@fhussonnois
Copy link
Copy Markdown
Member

Summary

  • Add a new Jikkou provider for managing Apache Iceberg tables and namespaces declaratively using Jikkou's Resource-as-Code model
  • Support full schema evolution (column add/update/delete, type promotion, rename via previousName), partition spec evolution, sort order replacement, and table property management
  • Support multiple catalog backends: REST, Hive, JDBC, AWS Glue, Nessie, Hadoop
  • Include safety controls: delete-orphans, delete-orphan-columns, delete-purge, and tables.deletion.exclude regex patterns
  • Add comprehensive documentation and a full demo with Nessie and SeaweedFS

Resources

  • IcebergNamespace: CRUD for catalog namespaces with property management
  • IcebergTable: full lifecycle including schema evolution, partition spec, sort order, location, and table properties

Test plan

  • Unit tests for type mapper, table converter, change computers, change descriptions, column differ, and extension provider
  • Integration tests for namespace controller, table controller, and health indicator (using Testcontainers + Nessie)
  • Manual validation using the included demo (demo/iceberg/)

Implements a new provider for managing Apache Iceberg tables and namespaces
declaratively using Jikkou's Resource-as-Code model.

Resources:
- IcebergNamespace: CRUD for catalog namespaces with property management
- IcebergTable: full lifecycle including schema evolution, partition spec,
  sort order, location, and table properties

Schema evolution features:
- Column additions, updates (type promotion, doc, required), and deletions
- Two-pass column rename detection via previousName field (preserves field IDs)
- Incompatible change gating via iceberg.jikkou.io/allow-incompatible-changes annotation
- Partition spec evolution and sort order replacement

Catalog backends supported:
- REST, Hive, JDBC, AWS Glue, Project Nessie, Hadoop
  (configured via catalogType + optional catalogProperties passthrough)

Safety controls:
- delete-orphans: opt-in to drop tables absent from spec
- delete-orphan-columns: opt-in to drop columns absent from spec
- delete-purge: opt-in to purge data files on table drop
- tables.deletion.exclude: regex patterns to protect tables from deletion
Covers configuration (all catalog types: REST, Hive, Glue, Nessie),
IcebergNamespace and IcebergTable resource specifications, column type
reference, partition transforms, schema evolution ordering, safe rename
via previousName, and the allow-incompatible-changes annotation.
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 1, 2026

Security Scan Results

Vulnerabilities detected:


Report Summary

┌───────────────────────────────────────────────────┬───────┬─────────────────┬─────────┐
│                      Target                       │ Type  │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ cli/pom.xml                                       │  pom  │        2        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ core/pom.xml                                      │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ docs/go.mod                                       │ gomod │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ extension-rest-client/pom.xml                     │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ pom.xml                                           │  pom  │        4        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ processor/pom.xml                                 │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-aiven/pom.xml           │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-aws/pom.xml             │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-confluent/pom.xml       │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-core/pom.xml            │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-iceberg/pom.xml         │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-kafka-connect/pom.xml   │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-kafka/pom.xml           │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-schema-registry/pom.xml │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ resource-generator/pom.xml                        │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ server/jikkou-api-client/pom.xml                  │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ server/jikkou-api-data/pom.xml                    │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ server/jikkou-api-server/pom.xml                  │  pom  │        2        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ template-jinja/pom.xml                            │  pom  │        0        │    -    │
└───────────────────────────────────────────────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


cli/pom.xml (pom)
=================
Total: 2 (HIGH: 2, CRITICAL: 0)

┌────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│          Library           │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                           Title                            │
├────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http  │ CVE-2026-33870 │ HIGH     │ fixed  │ 4.2.9.Final       │ 4.1.132.Final, 4.2.10.Final │ io.netty/netty-codec-http: Netty: Request smuggling via    │
│                            │                │          │        │                   │                             │ incorrect parsing of HTTP/1.1 chunked transfer encoding... │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33870                 │
├────────────────────────────┼────────────────┤          │        │                   ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http2 │ CVE-2026-33871 │          │        │                   │ 4.1.132.Final, 4.2.11.Final │ netty: Netty: Denial of Service via HTTP/2 CONTINUATION    │
│                            │                │          │        │                   │                             │ frame flood                                                │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33871                 │
└────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘

pom.xml (pom)
=============
Total: 4 (HIGH: 4, CRITICAL: 0)

┌────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│          Library           │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                           Title                            │
├────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http  │ CVE-2026-33870 │ HIGH     │ fixed  │ 4.2.9.Final       │ 4.1.132.Final, 4.2.10.Final │ io.netty/netty-codec-http: Netty: Request smuggling via    │
│                            │                │          │        │                   │                             │ incorrect parsing of HTTP/1.1 chunked transfer encoding... │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33870                 │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
├────────────────────────────┼────────────────┤          │        │                   ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http2 │ CVE-2026-33871 │          │        │                   │ 4.1.132.Final, 4.2.11.Final │ netty: Netty: Denial of Service via HTTP/2 CONTINUATION    │
│                            │                │          │        │                   │                             │ frame flood                                                │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33871                 │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
└────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘

server/jikkou-api-server/pom.xml (pom)
======================================
Total: 2 (HIGH: 2, CRITICAL: 0)

┌────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│          Library           │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                           Title                            │
├────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http  │ CVE-2026-33870 │ HIGH     │ fixed  │ 4.2.9.Final       │ 4.1.132.Final, 4.2.10.Final │ io.netty/netty-codec-http: Netty: Request smuggling via    │
│                            │                │          │        │                   │                             │ incorrect parsing of HTTP/1.1 chunked transfer encoding... │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33870                 │
├────────────────────────────┼────────────────┤          │        │                   ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http2 │ CVE-2026-33871 │          │        │                   │ 4.1.132.Final, 4.2.11.Final │ netty: Netty: Denial of Service via HTTP/2 CONTINUATION    │
│                            │                │          │        │                   │                             │ frame flood                                                │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33871                 │
└────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘

Scanned by Trivy

Add IcebergView as a third resource kind in the Iceberg provider,
enabling declarative management of Iceberg views via the ViewCatalog API.

Key design decisions:
- Schema is read-only (engine-inferred), never part of change detection
- Change detection covers queries, defaultNamespace, defaultCatalog, properties
- View updates use replaceVersion() with the live schema preserved
- Field named "queries" (maps to Iceberg "representations" / withQuery API)
- Catalogs that don't implement ViewCatalog gracefully return empty lists

New resource: IcebergView (iceberg.jikkou.io/v1beta1)
  - singular: icebergview, plural: icebergviews, shortName: ivw
  - Verbs: LIST, CREATE, UPDATE, DELETE, GET, APPLY
Add view create/update/delete resource files and integrate them into
the demo README for both JDBC and Nessie catalog providers.
Add missing view-related documentation across the Iceberg provider
pages: view-location annotation, view controller settings, resource
summary table, and updated provider description.
@fhussonnois fhussonnois force-pushed the feat/iceberg-provider branch from 33ef067 to b26d093 Compare April 4, 2026 21:24
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 4, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
60.2% Coverage on New Code (required ≥ 80%)
8.5% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

@fhussonnois fhussonnois merged commit de89bc6 into main Apr 4, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant