You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/configuring-polaris-for-production.md
+12-13Lines changed: 12 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,29 +23,28 @@ The default `polaris-server.yml` configuration is intended for develoment and te
23
23
24
24
### Configurations
25
25
26
-
There are many Polaris configurations that should be adjusted to ensure a secure Polaris deployment. Some of these configurations are briefly outlined below, along with a short description of each.
26
+
Notable configuration used to secure a Polaris deploymentare outlined below.
27
27
28
28
***oauth2**
29
29
- Configure [OAuth](https://oauth.net/2/) with this setting, including a token broker
- Use these configurations to specify a service that can resolve a realm from your bearer tokens.
33
-
- The service(s) used here must implement the relevant interfaces (e.g. [CallContextResolver](https://github.com/polaris-catalog/polaris/blob/8290019c10290a600e40b35ddb1e2f54bf99e120/polaris-service/src/main/java/io/polaris/service/context/CallContextResolver.java#L27)).
34
-
35
31
***authenticator.tokenBroker**
36
32
- Ensure that this setting reflects the token broker specified in **oauth2** above
37
33
38
-
***cors**
39
-
- Use settings like **cors.allowed-origins** to control what connections your Polaris service will accept
- Use these configurations to specify a service that can resolve a realm from bearer tokens.
36
+
- The service(s) used here must implement the relevant interfaces (i.e. [CallContextResolver](https://github.com/polaris-catalog/polaris/blob/8290019c10290a600e40b35ddb1e2f54bf99e120/polaris-service/src/main/java/io/polaris/service/context/CallContextResolver.java#L27) and [RealmContextResolver](https://github.com/polaris-catalog/polaris/blob/7ce86f10a68a3b56aed766235c88d6027c0de038/polaris-service/src/main/java/io/polaris/service/context/RealmContextResolver.java)).
40
37
38
+
***cors**
39
+
- Use settings like **cors.allowed-origins** to control what connections the Polaris service will accept
41
40
42
41
## Metastore Management
43
42
44
-
Use the configuration `metaStoreManager` to configure a [MetastoreManager](https://github.com/polaris-catalog/polaris/blob/627dc602eb15a3258dcc32babf8def34cf6de0e9/polaris-core/src/main/java/io/polaris/core/persistence/PolarisMetaStoreManager.java#L47) implementation where Polaris entities will be persisted.
43
+
A Metastore Manger should be configured with an implementation that durably persists Polaris entities. Use the configuration `metaStoreManager` to configure a [MetastoreManager](https://github.com/polaris-catalog/polaris/blob/627dc602eb15a3258dcc32babf8def34cf6de0e9/polaris-core/src/main/java/io/polaris/core/persistence/PolarisMetaStoreManager.java#L47) implementation where Polaris entities will be persisted.
45
44
46
45
The default `in-memory` implementation is meant for testing and not suitable for production usage. Instead, consider an implementation such as `eclipse-link` which allows you to store metadata in a remote database.
47
46
48
-
Credentials and metadata will be stored in the metastore manager, and so be sure that your metastore manager is accordingly secured.
47
+
Be sure to secure your metastore backend since it will be storing credentials and catalog metadata.
49
48
50
49
### Configuring EclipseLink
51
50
@@ -55,13 +54,13 @@ To use [EclipseLink](https://eclipse.dev/eclipselink/) for metastore management,
55
54
56
55
Before using Polaris when using a metastore manager other than `in-memory`, you must **bootstrap** the metastore manager. This is a manual operation that must be performed **only once** in order to prepare the metastore manager to integrate with Polaris. When the metastore manager is bootstrapped, any existing Polaris entities in the metastore manager may be **purged**.
57
56
58
-
To bootstrap Polaris, run a command like the following:
- By default, the `FILE` storage type may be supported. This is intended for testing, and in produciton you'll likely want to disable it
76
-
-Here you can also disable or enable any other storage type based on your expected usage of Apache Iceberg
74
+
- By default Polaris catalogs are allowed to be located in local filesystem with the `FILE` storage type. This should be disabled for production systems.
75
+
-Use this configuration to additionally disable any other storage types that will not be in use.
0 commit comments