Skip to content

feat(encryption): [7/N] Add encryption key updates - #4148

Merged
kevinjqliu merged 1 commit into
apache:mainfrom
xanderbailey:xb/encrytion-key-updates
Oct 24, 2026
Merged

kevinjqliu merged 1 commit into
apache:mainfrom
xanderbailey:xb/encrytion-key-updates

Conversation

@xanderbailey

Copy link
Copy Markdown
Contributor

Working towards #3222

Rationale for this change

We need to be able to send add / remove key changed with the update table request

Are these changes tested?

Are there any user-facing changes?

@xanderbailey xanderbailey changed the title feat(encryption): Add encryption key updates feat(encryption): [7/N] Add encryption key updates Oct 24, 2026
snapshot_id: int = Field(alias="snapshot-id")


class AddEncryptionKeyUpdate(IcebergBaseModel):

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

encryption_key: EncryptedKey = Field(alias="encryption-key")


class RemoveEncryptionKeyUpdate(IcebergBaseModel):

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if not isinstance(base_metadata, TableMetadataV3):
raise ValueError(f"Encryption keys are not supported in format version {base_metadata.format_version}")

if any(key.key_id == update.encryption_key.key_id for key in base_metadata.encryption_keys):

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Existing key id is a no-op, as in Rust's add_encryption_key.

raise ValueError(f"Encryption keys are not supported in format version {base_metadata.format_version}")

encryption_keys = [key for key in base_metadata.encryption_keys if key.key_id != update.key_id]
if len(encryption_keys) == len(base_metadata.encryption_keys):

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing a missing key is a no-op, as in Rust's remove_encryption_key.

@kevinjqliu kevinjqliu left a comment •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
I also ran this locally against the iceberg-rest-fixture and it works as expected.

Looks like the server does not guard on v3 and just applies the request to tables of any versions, this is a gap unrelated to this pr

@kevinjqliu
kevinjqliu added this pull request to the merge queue Oct 24, 2026
Comment on lines +703 to +704
if not isinstance(base_metadata, TableMetadataV3):
raise ValueError(f"Encryption keys are not supported in format version {base_metadata.format_version}")

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Merged via the queue into apache:main with commit 35bb9bb Oct 24, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants