Write to OSS Tables by using Kafka Connect

更新时间:
复制 MD 格式

OSS Tables is compatible with the Apache Iceberg REST Catalog protocol. You can use the Iceberg Sink Connector for Kafka Connect to write Kafka messages to tables in OSS Tables in real time, enabling stream data ingestion.

Step 1: Prepare the environment

Download dependency JAR packages

Place the following JAR packages in the Kafka Connect plug-in directory, which is the path specified by plugin.path.

JAR package

Version requirement

Description

iceberg-aws-bundle-1.10.1.jar

Matches the Apache Iceberg version

Provides the S3FileIO implementation and the AWS SDK required for REST Catalog SigV4 signing authentication.

iceberg-aws-1.10.1.jar

Matches the Apache Iceberg version

Provides the SigV4 signing and S3FileIO implementation. The version must be consistent with the iceberg-aws-bundle package.

iceberg-parquet-1.10.1.jar

Matches the Apache Iceberg version

Supports writing data in the Parquet file format.

hadoop-client-runtime-3.3.6.jar

3.3.6

A Hadoop runtime dependency required for internal loading by Apache Iceberg. You can adjust the version as needed.

hadoop-client-api-3.3.6.jar

3.3.6

A Hadoop API dependency required for internal loading by Apache Iceberg. You can adjust the version as needed.

failsafe-3.3.2.jar

3.3.2

This dependency is required by the Apache Iceberg SnapshotProducer at runtime. If this package is missing, a ClassNotFoundException occurs.

Step 2: Create a Table Bucket

Before you can write data, create a Table Bucket and a namespace. You can use ossutil or the AWS Command Line Interface (CLI) to create them.

Method 1: Use ossutil

1. Install or update ossutil

Install ossutil version 2.3.0 or later. If you have already installed ossutil, run the following command to update it to the latest version:

ossutil update -f

2. Configure credentials

Run the ossutil config command and enter the AccessKey ID, AccessKey Secret, and region as prompted.

3. Create a Table Bucket

ossutil tables-api create-table-bucket --name {table_bucket_name} --endpoint http://{endpoint} --region {region}

After the command runs successfully, the output includes the Table Bucket ARN. Record this value.

4. Create a namespace

ossutil tables-api create-namespace --table-bucket-arn {table_bucket_arn} --namespace {namespace_name} --endpoint http://{endpoint}
Important

Use underscores (_) instead of hyphens (-) in namespace and table names because the names are used as SQL identifiers.

5. Create a table

You can create an Apache Iceberg table by using one of the following methods:

  • Create the table by using another compute engine, such as Spark.

  • Create the table by using ossutil. First, save the table schema to a JSON file, and then call create-table.

    In the following example, the schema file schema.json defines 3 fields:

    {
      "iceberg": {
        "schema": {
          "fields": [
            {"name": "event_id", "type": "string", "required": true},
            {"name": "event_time", "type": "string"},
            {"name": "event_type", "type": "string"}
          ]
        }
      }
    }

    Create a table based on the schema file:

    ossutil tables-api create-table --table-bucket-arn {table_bucket_arn} --namespace {namespace_name} --name {table_name} --format ICEBERG --metadata file://schema.json --endpoint http://{endpoint}

Method 2: Use the AWS CLI

OSS Tables is compatible with the S3 Tables API. You can also use the AWS CLI to manage a Table Bucket.

1. Install the AWS CLI

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

2. Configure credentials

Run the aws configure command and enter the AccessKey ID, AccessKey Secret, and region as prompted.

3. Create a Table Bucket

aws s3tables --endpoint http://{endpoint} create-table-bucket --region {region} --name {table_bucket_name}

After the command runs successfully, the output includes the Table Bucket ARN.

4. Create a namespace

aws s3tables --endpoint http://{endpoint} create-namespace --table-bucket-arn {table_bucket_arn} --namespace {namespace_name}

5. Create a table

  • Create the table by using another compute engine, such as Spark.

  • To create the table by using the AWS CLI, first save the input parameters to a JSON file, such as create-table.json, and then call create-table.

    {
      "tableBucketARN": "{table_bucket_arn}",
      "namespace": "{namespace_name}",
      "name": "{table_name}",
      "format": "ICEBERG",
      "metadata": {
        "iceberg": {
          "schema": {
            "fields": [
              {"name": "event_id", "type": "string", "required": true},
              {"name": "event_time", "type": "string"},
              {"name": "event_type", "type": "string"}
            ]
          }
        }
      }
    }
    aws s3tables --endpoint http://{endpoint} create-table --cli-input-json file://{file_path}

6. Manage background maintenance jobs

OSS Tables supports automatic background maintenance for Apache Iceberg tables, such as file cleanup and small file compaction. You can use the AWS CLI to query and configure these maintenance jobs.

Query the status of a table maintenance job:

aws s3tables get-table-maintenance-job-status \
   --table-bucket-arn="{table_bucket_arn}" \
   --namespace="{namespace_name}" \
   --name="{table_name}" 

Configure a bucket-level maintenance policy (file cleanup):

aws s3tables put-table-bucket-maintenance-configuration \
   --table-bucket-arn {table_bucket_arn} \
   --type icebergUnreferencedFileRemoval \
   --value '{"status":"enabled","settings":{"icebergUnreferencedFileRemoval":{"unreferencedDays":4,"nonCurrentDays":10}}}' 

Configure a table-level maintenance policy (small file compaction):

aws s3tables put-table-maintenance-configuration \
   --table-bucket-arn {table_bucket_arn} \
   --type icebergCompaction \
   --namespace {namespace_name} \
   --name {table_name} \
   --value='{"status":"enabled","settings":{"icebergCompaction":{"targetFileSizeMB":256}}}'

Step 3: Configure Kafka Connect

OSS Tables provides an Apache Iceberg REST Catalog endpoint. Kafka Connect uses the Iceberg Sink Connector to connect to this endpoint and write data. The endpoints are:

  • Internal network: https://{region}-internal.oss-tables.aliyuncs.com/iceberg

  • Public network: https://{region}.oss-tables.aliyuncs.com/iceberg

OSS Tables provides an S3FileIO access endpoint for the OSS data plane, which the Iceberg Sink Connector uses to access table data. The endpoints are:

  • Internal network: https://oss-{region}-internal.aliyuncs.com

  • Public network: https://oss-{region}.aliyuncs.com

Connector configuration

When you create an Iceberg Sink Connector, specify the connector class as org.apache.iceberg.connect.IcebergSinkConnector and configure the following properties:

# --- Iceberg Catalog (REST) ---
iceberg.catalog.type: rest
iceberg.catalog.uri: https://{region}-internal.oss-tables.aliyuncs.com/iceberg
iceberg.catalog.rest.sigv4-enabled: true
iceberg.catalog.rest.signing-region: {region}
iceberg.catalog.warehouse: {table_bucket_arn}
iceberg.catalog.rest.signing-name: osstables
iceberg.catalog.rest.access-key-id: {access_key_id}
iceberg.catalog.rest.secret-access-key: {access_key_secret}


# --- Force S3FileIO (catalog returns oss:// but storage is S3-compatible) ---
iceberg.catalog.io-impl: org.apache.iceberg.aws.s3.S3FileIO

# --- S3FileIO storage configuration ---
iceberg.catalog.s3.endpoint: https://oss-{region}-internal.aliyuncs.com
iceberg.catalog.s3.access-key-id: {access_key_id}
iceberg.catalog.s3.secret-access-key: {access_key_secret}
iceberg.catalog.s3.path-style-access: true
iceberg.catalog.client.region: {region}

# --- Data format conversion ---
key.converter: org.apache.kafka.connect.json.JsonConverter
key.converter.schemas.enable: false
value.converter: org.apache.kafka.connect.json.JsonConverter
value.converter.schemas.enable: false
Important

If you use AWS SDK version 2.20 or later, you might encounter the following signing error: aws-chunked encoding is not supported with the specified x-amz-content-sha256 value. To resolve this issue, add the following JVM options to the Java startup parameters for Kafka Connect:

-Daws.requestChecksumCalculation=when_required
-Daws.responseChecksumValidation=when_required

Parameters

Parameter

Required

Description

iceberg.catalog.type

Yes

Specifies the catalog type. Set to rest to use a REST Catalog.

iceberg.catalog.uri

Yes

The REST Catalog endpoint URL.

  • Internal network: https://{region}-internal.oss-tables.aliyuncs.com/iceberg

  • Public network: https://{region}.oss-tables.aliyuncs.com/iceberg

iceberg.catalog.warehouse

Yes

The Table Bucket ARN. Format: acs:osstables:{region}:{alibaba_cloud_account_id}:bucket/{table_bucket_name}.

iceberg.catalog.rest.sigv4-enabled

Yes

Set this to true to enable SigV4 signing authentication.

iceberg.catalog.rest.signing-name

Yes

The SigV4 signing service name for the OSS Tables endpoint. Set this to osstables.

iceberg.catalog.io-impl

Yes

Set this to org.apache.iceberg.aws.s3.S3FileIO to access the OSS data plane over the S3 protocol.

iceberg.catalog.s3.endpoint

Yes

The OSS data plane endpoint.

  • Internal network: https://oss-{region}-internal.aliyuncs.com

  • Public network: https://oss-{region}.aliyuncs.com

iceberg.catalog.s3.path-style-access

Yes

Set this to true to use path-style access.

Permissions

If you use a RAM user or an STS temporary credential to access OSS Tables, ensure that the identity has the required permissions.

Resource definitions

  • Table Bucket ARN: acs:osstables:{region}:{alibaba_cloud_account_id}:bucket/{table_bucket_name}

  • Table ARN: acs:osstables:{region}:{alibaba_cloud_account_id}:bucket/{table_bucket_name}/table/{table_id}

Action definitions

The following table lists the OSS Tables actions and indicates which ones support cross-account authorization.

Category

Action

Cross-account access

Table Bucket-level

oss:CreateTableBucket

Not allowed

oss:GetTableBucket

Allowed

oss:ListTableBuckets

Not allowed

oss:CreateNamespace

Allowed

oss:GetNamespace

Allowed

oss:ListNamespaces

Allowed

oss:DeleteNamespace

Allowed

oss:DeleteTableBucket

Allowed

oss:PutTableBucketPolicy

Not allowed

oss:GetTableBucketPolicy

Not allowed

oss:DeleteTableBucketPolicy

Not allowed

oss:GetTableBucketMaintenanceConfiguration

Allowed

oss:PutTableBucketMaintenanceConfiguration

Allowed

oss:PutTableBucketEncryption

Not allowed

oss:GetTableBucketEncryption

Not allowed

oss:DeleteTableBucketEncryption

Not allowed

Table-level

oss:GetTableMaintenanceConfiguration

Allowed

oss:PutTableMaintenanceConfiguration

Allowed

oss:PutTablePolicy

Not allowed

oss:GetTablePolicy

Not allowed

oss:DeleteTablePolicy

Not allowed

oss:CreateTable

Allowed

oss:GetTable

Allowed

oss:GetTableMetadataLocation

Allowed

oss:ListTables

Allowed

oss:RenameTable

Allowed

oss:UpdateTableMetadataLocation

Allowed

oss:GetTableData

Allowed

oss:PutTableData

Allowed

oss:GetTableEncryption

Not allowed

oss:PutTableEncryption

Not allowed

oss:DeleteTable

Allowed

Permission mapping for REST operations

The following table lists the required OSS actions for each Iceberg REST Catalog operation.

Iceberg REST operation

Required OSS action

getConfig

oss:GetTableBucket

listNamespaces

oss:ListNamespaces

createNamespace

oss:CreateNamespace

loadNamespaceMetadata

oss:GetNamespace

dropNamespace

oss:DeleteNamespace

listTables

oss:ListTables

createTable

oss:CreateTable, oss:PutTableData

loadTable

oss:GetTableMetadataLocation, oss:GetTableData

updateTable

oss:UpdateTableMetadataLocation, oss:PutTableData, oss:GetTableData

dropTable

oss:DeleteTable

renameTable

oss:RenameTable

tableExists

oss:GetTable

namespaceExists

oss:GetNamespace