Zero Trust with Iceberg REST Catalog and Policy Engines
summary
Claims a reproducible governance layer: the Iceberg REST Catalog becomes a centralized enforcement point, issuing short‑lived credentials and decoupling access from compute. Implementation uses Lakekeeper (Rust single binary, demo via Docker Compose), relational tuples in OpenFGA for authorization, and engine‑agnostic policy checks with Open Policy Agent or Cedar. Demo shows Trino and PyIceberg both obey catalog decisions, with row/column scoping, separation of power, and live permission changes.
AI-written summary · about
chapters (12)
- 0:00Zero Trust and Iceberg intro
- 2:34Lakehouse architecture evolution
- 6:03What Apache Iceberg solves and its architecture
- 8:50Iceberg REST catalog and Lakekeeper
- 12:00Lakehouse governance challenges
- 17:14What Iceberg does not solve yet
- 19:01Lakekeeper’s OpenFGA governance
- 21:50Trusted vs general compute
- 24:22Access control demo
- 28:18Cedar policy simplification
- 30:25Data governance separation
- 31:50Key takeaways
related talks
39mMetadata as a Control Plane: Inside the Apache Iceberg REST Catalog
01h 12mHands-on with Apache Iceberg
34mCloud Agnostic Data Platform with DBT, Trino, Iceberg and MinIO
34mApache Iceberg.
41mThe Pillars of the Iceberg Ecosystem: The Table Spec, The Catalog Spec & Table Service
41mTip of the Iceberg
37mApache Iceberg: An Architectural Look Under the Covers
28mBridging Python and Apache Iceberg: The Power of PyIceberg