Apache Iceberg (Polaris catalog)¶
Part of the lakehouse (overview and interaction diagram).
The Apache Iceberg template (Governance category) deploys an Iceberg REST catalog — Apache Polaris — backed by a PostgreSQL database (CloudNativePG) created alongside it.
| Field | Role |
|---|---|
| Warehouse S3 bucket (Storage tab, required) | Bucket that will hold tables and metadata. Picking a namespace bucket fills in endpoint, region and access keys automatically. Fixed at creation. |
| S3 endpoint, S3 region (Storage tab) | Filled in by the bucket picker, to be typed in for an external S3. us-east-1 by default for the region. Fixed at creation. |
| Access Key ID, Secret Access Key (Storage tab) | The bucket's credentials, which can be changed afterwards — after a key rotation, for instance. |
| Iceberg catalog name | lakehouse by default: the warehouse that Trino, Spark or PyIceberg refer to. Fixed at creation. |
| Polaris realm | POLARIS by default, one realm per instance. Fixed at creation. |
| Memory limit, CPU limit (Capacity tab) | 2Gi and 1000m by default. |
| PostgreSQL storage size (Capacity tab) | 5Gi by default. Grow-only: a volume cannot be shrunk. |
On deployment, two tasks run automatically: realm initialization (credentials of the root principal), then creation of the catalog on the bucket with the required grants. The card turns Running before they finish — allow one or two extra minutes before the catalog is usable.
Catalog credentials
Engines authenticate to the catalog with the root principal, kept in the namespace secret <name>-root-principal (keys clientId, clientSecret, catalogUri, catalogName) — see Secrets. The catalog does not vend temporary S3 credentials (no STS on the platform's object storage): every engine uses its own bucket keys, hence the S3 fields repeated in the Trino and JupyterHub templates.
The REST API is exposed at https://<name>-<namespace>.<domain>/api/catalog (authenticated calls only — no web UI).
Deletion¶
Deleting the Apache Iceberg catalog removes its PostgreSQL database and secrets, but not the bucket files: the tables remain readable by a new catalog pointing at the same location, or can be cleaned up from the Buckets page.