管理 Iceberg REST 目錄資源

Lakehouse for Apache Iceberg 可讓您在 Lakehouse 執行階段目錄中，管理 Apache Iceberg REST 目錄端點。您可以使用 Google Cloud 控制台或 REST API 建立、設定及監控這些目錄，建立查詢引擎連線所需的 Metadata 層。

事前準備

1. 請參閱「關於 Lakehouse 執行階段目錄」，瞭解 Lakehouse 執行階段目錄的運作方式和服務限制。
登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎 建立帳戶，親自評估產品在實際工作環境中的成效。新客戶還能獲得價值 $300 美元的免費抵免額，可用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

必要的角色

如要取得使用 Lakehouse 執行階段目錄所需的權限，請要求管理員在專案中授予您下列 IAM 角色：

• BigLake 管理員 (roles/biglake.admin)
• 儲存空間管理員 (roles/storage.admin)

如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和組織的存取權」。

您或許也能透過自訂角色或其他預先定義的角色，取得必要權限。

管理動作

您可以使用 Google Cloud 控制台或 REST API，對 Apache Iceberg REST 目錄資源執行下列管理動作：

• 建立目錄：建立指向基礎 Cloud Storage 倉庫位置 (CreateIcebergCatalog) 的 Apache Iceberg REST 目錄管理端點。
• 更新目錄：將現有的 Cloud Storage bucket 目錄 (舊版 gs:// 目錄) 升級為 BigLake 目錄 (bl:// 目錄) (UpdateIcebergCatalog)。
• 建立命名空間：在 Iceberg REST 目錄中建立命名空間，將相關資料表分組 (CreateIcebergNamespace)。
• 啟用憑證臨時配發：將現有目錄的驗證方法切換為憑證臨時配發模式，直接將短期儲存空間權杖臨時配發給查詢引擎 (UpdateIcebergCatalog)。
• 取得目錄詳細資料：查看目錄的屬性和中繼資料，包括用戶端連線所需的 REST 目錄 URI (GetIcebergCatalog)。
• 管理命名空間 ACL：查看及更新目錄命名空間的 IAM 政策，控管特定主體 (get-iam-policy、set-iam-policy) 的存取權。
• 刪除目錄：從 Lakehouse 執行階段目錄 (DeleteIcebergCatalog) 取消註冊目錄中繼資料管理端點。
• 刪除命名空間：不再需要命名空間時，請從 Iceberg REST 目錄中刪除 (DeleteIcebergNamespace)。
• 查看稽核記錄：檢查 Cloud 稽核記錄，確認管理員和資料存取活動的記錄。

定價

如需定價詳細資料，請參閱「Lakehouse for Apache Iceberg 定價」。

後續步驟

• 瞭解如何管理命名空間 ACL。
• 進一步瞭解 Apache Iceberg REST 目錄端點。