管理 Iceberg REST Catalog 资源

Lakehouse for Apache Iceberg 可让您在 Lakehouse 运行时目录 中管理 Apache Iceberg REST 目录端点。您可以使用 Google Cloud 控制台 或 REST API 创建、配置和监控这些目录，以建立 查询引擎连接所需的元数据层。

准备工作

1. 阅读 关于 Lakehouse 运行时目录，了解 Lakehouse 运行时目录的工作原理以及该服务的限制。
登录您的 Google Cloud 账号。如果您是新手 Google Cloud， 请创建一个账号来评估我们的产品在 实际场景中的表现。新客户还可获享 $300 赠金，用于 运行、测试和部署工作负载。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

所需的角色

如需获得使用 Lakehouse 运行时目录所需的权限，请让您的管理员为您授予项目的以下 IAM 角色：

• BigLake Admin (roles/biglake.admin)
• Storage Admin (roles/storage.admin)

如需详细了解如何授予角色，请参阅管理对项目、文件夹和组织的访问权限。

您也可以通过自定义 角色或其他预定义 角色来获取所需的权限。

管理操作

您可以使用 Google Cloud 控制台或 REST API 对 Apache Iceberg REST 目录资源执行以下管理操作：

• 创建目录： 创建指向底层 Cloud Storage 仓库位置的 Apache Iceberg REST 目录管理端点 (CreateIcebergCatalog)。
• 更新目录：将现有 Cloud Storage 存储桶目录（旧版 gs:// 目录）升级到 BigLake 目录（bl:// 目录）（UpdateIcebergCatalog）。
• 创建命名空间： 在 Iceberg REST 目录中创建命名空间，以对相关表进行分组 (CreateIcebergNamespace)。
• 启用凭据自动售卖: 将现有目录的身份验证方法切换为凭据自动售卖模式，以便直接向查询引擎自动售卖短期存储令牌 (UpdateIcebergCatalog)。
• 获取目录详细信息： 查看目录的属性和元数据，包括客户端连接所需的 REST 目录 URI (GetIcebergCatalog)。
• 管理命名空间 ACL： 查看和更新目录命名空间的 IAM 政策，以控制特定主账号的访问权限 (get-iam-policy、set-iam-policy)。
• 删除目录：从 Lakehouse 运行时目录中取消注册目录元数据管理端点 (DeleteIcebergCatalog)。
• 删除命名空间: 从 Iceberg REST 目录中删除不再需要的命名空间 (DeleteIcebergNamespace)。
• 查看审核日志：检查 Cloud Audit Logs，以获取管理员活动和数据访问权限活动的可验证记录。

价格

如需了解价格详情，请参阅 Lakehouse for Apache Iceberg 价格。

后续步骤

• 了解如何管理命名空间 ACL。
• 详细了解 Apache Iceberg REST 目录 端点。