Roles: PolarisPrincipalRole and PolarisCatalogRole¶
Two kinds, the same tiny shape: a name and a property bag. What differs is scope. A PolarisPrincipalRole is server-wide and gets assigned to principals. A PolarisCatalogRole is scoped to one catalog and is the attachment point for grants. A PolarisCatalogRoleBinding is what connects the two.
PolarisPrincipalRole¶
A server-wide role in Polaris that may be granted to one or more principals via PolarisPrincipalRoleBinding.
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
connectionRef |
ConnectionRef | yes | The PolarisConnection this role lives on. |
|
name |
string | no | .metadata.name |
Role name in Polaris. Pattern ^[a-zA-Z0-9_-]+$. |
properties |
map[string]string | no | Open-ended property bag. |
Status¶
conditions: Ready, Synced.
Example¶
apiVersion: polaris.k8s.calific.io/v1alpha1
kind: PolarisPrincipalRole
metadata:
name: analytics-writer
namespace: data-platform
spec:
connectionRef:
name: prod
PolarisCatalogRole¶
A role scoped to a single Polaris catalog. Privileges attach via PolarisGrant; principals reach it via a PolarisCatalogRoleBinding from a PolarisPrincipalRole.
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
catalogRef |
CatalogRef | yes | The PolarisCatalog this role is scoped to. |
|
name |
string | no | .metadata.name |
Role name in Polaris. Pattern ^[a-zA-Z0-9_-]+$. |
properties |
map[string]string | no | Open-ended property bag. |
Status¶
conditions: Ready, Synced.
Example¶
apiVersion: polaris.k8s.calific.io/v1alpha1
kind: PolarisCatalogRole
metadata:
name: lakehouse-analytics-rw
namespace: data-platform
spec:
catalogRef:
name: lakehouse