Lakekeeper Plus Certified

Apache Iceberg Table Management (REST Catalog) provides centralized, engine-agnostic control of table metadata through a stateless REST API. It supports full DDL operations (CREATE, ALTER, DROP) and ACID-compliant DML (INSERT, UPDATE, DELETE, MERGE) via transactional metadata updates. Tables are versioned using immutable snapshot metadata, enabling time travel, rollback, and reproducible queries. The REST Catalog manages schema evolution, hidden partitioning, and table discovery across query engines like Spark, Flink, and Trino—ensuring consistent behavior in distributed lakehouse environments.

Lakekeeper Client Authentication supports secure access to the Iceberg REST Catalog using OAuth 2.0. Clients authenticate by presenting a bearer token in the Authorization header, typically issued by an identity provider (IdP) like Auth0, Azure AD, or Keycloak. Lakekeeper validates tokens using standard OAuth 2.0 flows (e.g., introspection or JWKS verification) to enforce fine-grained access control. This enables secure, standards-compliant integration with data engines and services, ensuring that only authorized clients can perform DDL, DML, or metadata operations on Iceberg tables via the REST API.

Lakekeeper Fine-Grained Access Control leverages OAuth 2.0 for authentication and OpenFGA for authorization, enabling precise control over who can access which Iceberg resources and what operations they can perform. After validating the OAuth 2.0 bearer token, Lakekeeper extracts the subject (sub) and queries OpenFGA relationship tuples to determine access rights. Permissions can be defined at any level—catalog, namespace, table, or operation type (e.g., read, write, delete, alter)—allowing for highly flexible and auditable access policies. This decoupled model supports enterprise-scale multi-user, multi-tenant governance across lakehouse environments with full support for REST Catalog operations.

Iceberg Table Maintenance refers to the processes that optimize storage, performance, and metadata health over time. Apache Iceberg tracks data and metadata changes via immutable snapshot files. 

Maintenance tasks include:

Snapshot expiration: Removes old snapshots to reduce metadata overhead.

Manifest and metadata cleanup: Prunes unused files to keep metadata compact.

Data file compaction: Merges small files to improve query performance.

Orphan file removal: Detects and deletes data files no longer referenced by metadata.

Partition evolution: Supports changes to partitioning without rewriting entire tables.