Raghav Rajagopalan
03/19/2026, 9:11 PMJohn Bergamini
03/20/2026, 7:04 PMiceberg_meta_cache_ttl_sec fix is at the wrong layer. That controls metadata refresh. The STS credentials are cached separately at the BE file client level, so you can force metadata to refresh every 30min but the BE still holds stale credentials until it gets the 400.
Fixes in order of simplicity:
If you're on 4.0.6, downgrade to 4.0.5. Cliff's finding around Polaris credential re-establishment lines up with what I'd expect from a regression there. Easiest path until a patch lands.
For 4.0.1, or while waiting on a fix, set the credential TTL below the STS expiry at the catalog level:
ALTER CATALOG mdlh_context_store SET (
"iceberg_meta_cache_ttl_sec" = "1800",
"credential_cache_ttl_sec" = "1800"
);
The goal is to force a re-fetch well before the 1hr STS expiry hits.
On the Polaris side, you can also increase the vended STS token duration. AWS allows up to 12 hours for role assumption, so if Polaris is issuing 1hr tokens, bumping that buys you headroom while the caching issue gets resolved.
If a GitHub issue doesn't already exist for the 4.0.6 regression, worth filing one. Cliff's repro is a solid data point.
The metadata TTL config isn't wrong to have but it's not solving the actual problem here.Raghav Rajagopalan
03/20/2026, 9:32 PM/api/{db}/{table}/_stream_load but somehow specify external catalog?
• if now, what other option might i have for regularly bringing in json data into an iceberg table with starrocksMoreno Garcia
03/22/2026, 12:49 AMMoreno Garcia
03/22/2026, 12:51 AMJohn Bergamini
03/23/2026, 4:05 PM