By default, DLF is accessible only from within a VPC. To connect to a DLF catalog over the internet—for example, from a local development environment or a cross-region network—a DLF administrator must enable public network access and configure the client accordingly. This topic walks you through enabling public network access and setting up connectivity for both Paimon and Iceberg.
Limitations
Public network access is currently in public beta and open to all users.
Public beta SLA and performance: No SLA is provided during the public beta. Core service functionality remains fully available. Public network access is subject to internet link variability, causing higher latency and lower throughput compared to VPC access. This mode is not intended for large-scale, high-concurrency production workloads.
Paimon: Use Paimon client (Java or Python) version 1.4.1 or later.
Iceberg: Requires
dlf-iceberg-plugin. Version requirements:Apache Iceberg: 1.10.1
dlf-iceberg-plugin: 1.2.0 or later
Naming restrictions: Only letters, digits, and specific symbols are supported for database and table names.
Parameter requirement: When accessing DLF over the public network, you must configure the OSS public endpoint.
Billing
Public network access is free during the public beta. Fees will apply once the beta concludes. Pricing details will be announced separately.
Enable public network access
For security reasons, public network access to DLF is disabled by default. To enable it, a DLF administrator performs the following steps:
Log on to the DLF consol
In the left-side navigation pane, choose Catalogs.
Click the target data catalog, then click the Catalog Configuration tab.
In the Advanced Settings section, set
enable.openapitotrue.
Configure public network access
Access Paimon tables over the public network
The following examples demonstrate connecting to a DLF Paimon catalog over the public network.
Endpoint format: https://dlfnext.${region-id}.aliyuncs.com. For region-specific endpoints, see Regions and endpoints.
Java
Options options = new Options();
// Configure the DLF public network endpoint
options.set("uri", "https://dlfnext.cn-hangzhou.aliyuncs.com");
options.set("warehouse", "paimon_test");
options.set("dlf.region", "cn-hangzhou");
options.set("dlf.access-key-id", "<Your AccessKey ID>");
options.set("dlf.access-key-secret", "<Your AccessKey Secret>");
// You must configure the OSS public network endpoint
options.set("dlf.oss-endpoint", "oss-cn-hangzhou.aliyuncs.com");
options.set("token.provider", "dlf");
Catalog restCatalog = new RESTCatalog(CatalogContext.create(options));The following table lists the configuration parameters for Java.
Parameter | Description | Example |
uri | The public network endpoint for DLF OpenAPI. For region-specific values, see Regions and endpoints. | https://dlfnext.cn-hangzhou.aliyuncs.com |
warehouse | The name of the DLF data catalog. | paimon_test |
dlf.region | The region ID of the DLF service. | cn-hangzhou |
dlf.access-key-id | The AccessKey ID of your Alibaba Cloud account or RAM user. | - |
dlf.access-key-secret | The AccessKey Secret of your Alibaba Cloud account or RAM user. | - |
dlf.oss-endpoint | The OSS public network endpoint. For more information, see Regions and endpoints in the OSS documentation. | oss-cn-hangzhou.aliyuncs.com |
token.provider | The authentication provider. Set to | dlf |
Python
from pypaimon import CatalogFactory
options = {
# The Python client must specify the metastore type as rest
'metastore': 'rest',
'uri': 'https://dlfnext.cn-hangzhou.aliyuncs.com',
'warehouse': 'paimon_test',
'dlf.region': 'cn-hangzhou',
'dlf.access-key-id': '<Your AccessKey ID>',
'dlf.access-key-secret': '<Your AccessKey Secret>',
# Configure this parameter if you use STS temporary credentials
'dlf.security-token': '<Your Security Token>',
'dlf.oss-endpoint': 'oss-cn-hangzhou.aliyuncs.com',
'token.provider': 'dlf',
}
rest_catalog = CatalogFactory.create(options)The following table lists the configuration parameters for Python.
Parameter | Description | Example |
metastore | The metastore type. Fixed value: | rest |
uri | The public network endpoint for DLF OpenAPI. For region-specific values, see Regions and endpoints. | https://dlfnext.cn-hangzhou.aliyuncs.com |
warehouse | The name of the DLF data catalog. | paimon_test |
dlf.region | The region ID of the DLF service. | cn-hangzhou |
dlf.access-key-id | The AccessKey ID of your Alibaba Cloud account or RAM user. | - |
dlf.access-key-secret | The AccessKey Secret of your Alibaba Cloud account or RAM user. | - |
dlf.security-token | The STS security token. Not required when using a long-term AccessKey pair. | - |
dlf.oss-endpoint | The public network endpoint for OSS. For more information, see Regions and endpoints in the OSS documentation. | oss-cn-hangzhou.aliyuncs.com |
token.provider | The authentication provider. Set to | dlf |
Access Iceberg tables over the public network
The following examples demonstrate connecting to a DLF Iceberg catalog over the public network.
Endpoint format: https://dlfnext.${region-id}.aliyuncs.com/iceberg (the Paimon REST public endpoint with the /iceberg path appended). For region-specific endpoints, see Regions and endpoints.
Maven dependencies
Public network authentication and file IO are handled by dlf-iceberg-plugin, available from the DLF Maven repository. OSS data reads and writes require JindoSDK. Add the following dependencies to your project:
<properties>
<iceberg.version>1.10.1</iceberg.version>
<dlf-iceberg-plugin.version>1.2.0</dlf-iceberg-plugin.version>
<jindo.version>6.7.8</jindo.version>
</properties>
<repositories>
<!-- Repository for dlf-iceberg-plugin -->
<repository>
<id>dlf-mvn-repo</id>
<url>https://dlf-mvn-repo.oss-cn-shanghai.aliyuncs.com/mvn-repo/release/</url>
</repository>
<!-- JindoSDK repository -->
<repository>
<id>jindodata</id>
<url>https://jindodata-binary.oss-cn-shanghai.aliyuncs.com/mvn-repo/</url>
</repository>
</repositories>
<dependencies>
<!-- DLF Iceberg plugin: DlfRESTCatalog + RESTDLFAuthManager public network authentication + DlfFileIO -->
<dependency>
<groupId>org.apache.iceberg</groupId>
<artifactId>dlf-iceberg-plugin-1.10.1</artifactId>
<version>${dlf-iceberg-plugin.version}</version>
</dependency>
<!-- Apache Iceberg -->
<dependency>
<groupId>org.apache.iceberg</groupId>
<artifactId>iceberg-core</artifactId>
<version>${iceberg.version}</version>
</dependency>
<dependency>
<groupId>org.apache.iceberg</groupId>
<artifactId>iceberg-data</artifactId>
<version>${iceberg.version}</version>
</dependency>
<dependency>
<groupId>org.apache.iceberg</groupId>
<artifactId>iceberg-parquet</artifactId>
<version>${iceberg.version}</version>
</dependency>
<dependency>
<groupId>org.apache.iceberg</groupId>
<artifactId>iceberg-aws-bundle</artifactId>
<version>${iceberg.version}</version>
</dependency>
<dependency>
<groupId>org.apache.iceberg</groupId>
<artifactId>iceberg-aws</artifactId>
<version>${iceberg.version}</version>
</dependency>
<!-- OSS data reads and writes (JindoSDK) -->
<dependency>
<groupId>com.aliyun.jindodata</groupId>
<artifactId>jindo-sdk</artifactId>
<version>${jindo.version}</version>
</dependency>
<dependency>
<groupId>com.aliyun.jindodata</groupId>
<artifactId>jindo-core</artifactId>
<version>${jindo.version}</version>
</dependency>
</dependencies>Java
Map<String, String> options = new HashMap<>();
options.put("uri", "https://dlfnext.cn-hangzhou.aliyuncs.com/iceberg");
options.put("warehouse", "iceberg_test");
// Public network authentication: RESTDLFAuthManager
options.put("rest.auth.type", "org.apache.iceberg.rest.auth.RESTDLFAuthManager");
options.put("rest.signing-region", "cn-hangzhou");
options.put("rest.access-key-id", "your-access-key-id");
options.put("rest.secret-access-key", "your-access-key-secret");
// options.put("rest.session-token", "your-security-token"); // Configure when using STS temporary credentials
options.put("io-impl", "org.apache.iceberg.rest.DlfFileIO");
options.put("dlf.oss-endpoint", "oss-cn-hangzhou.aliyuncs.com");
// Use DlfRESTCatalog provided by dlf-iceberg-plugin
RESTCatalog catalog = new org.apache.iceberg.rest.DlfRESTCatalog();
catalog.initialize("dlf", options);The following table lists the configuration parameters.
Parameter | Description | Example |
uri | The public network endpoint for DLF Iceberg. Format: | https://dlfnext.cn-hangzhou.aliyuncs.com/iceberg |
warehouse | The name of the DLF data catalog. | iceberg_test |
rest.auth.type | The public network authentication method. Fixed value: | org.apache.iceberg.rest.auth.RESTDLFAuthManager |
rest.signing-region | The region ID of the DLF service. | cn-hangzhou |
rest.access-key-id | The AccessKey ID of your Alibaba Cloud account or RAM user. | - |
rest.secret-access-key | The AccessKey Secret of your Alibaba Cloud account or RAM user. | - |
rest.session-token | The STS security token. Not required when using a long-term AccessKey pair. | - |
io-impl | The file IO implementation. Fixed value: | org.apache.iceberg.rest.DlfFileIO |
dlf.oss-endpoint | The public network endpoint for OSS. For more information, see Regions and endpoints in the OSS documentation. | oss-cn-hangzhou.aliyuncs.com |