From 747d9691acea1f2a673d5df075dd1ee2608f4804 Mon Sep 17 00:00:00 2001
From: Marvin Froeder <marvin@datasqrl.com>
Date: Wed, 5 Aug 2026 15:41:15 -0300
Subject: [PATCH 1/3] Pin AWS SDK to 2.44.4 to match the copy bundled in
 iceberg-aws-bundle

Signed-off-by: Marvin Froeder <marvin@datasqrl.com>
---
 pom.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pom.xml b/pom.xml
index b5ec69ff..90381363 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,6 +101,11 @@
     <auto.service.version>1.1.1</auto.service.version>
     <awaitility.version>4.3.0</awaitility.version>
     <aws-msk-iam-auth.version>2.3.7</aws-msk-iam-auth.version>
+    <!-- Must match the AWS SDK bundled inside iceberg-aws-bundle:${iceberg.version}; both land
+         unrelocated on the Flink system classpath, so a version skew is resolved first-wins.
+         Verify after an iceberg bump:
+           unzip -p iceberg-aws-bundle-<ver>.jar META-INF/maven/software.amazon.awssdk/sts/pom.properties -->
+    <awssdk.version>2.44.4</awssdk.version>
     <classgraph.version>4.8.186</classgraph.version>
     <commons-exec.version>1.6.0</commons-exec.version>
     <commons-math3.version>3.6.1</commons-math3.version>
@@ -165,6 +170,14 @@
         <scope>import</scope>
       </dependency>
 
+      <dependency>
+        <groupId>software.amazon.awssdk</groupId>
+        <artifactId>bom</artifactId>
+        <version>${awssdk.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>com.google.auto.service</groupId>
         <artifactId>auto-service</artifactId>

From b1e2a160ab31802181b9dab89d2a9cbb23542c99 Mon Sep 17 00:00:00 2001
From: Marvin Froeder <marvin@datasqrl.com>
Date: Wed, 5 Aug 2026 16:03:49 -0300
Subject: [PATCH 2/3] Document why core-site.xml depends on the unshaded AWS
 SDK v1 class name

Signed-off-by: Marvin Froeder <marvin@datasqrl.com>
---
 flink-sql-runner/src/main/docker/Dockerfile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/flink-sql-runner/src/main/docker/Dockerfile b/flink-sql-runner/src/main/docker/Dockerfile
index 7ad79e84..980e75d3 100644
--- a/flink-sql-runner/src/main/docker/Dockerfile
+++ b/flink-sql-runner/src/main/docker/Dockerfile
@@ -57,6 +57,14 @@ COPY flink-sql-runner.uber.jar /opt/flink/lib/sql-runner.uber.jar
 COPY --chmod=755 sql-runner /opt/flink/bin/sql-runner
 COPY --chmod=755 entrypoint.sh /entrypoint.sh
 
+# noop.jar is an empty JAR. `flink run` requires a JAR positional argument, but the runner code
+# ships on the system classpath in lib/ (see bin/sql-runner), so this only satisfies the CLI.
+#
+# core-site.xml: Hadoop 3.3.4's default S3A credential chain omits WebIdentityTokenCredentialsProvider,
+# which IRSA needs on EKS (#290). The class named below is AWS SDK v1 and is deliberately the
+# *unrelocated* name -- flink-s3-fs-hadoop ships com/amazonaws/** unshaded, which is the only reason
+# this resolves. If that JAR is ever shaded, this silently stops applying and S3A IRSA breaks again.
+# Unrelated to MSK IAM auth, which uses the separate AWS SDK v2 (software.amazon.awssdk) chain.
 RUN echo 'UEsDBBQACAgIAG2UllwAAAAAAAAAAAAAAAAUAAQATUVUQS1JTkYvTUFOSUZFU1QuTUb+ygAA803My0xLLS7RDUstKs7Mz7NSMNQz4HIuSk0sSU3Rdaq0UkjLyczL1i0uzNEtKs3LSy3i4gIAUEsHCL/cUjU2AAAANAAAAFBLAQIUABQACAgIAG2Ully/3FI1NgAAADQAAAAUAAQAAAAAAAAAAAAAAAAAAABNRVRBLUlORi9NQU5JRkVTVC5NRv7KAABQSwUGAAAAAAEAAQBGAAAAfAAAAAAA' | base64 -d > /opt/flink/noop.jar \
     && mkdir -p /opt/flink/hadoop-conf \
     && echo '<configuration><property><name>fs.s3a.aws.credentials.provider</name><value>com.amazonaws.auth.DefaultAWSCredentialsProviderChain</value></property></configuration>' > /opt/flink/hadoop-conf/core-site.xml \

From e653c81624471d6cd3a50ee4cf0eeb3572c21f56 Mon Sep 17 00:00:00 2001
From: Ferenc Csaky <ferenc@datasqrl.com>
Date: Thu, 6 Aug 2026 09:25:44 +0200
Subject: [PATCH 3/3] cut back the chatty ai comments

---
 flink-sql-runner/src/main/docker/Dockerfile | 6 ------
 pom.xml                                     | 7 ++-----
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/flink-sql-runner/src/main/docker/Dockerfile b/flink-sql-runner/src/main/docker/Dockerfile
index 980e75d3..0d2815e0 100644
--- a/flink-sql-runner/src/main/docker/Dockerfile
+++ b/flink-sql-runner/src/main/docker/Dockerfile
@@ -59,12 +59,6 @@ COPY --chmod=755 entrypoint.sh /entrypoint.sh
 
 # noop.jar is an empty JAR. `flink run` requires a JAR positional argument, but the runner code
 # ships on the system classpath in lib/ (see bin/sql-runner), so this only satisfies the CLI.
-#
-# core-site.xml: Hadoop 3.3.4's default S3A credential chain omits WebIdentityTokenCredentialsProvider,
-# which IRSA needs on EKS (#290). The class named below is AWS SDK v1 and is deliberately the
-# *unrelocated* name -- flink-s3-fs-hadoop ships com/amazonaws/** unshaded, which is the only reason
-# this resolves. If that JAR is ever shaded, this silently stops applying and S3A IRSA breaks again.
-# Unrelated to MSK IAM auth, which uses the separate AWS SDK v2 (software.amazon.awssdk) chain.
 RUN echo 'UEsDBBQACAgIAG2UllwAAAAAAAAAAAAAAAAUAAQATUVUQS1JTkYvTUFOSUZFU1QuTUb+ygAA803My0xLLS7RDUstKs7Mz7NSMNQz4HIuSk0sSU3Rdaq0UkjLyczL1i0uzNEtKs3LSy3i4gIAUEsHCL/cUjU2AAAANAAAAFBLAQIUABQACAgIAG2Ully/3FI1NgAAADQAAAAUAAQAAAAAAAAAAAAAAAAAAABNRVRBLUlORi9NQU5JRkVTVC5NRv7KAABQSwUGAAAAAAEAAQBGAAAAfAAAAAAA' | base64 -d > /opt/flink/noop.jar \
     && mkdir -p /opt/flink/hadoop-conf \
     && echo '<configuration><property><name>fs.s3a.aws.credentials.provider</name><value>com.amazonaws.auth.DefaultAWSCredentialsProviderChain</value></property></configuration>' > /opt/flink/hadoop-conf/core-site.xml \
diff --git a/pom.xml b/pom.xml
index 90381363..23f794a1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,12 +100,9 @@
     <assertj.version>3.27.7</assertj.version>
     <auto.service.version>1.1.1</auto.service.version>
     <awaitility.version>4.3.0</awaitility.version>
-    <aws-msk-iam-auth.version>2.3.7</aws-msk-iam-auth.version>
-    <!-- Must match the AWS SDK bundled inside iceberg-aws-bundle:${iceberg.version}; both land
-         unrelocated on the Flink system classpath, so a version skew is resolved first-wins.
-         Verify after an iceberg bump:
-           unzip -p iceberg-aws-bundle-<ver>.jar META-INF/maven/software.amazon.awssdk/sts/pom.properties -->
+    <!-- AWS SDK must be kept in sync with the version defined in "iceberg-aws-bundle" -->
     <awssdk.version>2.44.4</awssdk.version>
+    <aws-msk-iam-auth.version>2.3.7</aws-msk-iam-auth.version>
     <classgraph.version>4.8.186</classgraph.version>
     <commons-exec.version>1.6.0</commons-exec.version>
     <commons-math3.version>3.6.1</commons-math3.version>