Describe the bug
The Python CLI setup export path serializes principal roles as names only. Principal roles support user-defined properties through the Management API and the standalone principal-roles create command, but polaris setup export discards those properties.
As a result, exporting a realm and applying that file to another realm silently recreates affected principal roles with empty properties. This makes setup exports incomplete as migration or backup artifacts.
Steps to reproduce
- Create a principal role with a property, for example
analytics with owner: data-platform.
- Run
polaris setup export > setup.yaml.
- Inspect
principal_roles in setup.yaml.
- Apply the exported file to another realm with
polaris setup apply setup.yaml.
- Read the recreated principal role through the Management API.
Minimal observed export:
principal_roles:
- analytics
The recreated role has {} for properties.
Actual behavior
setup export emits only each principal-role name, and setup apply consequently creates each role without properties.
Expected behavior
Setup export/apply should preserve principal-role properties while continuing to accept the existing string-list format for configuration files that do not specify properties.
Additional context
The same setup workflow already preserves properties for principals and catalog roles. This gap is specific to principal roles.
This is distinct from #5264 and #5265. That work preserved principal and catalog-role properties and explicitly kept the current principal-role list representation out of scope.
I verified the behavior against upstream main at commit 72346a332eb4f78e46795fbd8bf8074f4d071b91. I also searched the full issue and pull-request history for setup export, principal-role properties, metadata loss, YAML, backup, and round-trip variants, and inspected every currently open pull request. No existing issue or active pull request covers this defect.
System information
- Apache Polaris: upstream
main at 72346a332eb4f78e46795fbd8bf8074f4d071b91
- Client: Python CLI
- Reproduced with the CLI unit-test harness on macOS
Describe the bug
The Python CLI setup export path serializes principal roles as names only. Principal roles support user-defined
propertiesthrough the Management API and the standaloneprincipal-roles createcommand, butpolaris setup exportdiscards those properties.As a result, exporting a realm and applying that file to another realm silently recreates affected principal roles with empty properties. This makes setup exports incomplete as migration or backup artifacts.
Steps to reproduce
analyticswithowner: data-platform.polaris setup export > setup.yaml.principal_rolesinsetup.yaml.polaris setup apply setup.yaml.Minimal observed export:
The recreated role has
{}forproperties.Actual behavior
setup exportemits only each principal-role name, andsetup applyconsequently creates each role without properties.Expected behavior
Setup export/apply should preserve principal-role properties while continuing to accept the existing string-list format for configuration files that do not specify properties.
Additional context
The same setup workflow already preserves properties for principals and catalog roles. This gap is specific to principal roles.
This is distinct from #5264 and #5265. That work preserved principal and catalog-role properties and explicitly kept the current principal-role list representation out of scope.
I verified the behavior against upstream
mainat commit72346a332eb4f78e46795fbd8bf8074f4d071b91. I also searched the full issue and pull-request history for setup export, principal-role properties, metadata loss, YAML, backup, and round-trip variants, and inspected every currently open pull request. No existing issue or active pull request covers this defect.System information
mainat72346a332eb4f78e46795fbd8bf8074f4d071b91