Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

In a 2026 test of Apache Iceberg Rust’s iceberg-catalog-rest 0.10.1, the client could express 13 of 25 selected catalog endpoints and authenticate to five of seven catalog services. The reported results were strongest for Apache Polaris, Google BigLake, and Microsoft OneLake. AWS Glue and S3 Tables required AWS SigV4 signing that this REST client did not provide; Databricks Unity Catalog and Snowflake Horizon were not tested. These findings describe one version, test setup, and set of runs—not a guarantee of compatibility with every Iceberg catalog or a later crate release.

What was tested—and what “reach” means

The test focused on the Rust crate iceberg-catalog-rest 0.10.1, alongside iceberg 0.10.1. The reported build used iceberg-storage-opendal 0.10.1, reqwest 0.12.28 with rustls-tls, and rustc 1.98.1. The article’s source review was dated September 4, 2026; it recorded versions on September 17, ran catalog checks on September 18, and performed a local write run on September 21.

Here, “reach” has two separate meanings: whether the Rust client can make a catalog request that the service answers, and whether the application can subsequently read the table’s metadata or data files from storage. A successful catalog response is not proof that the storage path works.

The author selected 25 distinct endpoints to check. The REST crate could express 13; 11 were absent and one existing method was a stub. That is a count for this selected endpoint set, not coverage of the entire Iceberg REST API. Counting individual probes instead gives the author’s reported 19 of 33 checks, because five checks exercise the same update_table endpoint. For API capability coverage, the distinct-endpoint count is the more useful one.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Results across the seven catalogs

Catalog Evidence in the report Result with the tested REST client
Apache Polaris Run locally Seven supported reads and 11 writes received responses. A local table-file read also succeeded. The Polaris configuration was permissive.
Google BigLake Managed service run Seven supported reads received responses using a token minted with gcloud. A GCS-backed metadata read succeeded.
Microsoft OneLake Managed service run Seven supported reads received responses using a token obtained with az. The attempt to read the table metadata file timed out.
AWS Glue Signature experiment only Requests were refused in the tested setup because the REST client did not sign catalog requests with AWS SigV4. The Rust project has a separate Glue catalog crate.
Amazon S3 Tables Signature experiment only Requests were refused in the tested setup because the REST client did not sign catalog requests with AWS SigV4. The Rust project has a separate S3 Tables catalog crate.
Databricks Unity Catalog Not run No service result was measured; the article’s comparison was based on source review.
Snowflake Horizon Not run No service result was measured; the article’s comparison was based on source review.

The counts and outcomes in this table are the author’s observations, not an independently reproduced benchmark. The managed-service checks took place in one machine and one region. The article does not report versions for those managed catalogs.

What the results say about each integration path

Polaris, BigLake, and OneLake: requests can work without proving full table access

For Polaris, BigLake, and OneLake, the author reports that each of the seven supported read operations tested received a response. The authentication paths were not identical: the local Polaris setup used its configured credentials, while the BigLake and OneLake checks used externally minted gcloud and az tokens respectively. These successful responses show that the tested client and credentials could reach those catalog APIs for the supported operations; they do not establish complete API coverage or semantic correctness of every returned value.

The different storage outcomes matter when planning an application. The author reports a successful local file read for Polaris and a successful GCS-backed metadata read for BigLake. OneLake’s catalog calls answered, but its metadata-file read attempt timed out. The article attributes the distinction to the separate storage-access path and notes that the test did not use catalog-issued storage credentials. That OneLake outcome is specific to the reported setup; it does not establish that OneLake table reads always time out.

Glue and S3 Tables: use the AWS-specific Rust crates for the tested versions

The reported failure was not evidence that Glue or S3 Tables lacks Iceberg REST behavior. It was an authentication mismatch: the tested REST crate could not sign AWS catalog requests with SigV4. A static header cannot substitute for a request signature, because the signature is bound to the particular request.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The Apache Iceberg Rust project lists separate catalog implementations for Glue and S3 Tables in addition to the REST crate. For a Rust application targeting these AWS catalogs, those catalog-specific crates are the described route rather than trying to make the tested REST client impersonate an AWS-signed client. Their operation behavior differed from the REST crate and from one another in the version examined, so switching crates does not imply identical API coverage or semantics.

Unity Catalog and Horizon: no compatibility verdict from this test

The article did not run Databricks Unity Catalog or Snowflake Horizon. Its rows for these services were based on source inspection, not live catalog requests. Treat them as unanswered by this test rather than as either supported or unsupported.

Catalog authentication and storage credentials are different problems

The REST crate supported OAuth, token, and header-based authentication paths in the setup described by the author. That flexibility explains how the tested client could use externally obtained cloud tokens, but it does not supply every provider’s signing protocol. In particular, the REST specification’s support for storage credentials or remote-signing configuration does not itself mean this pinned Rust REST client can SigV4-sign requests to the AWS catalog APIs.

After catalog access, the application still needs a working storage implementation and credentials for the locations referenced by the table. The test used the OpenDAL storage crate for cloud table loading, and its OneLake result demonstrates why catalog success and file access should be checked independently. Apache Iceberg’s REST specification evolves; capabilities described by the current specification should not be assumed to exist in a particular older client release.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What to verify before choosing this client

  1. Pin the versions you plan to deploy. The reported combination was iceberg and iceberg-catalog-rest 0.10.1, iceberg-storage-opendal 0.10.1, reqwest 0.12.28 with rustls-tls, and rustc 1.98.1. Check the release you use rather than treating a mutable project branch as equivalent to 0.10.1.
  2. Match authentication to the catalog. Determine whether the service accepts the token or headers your application can provide, or requires request signing the REST crate does not implement in the tested version. For AWS Glue and S3 Tables, evaluate the separate Rust catalog crates.
  3. Check the operations your application actually calls. The reported 13-of-25 figure is a bounded endpoint inventory. Compare your required calls with the methods available in your chosen release, and do not count a stub as a working operation.
  4. Test catalog and storage paths separately. Confirm that the catalog returns the expected table information, then try reading the metadata and data files using the storage backend and credentials your application will use.
  5. Validate the real service configuration. The Polaris instance in the report used permissive settings, and the cloud runs were limited to one machine and region. Authentication, authorization, network, and storage behavior in another deployment may differ.

Version-sensitive Rust setup details

The test article’s build notes say enabling a reqwest TLS feature in the consuming application was part of its HTTPS setup. Separately, the official Apache Iceberg Rust issue tracker described adding TLS features to the REST crate as an open enhancement at the time of the article. Because TLS configuration can change across releases, verify the feature requirements for the exact crate version in your dependency tree.

The Apache Iceberg Rust project describes itself as “a Rust implementation of Apache Iceberg.” Its repository separates REST, Glue, and S3 Tables catalog components; those project components and their behavior can change over time. The findings above apply to the versions and runs reported by xbill in the 2026 DEV Community article, not automatically to later releases.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.