Skip to content

Single Node Docker Advanced Configuration

Audience: System Administrators

Content Summary: This page contains the advanced configuration options for a Single Node Docker.

Ensure immuta.toml is present

Prior to executing any of the snd commands below, ensure an immuta.toml configuration file has been created.

If not created, refer to instructions in Single Node Docker Install, Step 1.

Custom pg_hba.conf Rules

Note

The following set of instructions presume Immuta is running.

To support Query Engine Authentication, the Single Node Docker installation provides a method to configure your own pg_hba.conf rules. Custom pg_hba.conf rules are appended to the top of the default pg_hba.conf file. pg_hba.conf rules are evaluated from top to bottom, selecting the first match. See the instructions below for enabling custom pg_hba.conf rules:

  1. Set IMMUTA_HOME and change into it (by default /opt/immuta):

    export IMMUTA_HOME="/opt/immuta"
    cd "${IMMUTA_HOME:?}"
    
  2. Create a text-file containing your pg_hba.conf rules at ${IMMUTA_HOME}/volumes/immuta-db/custom_pg_hba.conf.

    custom_pg_hba.conf

    host immuta +<IAMID>_user 0.0.0.0/0 ldap ldapserver="<LDAP SERVER>" ldapbinddn="<BIND DN>" ldapbindpasswd="<BIND PASSWORD>" ldapbasedn="<BASE DN>" ldapsearchfilter="<LDAP SEARCH FILTER>"
    
  3. Set permissions for custom_pg_hba.conf.

    chown 1000:1000 "${IMMUTA_HOME}/volumes/db/custom_pg_hba.conf"
    chmod 600 "${IMMUTA_HOME}/volumes/db/custom_pg_hba.conf"
    
  4. Add the following two key/value pairs to dictionary: db in immuta.toml.

    [db]
    
    environment = [
        CUSTOM_PG_HBA_FILE="/var/run/immuta/custom_pg_hba.conf"
    ]
    
    volumes = [
        "/opt/immuta/volumes/immuta-db/custom_pg_hba.conf:/var/run/immuta/custom_pg_hba.conf"
    ]
    
    Note

    If using a custom install path be sure to update the absolute path in toml key volumes.

  5. Remove immuta-db container.

    immuta-snd down immuta-db
    
  6. Create a new immuta-db container with the changes applied.

    immuta-snd init
    
    Note

    immuta-snd is smart enough to know the remaining Immuta containers (i.e., immuta-service, immuta-db) are healthy. They will not be touched when init is invoked.

  7. Start immuta-db container.

    immuta-snd start immuta-db