Skip to content

You are viewing documentation for Immuta version 2022.1.

For the latest version, view our documentation for Immuta SaaS or the latest self-hosted version.

Configure Trino Integration

Audience: System Administrators

Content Summary: This page details how to install the Trino integration. Native Trino is only available with certain licenses, please see your Immuta representative for more information.

See the Trino Plugin Release Notes for the current supported versions.

1 - Enable Native Trino

  1. Click the App Settings icon in the left sidebar.
  2. Click Enable in the Trino Integration section.

    Dynamic Trino Enable

  3. Click Save.

The catalog configuration displayed in this section will need to be written out on all Trino nodes (/etc/trino/config/catalog/immuta.properties).

2 - Install Dynamic Trino Plugin

Best Practice: Immuta Archives Access Required

A user with access to Immuta's Archives site is required to conduct the download in this step. Credentials to access the site can be obtained by visiting the Immuta Download Site and logging in with your Immuta Accounts credentials. At the very bottom of the page is an All Archives section with a here link that will take you directly to the archives site with your account credentials already applied.

  1. Download the latest version of the plugin from Immuta's Archives site.

  2. Follow Trino's documentation to install the plugin:

    • Create this directory: /usr/lib/trino/plugin/immuta.
    • Upload immuta-trino.zip to the directory.
  3. Install the Immuta Trino plugin on all Trino nodes within your cluster.

3 - Create an Immuta Catalog

Best Practice: Trino Database Structure

The top level is set based on the name of the catalog properties files in the /etc/trino/catalog directory. Use the name immuta.properties for this file, which will result in a Trino catalog named “immuta.”

  1. Follow Trino's documentation to create this catalog directory: /etc/trino/config/catalog.

  2. To configure the Immuta connector, mount the Immuta connector as the Immuta catalog: Create an immuta.properties file with the following contents, replacing the connection properties with your Trino Cluster Configuration displayed on the App Settings page:

    connector.name=immuta
    immuta.endpoint=https://your-immuta-url.com/
    immuta.apikey=<your-api-key>
    

TLS Certificates

TLS Certificate Generation

If you provided your own TLS certificates during Immuta installation, you must ensure that the hostname in your certificate matches the hostname specified in the Starburst (Trino) configuration.

If you did not provide your own TLS certificates, Immuta generated these certificates for you during installation. See notes about your specific deployment method below for details.

  • Kubernetes Deployment: Immuta generates a local certificate authority (CA) that signs certificates for each service by default. Ensure that the externalHostname you specified in the Immuta Helm Chart matches the Immuta hostname name specified in the Starburst (Trino) configuration.

  • Single Node Docker Deployment: Ensure that the hostname you specified in the immuta.toml file matches the Immuta hostname name specified in the Starburst (Trino) configuration. If you did not specify this property in the immuta.toml file, the installation script sets it for you based on the hostname of the server where you ran the script.

If the hostnames in your certificate don't match the hostname specified in your Starburst (Trino) integration, you can set immuta.disable-hostname-verification to true to get the integration working in the interim.

The Starburst (Trino) integration uses the immuta.ca-file property to communicate with Immuta. Specify a path to your CA file using the immuta.ca-file property.

Optional Parameters

You can include any of these parameters in your immuta.properties file to customize your integration.

  • immuta.ca-data The base64-encoded CA certificate to use when making calls to the Immuta Web Service.
  • immuta.ca-file: The path to a CA file to use when making calls to the Immuta Web Service.
  • immuta.cache.audit.seconds: The amount of time in seconds audit-related query metadata should be cached in the Immuta Metadata Database. If you customize this value, it should be set to a value longer than the longest running query you plan to execute against the Immuta catalog (The default is 24 hours.).
  • immuta.cache.datasources.seconds: The amount of time in seconds a user's available data sources will be cached. Changing this will impact how quickly available data sources will show up when updating projects or subscriptions.
  • immuta.cache.views.seconds: The amount of time in seconds that a user's view of a data source will be cached. Changing this will impact how quickly policy changes are reflected for users actively querying.
  • immuta.disable-hostname-verification: Disable hostname verification when connecting to the Immuta Web Service.
  • immuta.error-on-audit-failure: When set to true, error out when an Immuta audit record can not be created. Only used when the Event Listener is enabled.

4 - Configure Event Listener on Your Cluster

  1. Create an event-listener.properties file in this directory: /etc/trino/. For more details, see Trino's Event Listener documentation.
  2. Copy the Event Listener Configuration items from the App Settings page and paste it in the event-listener.properties file:

    Dynamic Trino Event Listener

5 - Configure Trino to Block Access

Best Practice: Give Users read-only Access to Immuta Catalog

Give users read-only access to the Immuta catalog. This will prevent users from describing the views, which in turn prevents them from seeing secrets involved in some masking policies.

Follow Trino's System Access Control documentation to configure Trino to block access to any catalog that is not Immuta so that all user access has policies enacted on it.