Skip to content

Configure Starburst (Trino) Integration

Audience: System Administrators

Content Summary: This page details how to configure the Starburst (Trino) integration.

Overview

The plugin comes pre-installed with Starburst Enterprise, so this page provides separate sets of guidelines for configuration:

Starburst Cluster Configuration

Installation Method

This installation method is only available to users on Starburst Enterprise. If you are using any other form of Trino, see the Trino Cluster Configuration section.

Prerequisite

The Starburst ODBC driver must be uploaded on the App Settings page.

1 - Enable the Integration

  1. Click the App Settings icon in the left sidebar.
  2. Scroll to the Native Integrations section and click Add Native Integration.
  3. Select Trino from the Native Integration Type dropdown menu.

    Trino Enable

  4. Click Save.

2 - Configure the Immuta Connector

Follow Starburst's documentation to configure the Immuta connector.

3 - Configure the Event Listener

  1. Create an etc/event-listener.properties file. For more details, see Starburst's Event Listener documentation.
  2. Copy the Event Listener Configuration items from the App Settings page and paste it in the event-listener.properties file:

    Trino Event Listener

4 - Configure Starburst to Block Access

Best Practice: Give Users read-only Access to Immuta Catalog

Give users read-only access to the Immuta catalog. This will prevent users from describing the views, which in turn prevents them from seeing secrets involved in some masking policies.

Follow Starburst's System Access Control documentation to configure Starburst to block access to any catalog that is not Immuta so that all user access has policies enacted on it.

Trino Cluster Configuration

Prerequisite

Review the Trino Plugin Release Notes for the current supported versions.

1 - Enable the Integration

  1. Click the App Settings icon in the left sidebar.
  2. Scroll to the Native Integrations section and click Add Native Integration.
  3. Select Trino from the Native Integration Type dropdown menu.

    Trino Enable

  4. Click Save.

The catalog configuration displayed in this section will need to be written out on all nodes (/etc/trino/config/catalog/immuta.properties).

2 - Install the Plugin

Best Practice: Immuta Archives Access Required

A user with access to Immuta's Archives site is required to conduct the download in this step. Credentials to access the site can be obtained by visiting the Immuta Download Site and logging in with your Immuta Accounts credentials. At the very bottom of the page is an All Archives section with a here link that will take you directly to the archives site with your account credentials already applied.

  1. Download the latest version of the plugin archive from Immuta's Archives site.

  2. Follow Trino's documentation to install the plugin archive on all nodes in your cluster:

    • For Docker installations, extract the archive to a local directory and mount the local directory to /usr/lib/trino/plugin/immuta in the Docker container.
    • For standalone installations, extract the archive to the plugin/immuta directory in the Trino installation directory.
  3. Install the plugin on all nodes within your cluster.

3 - Create an Immuta Catalog

  1. Follow Trino's documentation to create this catalog directory: /etc/trino/config/catalog.

  2. To configure the Immuta connector, mount the Immuta connector as the Immuta catalog: Create an immuta.properties file with the following contents, replacing the connection properties with your Trino Cluster Configuration displayed on the App Settings page:

    connector.name=immuta
    immuta.endpoint=https://your-immuta-url.com/
    immuta.apikey=<your-api-key>
    

Best Practice: Trino Database Structure

The top level is set based on the name of the catalog properties files in the /etc/trino/catalog directory. Use the name immuta.properties for this file, which will result in a Trino catalog named “immuta.”

4 - Configure the Event Listener

  1. Create an event-listener.properties file in this directory: /etc/trino/. For more details, see Trino's Event Listener documentation.
  2. Copy the Event Listener Configuration items from the App Settings page and paste it in the event-listener.properties file:

    Trino Event Listener

5 - Configure Trino to Block Access

Best Practice: Give Users read-only Access to Immuta Catalog

Give users read-only access to the Immuta catalog. This will prevent users from describing the views, which in turn prevents them from seeing secrets involved in some masking policies.

Follow Trino's System Access Control documentation to configure Trino to block access to any catalog that is not Immuta so that all user access has policies enacted on it.