Home
Arenadata Hyperwave
Services
Trino
Integrations
Kubernetes
Arenadata Cloud CLI
Configure Ranger for Trino on Kubernetes

Configure Ranger for Trino on Kubernetes using CLI

Sergei Tikhomirov

Collapse content Expand content

Contents

Prerequisites
Step 1. Create a service in Ranger
Step 2. Update the Trino cluster configuration

Prerequisites

An ADPS cluster (2.0.0 or later) is installed and running.
An ADH cluster (4.2.0 or later) is installed and running.
Trino is installed according to the instruction.

Step 1. Create a service in Ranger

This guide describes how to create a service via Ranger REST API. Alternatively, you can create a service in the Ranger web UI.

Define a service in a JSON file:

ranger-trino-k8s.json

{
  "isEnabled": true,
  "type": "trino",
  "name": "trino_k8s", (1)
  "displayName": "trino_k8s",
  "description": "Service for Kubernetes Trino",
  "configs": {
    "username": "trino", (2)
    "password": "bigdata",  (3)
    "ranger.plugin.audit.filters": "[{'accessResult':'DENIED','isAudited':true},{'isAudited':false,'resources':{'queryid':{'values':['*']}},'accessTypes':['execute']},{'isAudited':false,'resources':{'trinouser':{'values':['{USER}']}},'accessTypes':['impersonate']}]",
    "jdbc.driverClassName": "io.trino.jdbc.TrinoDriver",
    "jdbc.url": "jdbc:trino://10.92.42.219" (4)
  }
}

1	A name of the Trino service in Ranger. Must be unique.
2	A username for the service.
3	A password for the service.
4	A JDBC string for connecting to Trino exposed by Ingress or load balancer.

Push the defined service to Ranger:

$ curl -u admin:<admin_pwd> -H "Content-Type: application/json" -X POST -d @ranger-trino-k8s.json http://<ranger-admin>:6080/service/public/v2/api/service

Step 2. Update the Trino cluster configuration

Edit the trino-cluster.yaml configuration file by adding the Ranger configuration block:

trino-cluster.yaml

apiVersion: adc.arenadata.io/v1alpha1
kind: TrinoCluster
metadata:
  name: trino
  namespace: trino (1)
spec:
  image: hub.arenadata.io/adc-enterprise/trino:<tag> (2)

  ## Image pull secret for a private registry.
  ## Set 'externalSecretName' to reference an existing Secret,
  ## or set 'credentials' and optionally 'secretName' to let the CLI create one.
  #imagePullSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-registry-secret
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-registry-secret
  #
  #  #credentials:
  #  #  registry: registry.example.com
  #  #  username: user
  #  #  password: pass

  hadoop: (3)
    core:
      dfs.client.failover.proxy.provider.adh: org.apache.hadoop.hdfs.server.namenode.ha.ObserverReadProxyProvider
      dfs.ha.namenodes.adh: nn_tsn-adh-k8s-1,nn_tsn-adh-k8s-3
      dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:8020
      dfs.namenode.rpc-address.adh.nn_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:8020
      dfs.nameservices: adh
      fs.defaultFS: hdfs://adh
      fs.s3a.aws.credentials.provider: org.apache.hadoop.fs.s3a.SimpleAWSCredentialsProvider
      hadoop.proxyuser.trino.groups: '*'
      hadoop.proxyuser.trino.hosts: '*'
      hadoop.security.authentication: simple
    hdfs:
      dfs.client.read.shortcircuit: "false"
    hive:
      hive.metastore.sasl.enabled: "false"
      hive.metastore.uris: thrift://tsn-adh-k8s-1.ru-central1.internal:9083
      metastore.use.SSL: "false"
    ozone:
      ozone.om.address.adh.om_tsn-adh-k8s-1: tsn-adh-k8s-1.ru-central1.internal:9862
      ozone.om.address.adh.om_tsn-adh-k8s-2: tsn-adh-k8s-2.ru-central1.internal:9862
      ozone.om.address.adh.om_tsn-adh-k8s-3: tsn-adh-k8s-3.ru-central1.internal:9862
      ozone.om.nodes.adh: om_tsn-adh-k8s-1,om_tsn-adh-k8s-2,om_tsn-adh-k8s-3
      ozone.om.service.ids: adhom

  ## Kerberos configuration for authentication.
  #kerberos:
  #  realm: EXAMPLE.COM
  #
  #  # Service name in the Kerberos principal. Defaults to the product name.
  #  service: trino
  #
  #  # Hostname in the Kerberos principal.
  #  # Required for a fixed service principal; leave it empty only to derive one principal per pod from the cluster domain.
  #  hostname: kerberos.example.com
  #  keytab:
  #    # true - kerberos-operator creates the keytab Secret.
  #    # false (default) - reference an existing keytab Secret with name keytab.secretName.
  #    create: false
  #
  #    # Name of the keytab Secret.
  #    # Optional when create: true - names the generated Secret (default: <name>-keytab).
  #    # Required when create: false - must reference an existing Secret.
  #    secretName: kerberos-secret
  #
  #    # Label selector for the Pod that generates the keytab.
  #    # Required when create: true; ignored when create: false.
  #    labelSelector:
  #      env: prod
  #    #additionalPrincipals:
  #    #  - HTTP/kerberos.example.com
  #
  #    rotation:
  #      interval: 24h
  #      checkInterval: 1h

  ## LDAP authentication configuration.
  ## Uncomment and fill url and userBindPattern.
  ## For ldaps:// URLs the ssl: or ca: section must also be configured (depends on product)
  #ldap:
  #  # LDAP service url.
  #  url: ldaps://ldap.example.com:636
  #
  #  # LDAP user Bind pattern.
  #  userBindPattern: uid=${USER},cn=users,dc=example,dc=com

  ## Ranger plugin configuration.
  ## Uncomment and fill the lines below. adc apply derives the rest.
  ranger: (4)
  #  # fill ranger.plugin.trino.policy.rest.url below with Ranger endpoint, e.g. https://adps-adc.ru-central1.internal:6182
  #  # fill ranger.plugin.trino.service.name below with Ranger service name you want to use for product, e.g. adc_trino_id_1
    security:
      ranger.plugin.trino.policy.rest.url: "<ranger-admin>:6080"
      ranger.plugin.trino.service.name: "trino_k8s"
      ranger.plugin.trino.use.rangerGroups: "True"
      ranger.plugin.trino.use.only.rangerGroups: "True"
  #
  #  # fill xasecure.audit.destination.solr.zookeepers below with Zookeepers endpoints to resolve solr service, e.g. adps-adc.ru-central1.internal:2181/Arenadata.Hadoop-2.solr.server
    audit:
      xasecure.audit.destination.solr.zookeepers: "tsn-adps2-1.ru-central1.internal:2181/Arenadata.Hadoop-3.solr.server"
  #
  #  # Local Ranger files 'adc apply' writes into the configs Secret.
  #  # Relative paths are resolved against the config file.
    files: (5)
      jceksStorePath: ranger-trino.jceks

  ## Java KeyStore/TrustStore certificate configuration.
  ## Set externalSecretName to reference an existing Secret,
  ## or set files and optional secretName to have ADC create it.
  #ssl:
  #  ## Name of the Secret containing Java keystores.
  #  #secretName: custom-ssl-secret
  #  externalSecretName: existing-ssl-secret
  #
  #  # Key in the Secret containing the truststore file.
  #  trustStoreKey: truststore.jks
  #
  #  ## Password for the truststore (optional).
  #  #trustStorePassword: bigdata
  #
  #  ## Key in the Secret containing the keystore file (optional).
  #  #keyStoreKey: keystore.jks
  #
  #  ## Password for the keystore (optional).
  #  #keyStorePassword: bigdata
  #
  #  ## Alias of the key entry inside the keystore. Required by the Trino JMX exporter when scrape TLS is enabled.
  #  #keyStoreAlias: trino
  #
  #  ## Local files 'adc apply' puts into the Secret named by ssl.secretName.
  #  ## Relative paths are resolved against the config file.
  #  #files:
  #  #  trustStorePath: /path/to/truststore.jks
  #  #  #keyStorePath: /path/to/keystore.jks

  ## Use an external complete configs Secret instead of the one rendered by ADC.
  #configsSecret:
  #  # Use a Secret managed outside ADC.
  #  externalSecretName: existing-trino-configs
  #
  #  ## Or let ADC create the Secret.
  #  #secretName: custom-trino-configs

  coordinator:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: 500m
    #    memory: 4Gi
    #  requests:
    #    cpu: 250m
    #    memory: 512Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  http-server.http.port: "8080"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata
  worker:
    replicas: 1
    #resources:
    #  limits:
    #    cpu: 500m
    #    memory: 4Gi
    #  requests:
    #    cpu: 250m
    #    memory: 512Mi

    ## Component arguments. Key-value pairs passed to the component configuration.
    #args:
    #  http-server.http.port: "8080"

    ## Environment variables passed to the component container.
    #envs:
    #  - name: JAVA_TOOL_OPTIONS
    #    value: |-
    #      -Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks
    #      -Djavax.net.ssl.trustStorePassword=bigdata

  ## Trino catalogs (one entry per .properties file).
  ## adc apply derives Kerberos/SSL fields for iceberg catalogs from the surrounding cluster config.
  catalogs: (6)
    iceberg.properties:
      connector.name: iceberg
      fs.hadoop.enabled: "true"
      hive.config.resources: /opt/trino-server/etc/catalog/core-site.xml
      hive.hdfs.impersonation.enabled: "true"
      hive.metastore.thrift.impersonation.enabled: "true"
      hive.metastore.uri: thrift://tsn-adh-k8s-1.ru-central1.internal:9083

  ## Monitoring configuration.
  #monitoring:
  #  # Enables Prometheus metrics export from this product's pods.
  #  exportMetrics: true

  ## HTTPS on the Trino coordinator web endpoint.
  ## Set externalSecretName to reference a keystore Secret,
  ## or set files and optional secretName to have ADC create it.
  #webTLS:
  #  #secretName: custom-trino-web-tls
  #  externalSecretName: existing-trino-web-tls
  #  keystoreKey: keystore.p12
  #  #keystorePassword: changeit
  #
  #  ## Local keystore 'adc apply' puts into the Secret named by webTLS.secretName.
  #  ## A relative path is resolved against the config file.
  #  #files:
  #  #  keystorePath: ./keystore.p12

  ## Controls whether Secret/ConfigMap changes restart pods.
  ## Set enabled: false to update referenced Secrets without restarting
  ## the workload; pods keep running the previous configuration until
  ## the policy is re-enabled. Defaults to enabled.
  #configurationRollout:
  #  enabled: false

1	Namespace that the Trino cluster will use.
2	Settings for pulling the Trino cluster image.
3	Hadoop settings that were taken from the previously created hadoop_conf.yaml.
4	Ranger configuration.
5	Additional JCEKS file if Ranger is used along with SSL.
6	Iceberg catalog settings.

To generate the JCEKS file, run the following command on a host with Ranger Admin:

$ java -cp "/usr/lib/ranger-admin/cred/lib/*" org.apache.ranger.credentialapi.buildks create sslTrustStore -value bigdata -provider jceks://file$(pwd)/ranger-trino.jceks

Apply the configuration and deploy the Trino cluster:

$ ./adc apply -f trino-cluster.yaml

The expected output contains a confirmation of success:

time="20260518133858UTC" level="info" msg="cluster trino applied to namespace trino"

Delete old pods so that Trino operator creates new ones from an updated config:

$ kubectl delete pods -n <trino-cluster-ns> -l app.kubernetes.io/instance=trino-cluster

Verify the Trino cluster pods:

$ kubectl get pods -n trino

The expected output is:

trino-cluster-coordinator-0   1/1     Running   0          4m49s
trino-cluster-worker-0        1/1     Running   0          4m49s

Found a mistake? Seleсt text and press Ctrl+Enter to report it