Configure LDAP and SSL for Trino on Kubernetes using Helm

Sergei Tikhomirov

Prerequisites

  • An ADH cluster (4.2.0 or later) is installed.

  • Trino is deployed in Kubernetes according to the instruction.

  • SSL is enabled for the ADH cluster. This step is optional but recommended for security purposes. This guide presumes that this step was completed.

NOTE
The Kerberos and LDAP authentications are mutually exclusive.

Step 1. Update Kubernetes secrets

Your Trino installation already uses a Kubernetes secret with ADH configuration files to work with unprotected ADH services. To enable LDAP/SSL and allow Trino to work with SSL-protected ADH services, adjust the ADH configuration files within the secret.

  1. Adjust the iceberg.properties file. The updated file should include the following properties:

    iceberg.properties
    connector.name=iceberg
hive.metastore.uri=thrift://tsn-adh-k8s-1.ru-central1.internal:9083
hive.metastore.authentication.type=NONE
hive.metastore.thrift.client.ssl.trust-certificate=/etc/ssl/truststore.jks
hive.metastore.thrift.client.ssl.trust-certificate-password=<password>
hive.metastore.thrift.impersonation.enabled=true
fs.hadoop.enabled=True
hive.hdfs.authentication.type=NONE
hive.hdfs.wire-encryption.enabled=true
hive.hdfs.impersonation.enabled=True
hive.config.resources=/opt/trino-server/etc/catalog/core-site.xml
hive.metastore.thrift.client.ssl.enabled=True

  2. If you use Trino with Ranger, update the Ranger configuration according to the instruction.

  3. Create a file with LDAP settings:

    password-authenticator
    password-authenticator.name=ldap
ldap.url=<ldap_url>
ldap.user-bind-pattern=<bind_pattern>
ldap.ssl.truststore.path=<truststore>
ldap.ssl.turststore.password=<password>
ldap.allow-insecure=false

    where:

    • <ldap_url> is the URL for LDAP connection, e.g. ldaps://ad01.adsw.io:636.

    • <bind_pattern> is the LDAP user bind pattern, e.g. CN=${USER},OU=kerberos,OU=adh,DC=ad,DC=ranger-test.

    • <truststore> is a path to truststore.

    • <password> is a password for truststore.

  4. Re-create the Kubernetes secret:

    $ kubectl delete secret <trino-config> -n <trino-cluster-ns>
$ kubectl create secret generic <trino-config> -n <trino-cluster-ns> --from-file=core-site.xml --from-file=iceberg.properties --from-file=password-authenticator

    where:

    • <trino-config> is the name of the secret with Hadoop/Trino configs.

    • <trino-cluster-ns> is the namespace used by the Trino cluster.

  5. Create a secret for the truststore:

    $ kubectl create secret generic ca-certs -n <trino-cluster-ns> --from-file=truststore.jks=/etc/ssl/truststore.jks

  6. To access Trino web UI and allow JDBC connections, generate a certificate for Ingress:

    $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout trino-cloud.ru-central1.internal.key -out trino-cloud.ru-central1.internal.crt -subj "/CN=trino-cloud.ru-central1.internal"

  7. Create a secret for incoming JDBC connections:

    $ kubectl create secret tls trino-tls-secret -n <trino-cluster-ns> --cert=trino-cloud.ru-central1.internal.crt --key=trino-cloud.ru-central1.internal.key

  8. Create a keystore for web TLS:

    $ openssl pkcs12 -export -in trino-cloud.ru-central1.internal.crt -inkey trino-cloud.ru-central1.internal.key -out keystore.p12 -name trino-cloud.ru-central1.internal

  9. Create a secret for the keystore:

    $ kubectl create secret generic trino-web-tls -n <trino-cluster-ns> --from-file=keystore.p12=./keystore.p12

  10. Configure your Ingress controller or load balancer to serve HTTPS using the TLS certificate stored in Kubernetes secret. For example, if Ingress is used, append the following parameters to your Ingress configuration file:

    tls:
    - hosts:
      - trino-cloud.ru-central1.internal (1)
      secretName: trino-tls-secret
    1 TLS settings for requests arriving from the given host name.

Step 2. Update the Trino cluster configuration

  1. Modify the trino_cluster_values.yaml configuration file by adding the LDAP, SSL, and web TLS blocks to it. The updated file should look as follows:

    trino_cluster_values.yaml
    image:
  registry: "<registry>"
  repository: "<image>"
  tag: "<tag>"

useRanger: false
configsSecretName: <trino-config>

worker:
  replicas: 2
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: "2"
      memory: 4Gi
coordinator:
  replicas: 1
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: "2"
      memory: 4Gi

ldap:
  enabled: true

ssl: (1)
  secretName: ca-certs
  trustStoreKey: truststore.jks
  trustStorePassword: bigdata

webTLS: (2)
  secretName: trino-web-tls
  keystoreKey: keystore.p12
  keystorePassword: bigdata
    1 SSL settings.
    2 Web TLS settings.

  2. Update the Trino cluster information:

    $ helm upgrade --install trino-cluster oci://"$PRIVATE_REGISTRY"/adc-enterprise/charts/trino-cluster --version <version> -f trino_cluster_values.yaml --namespace <trino-cluster-ns> --create-namespace

  3. Delete old pods so that Trino operator creates new ones from an updated config:

    $ kubectl delete pods -n <trino-cluster-ns> -l app.kubernetes.io/instance=trino-cluster

  4. Check that all the pods are in the Running state:

    $ kubectl get pods -n <trino-cluster-ns>

    The expected output is:

    NAME                             READY   STATUS    RESTARTS   AGE
ad-trino-cluster-coordinator-0   1/1     Running   0          4s
ad-trino-cluster-worker-0        1/1     Running   0          17s
ad-trino-cluster-worker-1        1/1     Running   0          4s

Step 3. Check the JDBC connection

  1. Connect to the Trino cluster over JDBC, for example, using DBeaver. For this, the JDBC connection string looks as follows:

    jdbc:trino://trino-cloud.ru-central1.internal:443?SSL=true&SSLTrustStorePath=<SSLTrustStorePath>&SSLTrustStorePassword=<SSLTrustStorePassword>&user=<USER>&password=<PWD>

    where:

    • <USER> — username of a user in LDAP.

    • <PWD> — password of a user in LDAP.

    • <SSLTrustStorePath> — path to the truststore with certificates used by DBeaver.

    • <SSLTrustStorePassword> — password for accessing the truststore.

  2. Once connected, verify the Trino cluster operability:

    SHOW CATALOGS;

    The expected output:

    Catalog   |
----------+
iceberg   |
system    |
Found a mistake? Seleсt text and press Ctrl+Enter to report it